"\333\3425\15[\215^o\202\232\321\223\321\225\17`\300t\302+pL\200][\223\305\246\12\365ho\224]\263p\177yd\341n\360\6'\273q\12J\264\346\241q\320:\205\322\7\352}\216\27\6un\347\214R\4\323\3700\25x\334nPS\204\372H\20\300\4\271uy\35\3316o,k{=[\371j\2531\2042\324Y\1\344%:p\36o\257!\360\220\333\244\273\242\207\335\211\330_\320\275\335\353\315\245('z\205\366O[, ) , ) == 0x0
00848 896 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
00849 896 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
00850 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 100, ) }, ... 100, ) == 0x0
00851 896 NtQueryValueKey (100, (100, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
00852 896 NtClose (100, ... ) == 0x0
00853 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 100, ) }, ... 100, ) == 0x0
00854 896 NtQueryValueKey (100, (100, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00855 896 NtClose (100, ... ) == 0x0
00856 896 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
00857 896 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
00858 896 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
00859 896 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
00860 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 100, ) }, ... 100, ) == 0x0
00861 896 NtQueryValueKey (100, (100, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00862 896 NtQueryValueKey (100, (100, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00863 896 NtQueryValueKey (100, (100, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00864 896 NtClose (100, ... ) == 0x0
00865 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 100, ) }, ... 100, ) == 0x0
00866 896 NtQueryValueKey (100, (100, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00867 896 NtQueryValueKey (100, (100, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00868 896 NtClose (100, ... ) == 0x0
00869 896 NtOpenDirectoryObject (0x2000f, {24, 0, 0x40, 0, 0, (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 100, ) }, ... 100, ) == 0x0
00870 896 NtOpenEvent (0x1f0003, {24, 100, 0x0, 0, 0, (0x1f0003, {24, 100, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00871 896 NtUserRegisterWindowMessage ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
00872 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00873 896 NtOpenKey (0x9, {24, 32, 0x40, 0, 0, (0x9, {24, 32, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00874 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00875 896 NtOpenKey (0x2000000, {24, 32, 0x40, 0, 0, (0x2000000, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00876 896 NtCreateSemaphore (0x1f0003, {24, 100, 0x80, 1334456, 0, (0x1f0003, {24, 100, 0x80, 1334456, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 104, ) }, 0, 2147483647, ... 104, ) == STATUS_OBJECT_NAME_EXISTS
00877 896 NtQueryPerformanceCounter (... {-1440623662, 16}, {3579545, 0}, ) == 0x0
00878 896 NtQueryPerformanceCounter (... {-1440623082, 16}, {3579545, 0}, ) == 0x0
00879 896 NtAllocateVirtualMemory (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
00880 896 NtCreateMutant (0x1f0001, {24, 100, 0x80, 0, 0, (0x1f0001, {24, 100, 0x80, 0, 0, "Local\ZonesCounterMutex"}, 0, ... 108, ) }, 0, ... 108, ) == STATUS_OBJECT_NAME_EXISTS
00881 896 NtCreateMutant (0x1f0001, {24, 100, 0x80, 0, 0, (0x1f0001, {24, 100, 0x80, 0, 0, "Local\ZonesCacheCounterMutex"}, 0, ... 112, ) }, 0, ... 112, ) == STATUS_OBJECT_NAME_EXISTS
00882 896 NtCreateMutant (0x1f0001, {24, 100, 0x80, 0, 0, (0x1f0001, {24, 100, 0x80, 0, 0, "Local\ZonesLockedCacheCounterMutex"}, 0, ... 116, ) }, 0, ... 116, ) == STATUS_OBJECT_NAME_EXISTS
00883 896 NtQueryDefaultUILanguage (1242164, ...
00884 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
00885 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482748, ) == 0x0
00886 896 NtQueryInformationToken (-2147482748, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
00887 896 NtClose (-2147482748, ... ) == 0x0
00888 896 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
00889 896 NtOpenKey (0x80000000, {24, -2147482748, 0x240, 0, 0, (0x80000000, {24, -2147482748, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00890 896 NtOpenKey (0x80000000, {24, -2147482748, 0x640, 0, 0, (0x80000000, {24, -2147482748, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
00891 896 NtQueryValueKey (-2147481452, (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00892 896 NtClose (-2147481452, ... ) == 0x0
00893 896 NtClose (-2147482748, ... ) == 0x0
00883 896 NtQueryDefaultUILanguage ... ) == 0x0
00894 896 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00895 896 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00896 896 NtRequestWaitReplyPort (28, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} (28, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0\0I\333B\0\0\0\0\361\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81848, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0\0I\333B\0\0\0\0\361\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 1252, 896, 81848, 0} (28, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0\0I\333B\0\0\0\0\361\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81848, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0\0I\333B\0\0\0\0\361\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ) ) == 0x0
00897 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0
00898 896 NtOpenKey (0x8, {24, 0, 0x40, 0, 0, (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00899 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0
00900 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0
00901 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1239488, ... ) }, 1239488, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00902 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0
00903 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0
00904 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0
00905 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1239552, ... ) }, 1239552, ... ) == 0x0
00906 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 120, {status=0x0, info=1}, ) }, 3, 33, ... 120, {status=0x0, info=1}, ) == 0x0
00907 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0
00908 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 124, {status=0x0, info=1}, ) }, 5, 96, ... 124, {status=0x0, info=1}, ) == 0x0
00909 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 124, ... 128, ) == 0x0
00910 896 NtClose (124, ... ) == 0x0
00911 896 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x900000), 0x0, 1056768, ) == 0x0
00912 896 NtClose (128, ... ) == 0x0
00913 896 NtUnmapViewOfSection (-1, 0x900000, ... ) == 0x0
00914 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0
00915 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 128, ... 124, ) == 0x0
00916 896 NtQuerySection (124, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
00917 896 NtClose (128, ... ) == 0x0
00918 896 NtMapViewOfSection (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
00919 896 NtClose (124, ... ) == 0x0
00920 896 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
00921 896 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
00922 896 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0
00923 896 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
00924 896 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
00925 896 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0
00926 896 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
00927 896 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
00928 896 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0
00929 896 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
00930 896 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
00931 896 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0
00932 896 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
00933 896 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
00934 896 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0
00935 896 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
00936 896 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
00937 896 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0
00938 896 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
00939 896 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
00940 896 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0
00941 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00942 896 NtAddAtom ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1241032, ... ) , 42, 1241032, ... ) == 0x0
00943 896 NtQueryDefaultUILanguage (1239716, ...
00944 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
00945 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482748, ) == 0x0
00946 896 NtQueryInformationToken (-2147482748, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
00947 896 NtClose (-2147482748, ... ) == 0x0
00948 896 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
00949 896 NtOpenKey (0x80000000, {24, -2147482748, 0x240, 0, 0, (0x80000000, {24, -2147482748, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00950 896 NtOpenKey (0x80000000, {24, -2147482748, 0x640, 0, 0, (0x80000000, {24, -2147482748, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
00951 896 NtQueryValueKey (-2147481452, (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00952 896 NtClose (-2147481452, ... ) == 0x0
00953 896 NtClose (-2147482748, ... ) == 0x0
00943 896 NtQueryDefaultUILanguage ... ) == 0x0
00954 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238556, ... ) }, 1238556, ... ) == 0x0
00955 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 124, {status=0x0, info=1}, ) }, 5, 96, ... 124, {status=0x0, info=1}, ) == 0x0
00956 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 124, ... 128, ) == 0x0
00957 896 NtClose (124, ... ) == 0x0
00958 896 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x380000), 0x0, 4096, ) == 0x0
00959 896 NtClose (128, ... ) == 0x0
00960 896 NtUnmapViewOfSection (-1, 0x380000, ... ) == 0x0
00961 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238152, ... ) }, 1238152, ... ) == 0x0
00962 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238896, (0x80100080, {24, 0, 0x40, 0, 1238896, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 128, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 128, {status=0x0, info=1}, ) == 0x0
00963 896 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 128, ... 124, ) == 0x0
00964 896 NtClose (128, ... ) == 0x0
00965 896 NtMapViewOfSection (124, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x380000), {0, 0}, 4096, ) == 0x0
00966 896 NtClose (124, ... ) == 0x0
00967 896 NtUnmapViewOfSection (-1, 0x380000, ... ) == 0x0
00968 896 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 124, {status=0x0, info=1}, ) }, 1, 96, ... 124, {status=0x0, info=1}, ) == 0x0
00969 896 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 124, ... 128, ) == 0x0
00970 896 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x380000), 0x0, 4096, ) == 0x0
00971 896 NtQueryInformationFile (124, 1238548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
00972 896 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00973 896 NtRequestWaitReplyPort (28, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} (28, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1|\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81849, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1|\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 1252, 896, 81849, 0} (28, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1|\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81849, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1|\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ) ) == 0x0
00974 896 NtClose (124, ... ) == 0x0
00975 896 NtClose (128, ... ) == 0x0
00976 896 NtUnmapViewOfSection (-1, 0x380000, ... ) == 0x0
00977 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0
00978 896 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
00979 896 NtUserSystemParametersInfo (104, 0, 2001084812, 0, ... ) == 0x1
00980 896 NtUserGetDC (0, ... ) == 0x1010052
00981 896 NtUserCallOneParam (16842834, 57, ... ) == 0x1
00982 896 NtUserSystemParametersInfo (38, 4, 2001086940, 0, ... ) == 0x1
00983 896 NtUserSystemParametersInfo (66, 12, 1240548, 0, ... ) == 0x1
00984 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
00985 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0
00986 896 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
00987 896 NtClose (128, ... ) == 0x0
00988 896 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 128, ) }, ... 128, ) == 0x0
00989 896 NtOpenProcessToken (-1, 0x8, ... 124, ) == 0x0
00990 896 NtAccessCheck (1333816, 124, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
00991 896 NtClose (124, ... ) == 0x0
00992 896 NtOpenKey (0x20019, {24, 128, 0x40, 0, 0, (0x20019, {24, 128, 0x40, 0, 0, "Control Panel\Desktop"}, ... 124, ) }, ... 124, ) == 0x0
00993 896 NtQueryValueKey (124, (124, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
00994 896 NtClose (124, ... ) == 0x0
00995 896 NtUserSystemParametersInfo (41, 500, 1240576, 0, ... ) == 0x1
00996 896 NtOpenProcessToken (-1, 0x8, ... 124, ) == 0x0
00997 896 NtAccessCheck (1333816, 124, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
00998 896 NtClose (124, ... ) == 0x0
00999 896 NtOpenKey (0x20019, {24, 128, 0x40, 0, 0, (0x20019, {24, 128, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 124, ) }, ... 124, ) == 0x0
01000 896 NtQueryValueKey (124, (124, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01001 896 NtClose (124, ... ) == 0x0
01002 896 NtUserSystemParametersInfo (27, 0, 2001085788, 0, ... ) == 0x1
01003 896 NtUserSystemParametersInfo (102, 0, 2001086828, 0, ... ) == 0x1
01004 896 NtClose (128, ... ) == 0x0
01005 896 NtUserSystemParametersInfo (4130, 0, 1241080, 0, ... ) == 0x1
01006 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 128, ) }, ... 128, ) == 0x0
01007 896 NtEnumerateValueKey (128, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
01008 896 NtClose (128, ... ) == 0x0
01009 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01010 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03b
01011 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03d
01012 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01013 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03f
01014 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01015 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c041
01016 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01017 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c043
01018 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c045
01019 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01020 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c047
01021 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01022 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c049
01023 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01024 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04b
01025 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01026 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04d
01027 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01028 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04f
01029 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c051
01030 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01031 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c053
01032 896 NtUserFindExistingCursorIcon (1240324, 1240340, 1240388, ... ) == 0x10011
01033 896 NtUserRegisterClassExWOW (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8177c055
01034 896 NtUserFindExistingCursorIcon (1240324, 1240340, 1240388, ... ) == 0x10011
01035 896 NtUserRegisterClassExWOW (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8177c057
01036 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01037 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c059
01038 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10013
01039 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05b
01040 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01041 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05d
01042 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01043 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05f
01044 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01045 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c017
01046 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01047 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c019
01048 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10013
01049 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c018
01050 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01051 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01a
01052 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01053 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01c
01054 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01055 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01e
01056 896 NtUserFindExistingCursorIcon (1240320, 1240336, 1240384, ... ) == 0x10011
01057 896 NtUserRegisterClassExWOW (1240320, 1240388, 1240404, 1240420, 0, 384, 0, ... ) == 0x8177c01b
01058 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01059 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c068
01060 896 NtUserFindExistingCursorIcon (1240328, 1240344, 1240392, ... ) == 0x10011
01061 896 NtUserRegisterClassExWOW (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c06a
01062 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
01063 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0
01064 896 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
01065 896 NtClose (128, ... ) == 0x0
01066 896 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_Classes"}, ... 128, ) }, ... 128, ) == 0x0
01067 896 NtSetInformationObject (130, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
01068 896 NtQueryKey (130, Name, 384, ... {Name= (130, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_CLASSES"}, 140, ) }, 140, ) == 0x0
01069 896 NtOpenKey (0x2000000, {24, 130, 0x40, 0, 0, (0x2000000, {24, 130, 0x40, 0, 0, "PROTOCOLS\Name-Space Handler\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01070 896 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\PROTOCOLS\Name-Space Handler"}, ... 124, ) }, ... 124, ) == 0x0
01071 896 NtAllocateVirtualMemory (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
01072 896 NtQueryKey (126, Name, 392, ... {Name= (126, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space HandlerS"}, 130, ) }, 130, ) == 0x0
01073 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
01074 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 132, ) == 0x0
01075 896 NtQueryInformationToken (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
01076 896 NtClose (132, ... ) == 0x0
01077 896 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_Classes\PROTOCOLS\Name-Space Handler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01078 896 NtEnumerateKey (126, 0, Node, 288, ... {LastWrite={0xdf7c22cc,0x1c74da8}, TitleIdx=0, Name= (126, 0, Node, 288, ... {LastWrite={0xdf7c22cc,0x1c74da8}, TitleIdx=0, Name="mk", Class=""}, 28, ) , Class=""}, 28, ) == 0x0
01079 896 NtEnumerateKey (126, 1, Node, 288, ... ) == STATUS_NO_MORE_ENTRIES
01080 896 NtClose (126, ... ) == 0x0
01081 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
01082 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 124, ) == 0x0
01083 896 NtQueryInformationToken (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
01084 896 NtClose (124, ... ) == 0x0
01085 896 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 124, ) }, ... 124, ) == 0x0
01086 896 NtSetInformationObject (124, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
01087 896 NtOpenKey (0x1, {24, 124, 0x40, 0, 0, (0x1, {24, 124, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01088 896 NtOpenKey (0x1, {24, 124, 0x40, 0, 0, (0x1, {24, 124, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01089 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 132, ) }, ... 132, ) == 0x0
01090 896 NtQueryValueKey (132, (132, "DisableImprovedZoneCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01091 896 NtClose (132, ... ) == 0x0
01092 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01093 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01094 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01095 896 NtOpenKey (0x1, {24, 124, 0x40, 0, 0, (0x1, {24, 124, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01096 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 132, ) }, ... 132, ) == 0x0
01097 896 NtOpenKey (0x1, {24, 124, 0x40, 0, 0, (0x1, {24, 124, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01098 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01099 896 NtClose (132, ... ) == 0x0
01100 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01101 896 NtOpenKey (0x20019, {24, 124, 0x40, 0, 0, (0x20019, {24, 124, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01102 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01103 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01104 896 NtOpenKey (0x20019, {24, 124, 0x40, 0, 0, (0x20019, {24, 124, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01105 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01106 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01107 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01108 896 NtOpenKey (0x1, {24, 124, 0x40, 0, 0, (0x1, {24, 124, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01109 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 132, ) }, ... 132, ) == 0x0
01110 896 NtOpenKey (0x1, {24, 124, 0x40, 0, 0, (0x1, {24, 124, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01111 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_OBJECT_CACHING"}, ... 136, ) }, ... 136, ) == 0x0
01112 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01113 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01114 896 NtClose (136, ... ) == 0x0
01115 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_ZONE_ELEVATION"}, ... 136, ) }, ... 136, ) == 0x0
01116 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01117 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01118 896 NtClose (136, ... ) == 0x0
01119 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_MIME_HANDLING"}, ... 136, ) }, ... 136, ) == 0x0
01120 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01121 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01122 896 NtClose (136, ... ) == 0x0
01123 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_MIME_SNIFFING"}, ... 136, ) }, ... 136, ) == 0x0
01124 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01125 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01126 896 NtClose (136, ... ) == 0x0
01127 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_WINDOW_RESTRICTIONS"}, ... 136, ) }, ... 136, ) == 0x0
01128 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01129 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01130 896 NtClose (136, ... ) == 0x0
01131 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_WEBOC_POPUPMANAGEMENT"}, ... 136, ) }, ... 136, ) == 0x0
01132 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01133 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01134 896 NtClose (136, ... ) == 0x0
01135 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_BEHAVIORS"}, ... 136, ) }, ... 136, ) == 0x0
01136 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01137 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "*", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
01138 896 NtClose (136, ... ) == 0x0
01139 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_DISABLE_MK_PROTOCOL"}, ... 136, ) }, ... 136, ) == 0x0
01140 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01141 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "*", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
01142 896 NtClose (136, ... ) == 0x0
01143 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_LOCALMACHINE_LOCKDOWN"}, ... 136, ) }, ... 136, ) == 0x0
01144 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01145 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01146 896 NtClose (136, ... ) == 0x0
01147 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_SECURITYBAND"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01148 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_RESTRICT_ACTIVEXINSTALL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01149 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_VALIDATE_NAVIGATE_URL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01150 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_RESTRICT_FILEDOWNLOAD"}, ... 136, ) }, ... 136, ) == 0x0
01151 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01152 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01153 896 NtClose (136, ... ) == 0x0
01154 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_ADDON_MANAGEMENT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01155 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_PROTOCOL_LOCKDOWN"}, ... 136, ) }, ... 136, ) == 0x0
01156 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01157 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01158 896 NtClose (136, ... ) == 0x0
01159 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_HTTP_USERNAME_PASSWORD_DISABLE"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01160 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_SAFE_BINDTOOBJECT"}, ... 136, ) }, ... 136, ) == 0x0
01161 896 NtQueryValueKey (136, (136, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01162 896 NtQueryValueKey (136, (136, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01163 896 NtClose (136, ... ) == 0x0
01164 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_UNC_SAVEDFILECHECK"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01165 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_GET_URL_DOM_FILEPATH_UNENCODED"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01166 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_TABBED_BROWSING"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01167 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_SSLUX"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01168 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_DISABLE_NAVIGATION_SOUNDS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01169 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_DISABLE_LEGACY_COMPRESSION"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01170 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_FORCE_ADDR_AND_STATUS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01171 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_XMLHTTP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01172 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_DISABLE_TELNET_PROTOCOL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01173 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_FEEDS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01174 896 NtOpenKey (0x1, {24, 132, 0x40, 0, 0, (0x1, {24, 132, 0x40, 0, 0, "FEATURE_BLOCK_INPUT_PROMPTS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01175 896 NtClose (132, ... ) == 0x0
01176 896 NtTestAlert (... ) == 0x0
01177 896 NtContinue (1244464, 1, ...
01178 896 NtSetInformationThread (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x40a200,}, 4, ... ) == 0x0
01179 896 NtCreateEvent (0x1f0003, {24, 100, 0x80, 1245092, 0, (0x1f0003, {24, 100, 0x80, 1245092, 0, "VT_3"}, 1, 0, ... 132, ) }, 1, 0, ... 132, ) == 0x0
01180 896 NtCreateSection (0xe, {24, 0, 0x40, 1245092, 0, (0xe, {24, 0, 0x40, 1245092, 0, "\BaseNamedObjects\W32_Virtu"}, {27086, 0}, 64, 134217728, 0, ... 136, ) }, {27086, 0}, 64, 134217728, 0, ... 136, ) == 0x0
01181 896 NtMapViewOfSection (136, -1, (0x0), 0, 27086, 0x0, 27086, 2, 0, 64, ... (0x380000), 0x0, 28672, ) == 0x0
01182 896 NtOpenProcessToken (-1, 0x20, ... 140, ) == 0x0
01183 896 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
01184 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01185 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 144, ) }, ... 144, ) == 0x0
01186 896 NtQueryValueKey (144, (144, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01187 896 NtClose (144, ... ) == 0x0
01188 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01189 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 144, ) == 0x0
01190 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0
01191 896 NtQuerySystemTime (... {1444454164, 29929616}, ) == 0x0
01192 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 152, ) == 0x0
01193 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01194 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
01195 896 NtQueryInformationProcess (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
01196 896 NtQueryInformationProcess (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
01197 896 NtAllocateVirtualMemory (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
01198 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 156, ) == 0x0
01199 896 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 160, ) == 0x0
01200 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 164, ) }, ... 164, ) == 0x0
01201 896 NtOpenKey (0x20019, {24, 164, 0x40, 0, 0, (0x20019, {24, 164, 0x40, 0, 0, "ActiveComputerName"}, ... 168, ) }, ... 168, ) == 0x0
01202 896 NtQueryValueKey (168, (168, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (168, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (168, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
01203 896 NtClose (168, ... ) == 0x0
01204 896 NtClose (164, ... ) == 0x0
01205 896 NtCreateIoCompletion (0x1f0003, 0x0, 0, ... 164, ) == 0x0
01206 896 NtCreateIoCompletion (0x1f0003, 0x0, -1, ... 168, ) == 0x0
01207 896 NtDuplicateObject (-1, 164, -1, 0x0, 0, 2, ... 172, ) == 0x0
01208 896 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
01209 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 176, ) == 0x0
01210 896 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
01211 896 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
01212 896 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1243252, (0xc0100080, {24, 0, 0x40, 0, 1243252, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
01213 896 NtSetInformationFile (180, 1243308, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
01214 896 NtSetInformationFile (180, 1243296, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
01215 896 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
01216 896 NtWriteFile (180, 157, 0, 0, (180, 157, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
01217 896 NtAllocateVirtualMemory (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
01218 896 NtReadFile (180, 157, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, (180, 157, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
01219 896 NtFsControlFile (180, 157, 0x0, 0x0, 0x11c017, (180, 157, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68}, (180, 157, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
01220 896 NtFsControlFile (180, 157, 0x0, 0x0, 0x11c017, (180, 157, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0Pt\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \0Pt\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (180, 157, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0Pt\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) == 0x103
01221 896 NtFsControlFile (180, 157, 0x0, 0x0, 0x11c017, (180, 157, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36}, (180, 157, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
01222 896 NtClose (176, ... ) == 0x0
01223 896 NtClose (180, ... ) == 0x0
01224 896 NtAdjustPrivilegesToken (140, 0, 1245096, 0, 0, 0, ... ) == 0x0
01225 896 NtClose (140, ... ) == 0x0
01226 896 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 3801088, 65536, ) == 0x0
01227 896 NtQuerySystemInformation (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
01228 896 NtCreateSection (0xf0007, 0x0, {18400, 0}, 4, 134217728, 0, ... 140, ) == 0x0
01229 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3b0000), {0, 0}, 20480, ) == 0x0
01230 896 NtUnmapViewOfSection (-1, 0x3b0000, ... ) == 0x0
01231 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3b0000), {0, 0}, 20480, ) == 0x0
01232 896 NtFreeVirtualMemory (-1, (0x3a0000), 0, 32768, ... (0x3a0000), 65536, ) == 0x0
01233 896 NtUnmapViewOfSection (-1, 0x3b0000, ... ) == 0x0
01234 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01235 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01236 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01237 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01238 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01239 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01240 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01241 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01242 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01243 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01244 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {580, 0}, ... 180, ) == 0x0
01245 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 176, ) }, ... 176, ) == 0x0
01246 896 NtMapViewOfSection (176, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
01247 896 NtClose (176, ... ) == 0x0
01248 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01249 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01250 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01251 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01252 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01253 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01254 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01255 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01256 896 NtAllocateVirtualMemory (180, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
01257 896 NtAllocateVirtualMemory (180, 28893184, 0, 8192, 4096, 4, ... 28893184, 8192, ) == 0x0
01258 896 NtProtectVirtualMemory (180, (0x1b8e000), 4096, 260, ... (0x1b8e000), 4096, 4, ) == 0x0
01259 896 NtCreateThread (0x1f03ff, 0x0, 180, 1243840, 1243784, 1, ... 176, {580, 376}, ) == 0x0
01260 896 NtRequestWaitReplyPort (28, {28, 56, new_msg, 0, 0, 0, 0, 0} (28, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\260\0\0\0D\2\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\260\0\0\0D\2\0\0x\1\0\0" ) ... {28, 56, reply, 0, 1252, 896, 81850, 0} (28, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\260\0\0\0D\2\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\260\0\0\0D\2\0\0x\1\0\0" ) ) == 0x0
01261 896 NtResumeThread (176, ... 1, ) == 0x0
01262 896 NtDelayExecution (0, {-100000, -1}, ... ) == 0x0
01263 896 NtClose (180, ... ) == 0x0
01264 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01265 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01266 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {640, 0}, ... 180, ) == 0x0
01267 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01268 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
01269 896 NtClose (184, ... ) == 0x0
01270 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01271 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01272 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01273 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01274 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01275 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01276 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01277 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01278 896 NtClose (180, ... ) == 0x0
01279 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01280 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01281 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {652, 0}, ... 180, ) == 0x0
01282 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01283 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
01284 896 NtClose (184, ... ) == 0x0
01285 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01286 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01287 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01288 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01289 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01290 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01291 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01292 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01293 896 NtClose (180, ... ) == 0x0
01294 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01295 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01296 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {816, 0}, ... 180, ) == 0x0
01297 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01298 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01299 896 NtClose (184, ... ) == 0x0
01300 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01301 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01302 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01303 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01304 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01305 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01306 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01307 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01308 896 NtClose (180, ... ) == 0x0
01309 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01310 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01311 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {904, 0}, ... 180, ) == 0x0
01312 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01313 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01314 896 NtClose (184, ... ) == 0x0
01315 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01316 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01317 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01318 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01319 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01320 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01321 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01322 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01323 896 NtClose (180, ... ) == 0x0
01324 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01325 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01326 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1000, 0}, ... 180, ) == 0x0
01327 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01328 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff50000), 0x0, 28672, ) == 0x0
01329 896 NtClose (184, ... ) == 0x0
01330 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01331 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Md\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01332 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01333 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01334 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01335 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01336 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01337 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01338 896 NtClose (180, ... ) == 0x0
01339 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01340 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01341 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1044, 0}, ... 180, ) == 0x0
01342 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01343 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01344 896 NtClose (184, ... ) == 0x0
01345 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01346 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01347 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01348 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01349 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01350 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01351 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01352 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01353 896 NtClose (180, ... ) == 0x0
01354 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01355 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01356 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1196, 0}, ... 180, ) == 0x0
01357 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01358 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01359 896 NtClose (184, ... ) == 0x0
01360 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01361 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01362 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01363 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01364 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01365 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01366 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01367 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01368 896 NtClose (180, ... ) == 0x0
01369 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01370 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01371 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1468, 0}, ... 180, ) == 0x0
01372 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01373 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01374 896 NtClose (184, ... ) == 0x0
01375 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01376 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01377 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01378 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01379 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01380 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01381 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01382 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01383 896 NtClose (180, ... ) == 0x0
01384 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01385 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01386 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1720, 0}, ... 180, ) == 0x0
01387 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01388 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01389 896 NtClose (184, ... ) == 0x0
01390 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01391 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01392 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01393 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01394 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01395 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01396 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01397 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01398 896 NtClose (180, ... ) == 0x0
01399 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01400 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01401 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 180, ) == 0x0
01402 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01403 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01404 896 NtClose (184, ... ) == 0x0
01405 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01406 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01407 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01408 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01409 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01410 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01411 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01412 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01413 896 NtClose (180, ... ) == 0x0
01414 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01415 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01416 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 180, ) == 0x0
01417 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01418 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01419 896 NtClose (184, ... ) == 0x0
01420 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01421 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01422 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01423 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01424 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01425 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01426 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01427 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01428 896 NtClose (180, ... ) == 0x0
01429 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01430 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01431 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {196, 0}, ... 180, ) == 0x0
01432 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01433 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01434 896 NtClose (184, ... ) == 0x0
01435 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01436 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01437 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01438 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01439 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01440 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01441 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01442 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01443 896 NtClose (180, ... ) == 0x0
01444 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01445 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01446 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {160, 0}, ... 180, ) == 0x0
01447 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01448 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01449 896 NtClose (184, ... ) == 0x0
01450 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01451 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01452 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01453 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01454 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01455 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01456 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01457 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01458 896 NtClose (180, ... ) == 0x0
01459 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01460 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01461 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {260, 0}, ... 180, ) == 0x0
01462 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01463 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01464 896 NtClose (184, ... ) == 0x0
01465 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01466 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01467 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01468 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01469 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01470 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01471 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01472 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01473 896 NtClose (180, ... ) == 0x0
01474 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01475 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01476 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {288, 0}, ... 180, ) == 0x0
01477 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01478 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01479 896 NtClose (184, ... ) == 0x0
01480 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01481 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01482 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01483 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01484 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01485 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01486 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01487 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01488 896 NtClose (180, ... ) == 0x0
01489 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01490 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01491 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {412, 0}, ... 180, ) == 0x0
01492 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01493 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01494 896 NtClose (184, ... ) == 0x0
01495 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01496 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01497 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01498 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01499 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01500 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01501 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01502 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01503 896 NtClose (180, ... ) == 0x0
01504 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01505 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01506 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 180, ) == 0x0
01507 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01508 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01509 896 NtClose (184, ... ) == 0x0
01510 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01511 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01512 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01513 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01514 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01515 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01516 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01517 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01518 896 NtClose (180, ... ) == 0x0
01519 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01520 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01521 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {556, 0}, ... 180, ) == 0x0
01522 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01523 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01524 896 NtClose (184, ... ) == 0x0
01525 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01526 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01527 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01528 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01529 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01530 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01531 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01532 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01533 896 NtClose (180, ... ) == 0x0
01534 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01535 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01536 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1204, 0}, ... 180, ) == 0x0
01537 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01538 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01539 896 NtClose (184, ... ) == 0x0
01540 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01541 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01542 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01543 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01544 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01545 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01546 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01547 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01548 896 NtClose (180, ... ) == 0x0
01549 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01550 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01551 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1452, 0}, ... 180, ) == 0x0
01552 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01553 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01554 896 NtClose (184, ... ) == 0x0
01555 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01556 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01557 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01558 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01559 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01560 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01561 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01562 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01563 896 NtClose (180, ... ) == 0x0
01564 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01565 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01566 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {784, 0}, ... 180, ) == 0x0
01567 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01568 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01569 896 NtClose (184, ... ) == 0x0
01570 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01571 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01572 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01573 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01574 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01575 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01576 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01577 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01578 896 NtClose (180, ... ) == 0x0
01579 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01580 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01581 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {488, 0}, ... 180, ) == 0x0
01582 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01583 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01584 896 NtClose (184, ... ) == 0x0
01585 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01586 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01587 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01588 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01589 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01590 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01591 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01592 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01593 896 NtClose (180, ... ) == 0x0
01594 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01595 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01596 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1208, 0}, ... 180, ) == 0x0
01597 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01598 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01599 896 NtClose (184, ... ) == 0x0
01600 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01601 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01602 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01603 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01604 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01605 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01606 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01607 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01608 896 NtClose (180, ... ) == 0x0
01609 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01610 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01611 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {168, 0}, ... 180, ) == 0x0
01612 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01613 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01614 896 NtClose (184, ... ) == 0x0
01615 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01616 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01617 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01618 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01619 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01620 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01621 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01622 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01623 896 NtClose (180, ... ) == 0x0
01624 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01625 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01626 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {764, 0}, ... 180, ) == 0x0
01627 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01628 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01629 896 NtClose (184, ... ) == 0x0
01630 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01631 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01632 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01633 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01634 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01635 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01636 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01637 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01638 896 NtClose (180, ... ) == 0x0
01639 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01640 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01641 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {868, 0}, ... 180, ) == 0x0
01642 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01643 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01644 896 NtClose (184, ... ) == 0x0
01645 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01646 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01647 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01648 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01649 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01650 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01651 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01652 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01653 896 NtClose (180, ... ) == 0x0
01654 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01655 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01656 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {808, 0}, ... 180, ) == 0x0
01657 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01658 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01659 896 NtClose (184, ... ) == 0x0
01660 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01661 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01662 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01663 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01664 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01665 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01666 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01667 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01668 896 NtClose (180, ... ) == 0x0
01669 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01670 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01671 896 NtOpenProcess (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 180, ) == 0x0
01672 896 NtOpenSection (0xe, {24, 100, 0x0, 0, 0, (0xe, {24, 100, 0x0, 0, 0, "W32_Virtu"}, ... 184, ) }, ... 184, ) == 0x0
01673 896 NtMapViewOfSection (184, 180, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
01674 896 NtClose (184, ... ) == 0x0
01675 896 NtProtectVirtualMemory (180, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
01676 896 NtWriteVirtualMemory (180, 0x7c90d682, (180, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01677 896 NtProtectVirtualMemory (180, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01678 896 NtWriteVirtualMemory (180, 0x7c90dcfd, (180, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01679 896 NtProtectVirtualMemory (180, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01680 896 NtWriteVirtualMemory (180, 0x7c90d754, (180, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01681 896 NtProtectVirtualMemory (180, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
01682 896 NtWriteVirtualMemory (180, 0x7c90d769, (180, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
01683 896 NtClose (180, ... ) == 0x0
01684 896 NtMapViewOfSection (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01685 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01686 896 NtClose (140, ... ) == 0x0
01687 896 NtClose (132, ... ) == 0x0
01688 896 NtRequestWaitReplyPort (28, {20, 48, new_msg, 0, 40, 3297224, -1, 3277240} (28, {20, 48, new_msg, 0, 40, 3297224, -1, 3277240} "\0\0\0\0%\2\2\0\0\02\0\264\374\22\0\1\0<\0" ... {20, 48, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0%\2\2\0\0\0\0\0\264\374\22\0\1\0<\0" ) ... {20, 48, reply, 0, 1252, 896, 81895, 0} (28, {20, 48, new_msg, 0, 40, 3297224, -1, 3277240} "\0\0\0\0%\2\2\0\0\02\0\264\374\22\0\1\0<\0" ... {20, 48, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0%\2\2\0\0\0\0\0\264\374\22\0\1\0<\0" ) ) == 0x0
01689 896 NtClose (36, ... ) == 0x0
01690 896 NtCreateMutant (0x1f0001, {24, 100, 0x80, 0, 0, (0x1f0001, {24, 100, 0x80, 0, 0, "RpcPatch_Mutex"}, 0, ... 36, ) }, 0, ... 36, ) == 0x0
01691 896 NtOpenEvent (0x100000, {24, 100, 0x0, 0, 0, (0x100000, {24, 100, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 132, ) }, ... 132, ) == 0x0
01692 896 NtWaitForSingleObject (132, 0, {-1800000000, -1}, ... ) == 0x0
01693 896 NtClose (132, ... ) == 0x0
01694 896 NtDeviceIoControlFile (96, 0, 0x0, 0x0, 0x390008, (96, 0, 0x0, 0x0, 0x390008, "Z\205\35\11!,\22-\316\23\375\303\346\272\335Zd\270\311\247)P\274\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
01695 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
01696 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
01697 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
01698 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
01699 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
01700 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
01701 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
01702 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482748, 2, ) }, 0, 0x0, 0, ... -2147482748, 2, ) == 0x0
01703 896 NtSetValueKey (-2147482748, (-2147482748, "Seed", 0, 3, "\302(!\346\367\362pe\340\320\263`?\250\250rX\<~\324\375\3511v\235\353m\255\260\331\320\23\6H\0\376m\213\355p\257Pz\346N\374\202\265k\256\2644\177\310^AN\307\303\341\342s0\230P\226U}\227-4\20\357\21197\15\205v", 80, ... ) , 0, 3, (-2147482748, "Seed", 0, 3, "\302(!\346\367\362pe\340\320\263`?\250\250rX\<~\324\375\3511v\235\353m\255\260\331\320\23\6H\0\376m\213\355p\257Pz\346N\374\202\265k\256\2644\177\310^AN\307\303\341\342s0\230P\226U}\227-4\20\357\21197\15\205v", 80, ... ) , 80, ... ) == 0x0
01704 896 NtClose (-2147482748, ... ) == 0x0
01694 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "eO\322\34\200(\303Yqk\331\327PF\310D\264\371rU\273\323~\14\11\343=\23r\341\371\245E\222\315=@\251\227$\323P\262\16\302}\263q\247F\37C\260\346Z\210^\240\11\34\201\256B\31y\255~(n\307\227\376\250lcI\32\206\21VzD\353\371\372\211\361O\201\177\271\31\203yG\17\227[\275\2113\36\260\17\233\226I\357'\335\204\342\275WL\360$$\306x\27\215\304\321j\\213\241\272\345\251\305\242.\272?\35\22h\351{S;\2\207\351sx\205P\305\272\273|\357\217b+\204D\11#r\11\331s\344?\210\25\372\335\360vD\277\231\30\271 n\(\12\341\2\222\2015\234\22M\40\250\245\327\377g0\250\27\254\221u\207d_[\304T\26\17\240\7a\260\350k\261\361\352'\336\315\10\250\366P1\327\351\263\312#\347h\272XD\261\252\366\211\236\225\257.\313@p\350\325\325\", ) , ) == 0x0
01705 896 NtDeviceIoControlFile (96, 0, 0x0, 0x0, 0x390008, (96, 0, 0x0, 0x0, 0x390008, "Z\205\35\11!,\22-\316\23\375\303\346\272\237\317\333bj\22R\226\333d\270\311\247)P\274\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
01706 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
01707 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
01708 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
01709 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
01710 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
01711 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
01712 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
01713 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482748, 2, ) }, 0, 0x0, 0, ... -2147482748, 2, ) == 0x0
01714 896 NtSetValueKey (-2147482748, (-2147482748, "Seed", 0, 3, "o\227\13\271\376\367:\317\255\322'\216\362 Wv\233\212\376\206\251\337%GQ\2\352\377\315\354\350q\225\347\366\30B\204\266C\26vJ\263\34\263\33p\237\323\257\275\36\5\305\315PP\340\335\344L'M]\372\310\225\201\23\21\341g0\264sl\341\266\315", 80, ... ) , 0, 3, (-2147482748, "Seed", 0, 3, "o\227\13\271\376\367:\317\255\322'\216\362 Wv\233\212\376\206\251\337%GQ\2\352\377\315\354\350q\225\347\366\30B\204\266C\26vJ\263\34\263\33p\237\323\257\275\36\5\305\315PP\340\335\344L'M]\372\310\225\201\23\21\341g0\264sl\341\266\315", 80, ... ) , 80, ... ) == 0x0
01715 896 NtClose (-2147482748, ... ) == 0x0
01705 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\230G\213\302\12#\261d)\267\252\210\203\277An"%\342\363\1\215\236Fm\324\377U*\352Qg\272\243nnT\301\4\0m\243K\27\374\0\326\201J\263=\276\2200]\350t\33\12\352\22\314%\313zE\332]\305\36+w^\2aEpp\227\331\275=\310\212\343\3269sa\21\311\251z\2019\337\225\221x\344\2751\207\216T\351\272\245\227Y\214\347\363\214?\226{\260\304l\200\222\243\2218\363\253.2\227T\340\246C\337\11n\277\306P\322\323\345K\247\333\213\356N\13@kK4\334\224\36S\306u1\305{G\346G\4l^\343\201\243\374\177$\303\09\31\254\213\212\223CX\263\304\3343\376\245p\255\23\264T+\3\5\225j\213\254\21\12\354a\333\234\25\276\353>\343\334H\11\333[\36\16\301\342zwRx%\267\37\23?\251u\330\227j\365\371\230\351\322)-r\343\206kiI\307\355", ) %\342\363\1\215\236Fm\324\377U*\352Qg\272\243nnT\301\4\0m\243K\27\374\0\326\201J\263=\276\2200]\350t\33\12\352\22\314%\313zE\332]\305\36+w^\2aEpp\227\331\275=\310\212\343\3269sa\21\311\251z\2019\337\225\221x\344\2751\207\216T\351\272\245\227Y\214\347\363\214?\226{\260\304l\200\222\243\2218\363\253.2\227T\340\246C\337\11n\277\306P\322\323\345K\247\333\213\356N\13@kK4\334\224\36S\306u1\305{G\346G\4l^\343\201\243\374\177$\303\09\31\254\213\212\223CX\263\304\3343\376\245p\255\23\264T+\3\5\225j\213\254\21\12\354a\333\234\25\276\353>\343\334H\11\333[\36\16\301\342zwRx%\267\37\23?\251u\330\227j\365\371\230\351\322)-r\343\206kiI\307\355", ) == 0x0
01716 896 NtDeviceIoControlFile (96, 0, 0x0, 0x0, 0x390008, (96, 0, 0x0, 0x0, 0x390008, "Z\205\35\11!,\22-\316\23\375\303\346\272\237\317\333bj\22R\324N\333bj\22R\226\333d\270\311\247)P\274\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
01717 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
01718 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
01719 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
01720 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
01721 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
01722 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
01723 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
01724 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482748, 2, ) }, 0, 0x0, 0, ... -2147482748, 2, ) == 0x0
01725 896 NtSetValueKey (-2147482748, (-2147482748, "Seed", 0, 3, "\222\320\211\2051\22\366w\256\360~\331\22\12\17\237\22"\315\331\23\305\202\221-(&j\235c\14\24":\3711Kqq>\311m\223\343\235\352\251\255\317)\4\301\324\261\347"\355&\5OL,n\272\243\24\355\201\36\200\345c\364M\14L\265\271\351*", 80, ... ) , 0, 3, (-2147482748, "Seed", 0, 3, "\222\320\211\2051\22\366w\256\360~\331\22\12\17\237\22"\315\331\23\305\202\221-(&j\235c\14\24":\3711Kqq>\311m\223\343\235\352\251\255\317)\4\301\324\261\347"\355&\5OL,n\272\243\24\355\201\36\200\345c\364M\14L\265\271\351*", 80, ... ) \315\331\23\305\202\221-(&j\235c\14\24 (-2147482748, "Seed", 0, 3, "\222\320\211\2051\22\366w\256\360~\331\22\12\17\237\22"\315\331\23\305\202\221-(&j\235c\14\24":\3711Kqq>\311m\223\343\235\352\251\255\317)\4\301\324\261\347"\355&\5OL,n\272\243\24\355\201\36\200\345c\364M\14L\265\271\351*", 80, ... ) \355&\5OL,n\272\243\24\355\201\36\200\345c\364M\14L\265\271\351*", 80, ... ) == 0x0
01726 896 NtClose (-2147482748, ... ) == 0x0
01716 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "dO\3\6\33\211\325\217\360\325\325\254\2425\377\276\270\325B9?}x\324E\2134\253\373\266\13\232\13\22\215\341\234D*;\35%+\227\246\247g\304\340\6\267\263:\363\313\207#\360\217\260A\33\362\314\370\343\16\304\20\4e\324\32+\17\346\210\254\365x(\303p\327uwP\371\242\3768(\254\266\321\346s\24"\200\247\247\17\371\370\270\246\263\31\315\7t\2623\377L\310?\376\322\26\350\373z\216\302f\204\14Q\366\231\241#F\253\267\231\12~F\204\254"g9\25\224R\213\250\332\16_D\334l\265\6Y^\362!(\250s\139\3^4\320t\1\310\4\363S\21\0\225\371h\231\25\27\2<\2742\6\177\4\344y\22\246\27e\24\31zc\30I\375?\337\372\204`(\202\24\241\244k\301\334\344\17\242\14\224}\303S\\240\250\246\213G\234\21m\276LY3\320\244\36\372\30\327n-4;\22@\330J\331", ) \200\247\247\17\371\370\270\246\263\31\315\7t\2623\377L\310?\376\322\26\350\373z\216\302f\204\14Q\366\231\241#F\253\267\231\12~F\204\254 ... {status=0x0, info=256}, "dO\3\6\33\211\325\217\360\325\325\254\2425\377\276\270\325B9?}x\324E\2134\253\373\266\13\232\13\22\215\341\234D*;\35%+\227\246\247g\304\340\6\267\263:\363\313\207#\360\217\260A\33\362\314\370\343\16\304\20\4e\324\32+\17\346\210\254\365x(\303p\327uwP\371\242\3768(\254\266\321\346s\24"\200\247\247\17\371\370\270\246\263\31\315\7t\2623\377L\310?\376\322\26\350\373z\216\302f\204\14Q\366\231\241#F\253\267\231\12~F\204\254"g9\25\224R\213\250\332\16_D\334l\265\6Y^\362!(\250s\139\3^4\320t\1\310\4\363S\21\0\225\371h\231\25\27\2<\2742\6\177\4\344y\22\246\27e\24\31zc\30I\375?\337\372\204`(\202\24\241\244k\301\334\344\17\242\14\224}\303S\\240\250\246\213G\234\21m\276LY3\320\244\36\372\30\327n-4;\22@\330J\331", ) , ) == 0x0
01727 896 NtDeviceIoControlFile (96, 0, 0x0, 0x0, 0x390008, (96, 0, 0x0, 0x0, 0x390008, "Z\205\35\11!,\22-\316\23\375\303\346\272\237\317\333bj\22R\324N\333bj\22R\324N\333bj\22R\226\333d\270\311\247)P\274\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
01728 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
01729 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
01730 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
01731 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
01732 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
01733 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
01734 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
01735 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482748, 2, ) }, 0, 0x0, 0, ... -2147482748, 2, ) == 0x0
01736 896 NtSetValueKey (-2147482748, (-2147482748, "Seed", 0, 3, "\372\10&\246\26\347\30\34~\332\260\305\244n\332\205\234\323!"\22\316\371?\227\344n\325:\321\375\217\265p\13\202y\341\207\372w \5\306!\16\367\264\252"\317j8\17\33\14\213\336\307\231\32\267\300\320\34\230\216\374\220^\273\30\232Ha\177\25T\14a", 80, ... ) , 0, 3, (-2147482748, "Seed", 0, 3, "\372\10&\246\26\347\30\34~\332\260\305\244n\332\205\234\323!"\22\316\371?\227\344n\325:\321\375\217\265p\13\202y\341\207\372w \5\306!\16\367\264\252"\317j8\17\33\14\213\336\307\231\32\267\300\320\34\230\216\374\220^\273\30\232Ha\177\25T\14a", 80, ... ) \22\316\371?\227\344n\325:\321\375\217\265p\13\202y\341\207\372w \5\306!\16\367\264\252 (-2147482748, "Seed", 0, 3, "\372\10&\246\26\347\30\34~\332\260\305\244n\332\205\234\323!"\22\316\371?\227\344n\325:\321\375\217\265p\13\202y\341\207\372w \5\306!\16\367\264\252"\317j8\17\33\14\213\336\307\231\32\267\300\320\34\230\216\374\220^\273\30\232Ha\177\25T\14a", 80, ... ) , 80, ... ) == 0x0
01737 896 NtClose (-2147482748, ... ) == 0x0
01727 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "_f\242\360\353g\10\14cJ\337y\17\11\363J\323\36\367\201\216\2476\20t-\26\302\273o\327\214\232\12\200JB,t\360+\26\34\7\264\210\364\242$i\275r\230x*\1\213\301\363$\360.\372\241?i"/\1\341@Z\277\202#T\275\367\307\3>\341\256#$\326o9\15\4\6Hf\333-\244\260O\307k4\220\5\373\343\253\14\215L\333\327B0\252;\263\356\11\36\234\347t\270BMv\231\344\23\357\263\343\264iqVE\252Nx\322\250\225\354\33\366C\305\14\223\31{\301\216\21c\214\244m\2\233\357\372\3461\217\10\354s\7B\277\20\346\33\204z\363E\275\335\204\250\233\313\237\343\337r\2\212\3400\310\364m:\361\355m\341i)z]O\324z\305\222o\372\345I\37\357\212a\316/1\27\257\313/\262y]\226\275d\246\232\1R\3350\216\332\315\342\224yI\226\261u\353\200\247r|\264\203\332", ) /\1\341@Z\277\202#T\275\367\307\3>\341\256#$\326o9\15\4\6Hf\333-\244\260O\307k4\220\5\373\343\253\14\215L\333\327B0\252;\263\356\11\36\234\347t\270BMv\231\344\23\357\263\343\264iqVE\252Nx\322\250\225\354\33\366C\305\14\223\31{\301\216\21c\214\244m\2\233\357\372\3461\217\10\354s\7B\277\20\346\33\204z\363E\275\335\204\250\233\313\237\343\337r\2\212\3400\310\364m:\361\355m\341i)z]O\324z\305\222o\372\345I\37\357\212a\316/1\27\257\313/\262y]\226\275d\246\232\1R\3350\216\332\315\342\224yI\226\261u\353\200\247r|\264\203\332", ) == 0x0
01738 896 NtDeviceIoControlFile (96, 0, 0x0, 0x0, 0x390008, (96, 0, 0x0, 0x0, 0x390008, "Z\205\35\11!,\22-\316\23\375\303\346\272\237\317\333bj\22R\324N\333bj\22R\324N\333bj\22R\324N\333bj\22R\226\333d\270\311\247)P\274\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
01739 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
01740 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
01741 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
01742 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
01743 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
01744 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
01745 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
01746 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482748, 2, ) }, 0, 0x0, 0, ... -2147482748, 2, ) == 0x0
01747 896 NtSetValueKey (-2147482748, (-2147482748, "Seed", 0, 3, "x \37f\340\224U\17\341\20QqZz\203|\271_o\317\332E\303\374+F\301\22\242VzVJb\342O7\22b\357\210\237\201-\277\203^1\21\207\5U\232\3048\233\237T\342\27\344Oo\245\272\0+x\376\0\304}\352\7\351\234\3403\203\255", 80, ... ) , 0, 3, (-2147482748, "Seed", 0, 3, "x \37f\340\224U\17\341\20QqZz\203|\271_o\317\332E\303\374+F\301\22\242VzVJb\342O7\22b\357\210\237\201-\277\203^1\21\207\5U\232\3048\233\237T\342\27\344Oo\245\272\0+x\376\0\304}\352\7\351\234\3403\203\255", 80, ... ) , 80, ... ) == 0x0
01748 896 NtClose (-2147482748, ... ) == 0x0
01738 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\36\277C\342\323\256g\244\236B\270-\253\0\321Z\277\247EQ\244\253\341\270\201\346\271\257\17j\357\251\26\250#\201\331J\241\271\357\243\332\323(vr[\207\342}\325\343A\212\266\363\30\315\260\362(?\225\364\217\277\342\200>,\257\270\263\26\325X\262\217\313\23[pGDB\266\326\257\24Hbz\353\5\235\32?\341\217\37\254\26\16\330\371\304\201w\307o\362\16o%\250vG\307\334\16\312\246\17i\235\331\250\372*O\242\3124\342\200\377\247\231s3Y\361\214\255\261\203\1/j\251\217\212\354\367\201\235\33\217H\324\35T7\207\311\3\17\314P\367h, ) , ) == 0x0
01749 896 NtDeviceIoControlFile (96, 0, 0x0, 0x0, 0x390008, (96, 0, 0x0, 0x0, 0x390008, "Z\205\35\11!,\22-\316\23\375\303\346\272\237\317\333bj\22R\324N\333bj\22R\324N\333bj\22R\324N\333bj\22R\324N\333bj\22R\226\333d\270\311\247)P\274\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
01750 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
01751 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
01752 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
01753 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
01754 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
01755 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
01756 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
01757 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482748, 2, ) }, 0, 0x0, 0, ... -2147482748, 2, ) == 0x0
01758 896 NtSetValueKey (-2147482748, (-2147482748, "Seed", 0, 3, "\252\357\310\365\312\226B\255\265\1\211\242h\347\242 \360\305\346a pw\370\15x\350\265\17\262\272)Vp\351(\363\241\304\352\351\370V\301\342\201\10\2+\375\24+\331n\256b\3571\22"\277\253"\272\353\22\3174Nq?\311<\253\355RL\133", 80, ... ) , 0, 3, (-2147482748, "Seed", 0, 3, "\252\357\310\365\312\226B\255\265\1\211\242h\347\242 \360\305\346a pw\370\15x\350\265\17\262\272)Vp\351(\363\241\304\352\351\370V\301\342\201\10\2+\375\24+\331n\256b\3571\22"\277\253"\272\353\22\3174Nq?\311<\253\355RL\133", 80, ... ) \277\253 (-2147482748, "Seed", 0, 3, "\252\357\310\365\312\226B\255\265\1\211\242h\347\242 \360\305\346a pw\370\15x\350\265\17\262\272)Vp\351(\363\241\304\352\351\370V\301\342\201\10\2+\375\24+\331n\256b\3571\22"\277\253"\272\353\22\3174Nq?\311<\253\355RL\133", 80, ... ) , 80, ... ) == 0x0
01759 896 NtClose (-2147482748, ... ) == 0x0
01749 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "^a\264\350=\220{\0\20\252\332\\361\362\304\345\243R\30Q\32\352*\322!k\33\33\347\321\337\312\352\13\220\343\215+\37m\315\4\225\12V*\2614\11".\242\200\313\307\16?tv\301\24\235:BW)\213\232F1\376r\266\222\26\177\301\341(\215\264\\353\30\2\251\0S\3031\257A\272 \236\27\262\226\304\31\366qv\224\263\274\302<5_\320kp\360I\270\261\24b\3737%\9\177\275]\264\277\204\322\360\305c\376\274S\307\260\253\241\207~|:8\2267\343L\1\240B\231\230\5\257\300\32\240g\243',\255\242\3553B\16E\311^\3\235Pn\207X\245\364\306\263E:\35g\213@\33\250\30\361K\372\352}\340\26\336\272\204\306\35c\334\256[\371K\305\265\355\2761\202p\14\255\244y\254\366\206k\345v\316%3\36614[N~\2\3424:\26\345", ) \13\220\343\215+\37m\315\4\225\12V*\2614\11 ... {status=0x0, info=256}, "^a\264\350=\220{\0\20\252\332\\361\362\304\345\243R\30Q\32\352*\322!k\33\33\347\321\337\312\352\13\220\343\215+\37m\315\4\225\12V*\2614\11".\242\200\313\307\16?tv\301\24\235:BW)\213\232F1\376r\266\222\26\177\301\341(\215\264\\353\30\2\251\0S\3031\257A\272 \236\27\262\226\304\31\366qv\224\263\274\302<5_\320kp\360I\270\261\24b\3737%\9\177\275]\264\277\204\322\360\305c\376\274S\307\260\253\241\207~|:8\2267\343L\1\240B\231\230\5\257\300\32\240g\243',\255\242\3553B\16E\311^\3\235Pn\207X\245\364\306\263E:\35g\213@\33\250\30\361K\372\352}\340\26\336\272\204\306\35c\334\256[\371K\305\265\355\2761\202p\14\255\244y\254\366\206k\345v\316%3\36614[N~\2\3424:\26\345", ) , ) == 0x0
01760 896 NtDeviceIoControlFile (96, 0, 0x0, 0x0, 0x390008, (96, 0, 0x0, 0x0, 0x390008, "Z\205\35\11!,\22-\316\23\375\303\346\272\237\317\333bj\22R\324N\333bj\22R\324N\333bj\22R\324N\333bj\22R\324N\333bj\22R\324N\333bj\22R\226\333d\270\311\247)P\274\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
01761 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
01762 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
01763 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
01764 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
01765 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
01766 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
01767 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
01768 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482748, 2, ) }, 0, 0x0, 0, ... -2147482748, 2, ) == 0x0
01769 896 NtSetValueKey (-2147482748, (-2147482748, "Seed", 0, 3, "@\21(\362\235\267\5%\343\31\221\363\310\33\242 \237\246\202\30\205\255*\14\275J=\300/\363\3501lV\343)\270\78\274\250\2534F2\273D\271\332\246\240\11\243er\216\354\354\213M\15\3\2222\362,\200?\313\33=\271O}[!\230g!\247", 80, ... ) , 0, 3, (-2147482748, "Seed", 0, 3, "@\21(\362\235\267\5%\343\31\221\363\310\33\242 \237\246\202\30\205\255*\14\275J=\300/\363\3501lV\343)\270\78\274\250\2534F2\273D\271\332\246\240\11\243er\216\354\354\213M\15\3\2222\362,\200?\313\33=\271O}[!\230g!\247", 80, ... ) , 80, ... ) == 0x0
01770 896 NtClose (-2147482748, ... ) == 0x0
01760 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\212\266\213m\277\335\370\314\352\0\36\3613\235\33\31590\350\364\2104c8)\376\311\355t~]\272\273\217T\347q~\334\330JA\240l\31\204(8\14\261m\0\11N~\4`B\21\232\255\300\226\220\376\346\232%\204\2426\274v\216XH\361\24\331\331\3\362\342,\362\2057Y\312V\202{g\313A\244\5!\331\376\345\22\301\346\232\26\353\23\267a-F\224GUu\206\350\34\312\357dO\304K\202\250\273:\272\324\335\303\361\366d=\305\236\306V\373<\212\331\361\353\2133\365\341=\225\177\317\205\300vU\365"b\217U\7\304\373\230\366\21\256\221\254,<\322\12\363\222\216RL\243\324s\243|\23m\267|\256\235\215~\*\332\353\377\3575\231B+\4\1\230\25\226:\204z\37\300\307c\200\222\330MN\263\257\322\267a\337\2728n\365\222\351l\327\337\262\30\\215\324W\245V\15\205y\324\333i\246\26\312\344\214", ) b\217U\7\304\373\230\366\21\256\221\254,<\322\12\363\222\216RL\243\324s\243|\23m\267|\256\235\215~\*\332\353\377\3575\231B+\4\1\230\25\226:\204z\37\300\307c\200\222\330MN\263\257\322\267a\337\2728n\365\222\351l\327\337\262\30\\215\324W\245V\15\205y\324\333i\246\26\312\344\214", ) == 0x0
01771 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 132, ) == 0x0
01772 896 NtConnectPort ( ("\RPC Control\ntsvcs", {12, 2, 1, 1}, 0x0, 0x0, 1243284, 188, ... 140, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 1}, 0x0, 0x0, 1243284, 188, ... 140, 0x0, 0x0, 0x0, 188, ) == 0x0
01773 896 NtRequestWaitReplyPort (140, {200, 224, new_msg, 0, 1340496, 12, 2, 1310977} (140, {200, 224, new_msg, 0, 1340496, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\44\24\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\1\0\0\0\30\226\24\0\4\0\0\0\2\0\0\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\24\0\2\0\0\0\14\36Z\246DT\206ax\211\24\0\267?yl\12\0\0\0\0\0\0\0x\211\24\0(\0\0\0\200\211\24\0\377a\260\374\240\1\24\0(\0\0\0\202}\0\0\0\0\24\0\360\366\22\0\23\1\0\0\0\0\0\0X[\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\24\367\22\0\372\31\221|\250\376\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 1252, 896, 81897, 0} "\7\0\0\0\274\0\0\0\44\24\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\24\0\2\0\0\0\14\36Z\246DT\206ax\211\24\0\267?yl\12\0\0\0\0\0\0\0x\211\24\0(\0\0\0\200\211\24\0\377a\260\374\240\1\24\0(\0\0\0\202}\0\0\0\0\24\0\360\366\22\0\23\1\0\0\0\0\0\0X[\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\24\367\22\0\372\31\221|\250\376\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ... {200, 224, reply, 0, 1252, 896, 81897, 0} (140, {200, 224, new_msg, 0, 1340496, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\44\24\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\1\0\0\0\30\226\24\0\4\0\0\0\2\0\0\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\24\0\2\0\0\0\14\36Z\246DT\206ax\211\24\0\267?yl\12\0\0\0\0\0\0\0x\211\24\0(\0\0\0\200\211\24\0\377a\260\374\240\1\24\0(\0\0\0\202}\0\0\0\0\24\0\360\366\22\0\23\1\0\0\0\0\0\0X[\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\24\367\22\0\372\31\221|\250\376\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 1252, 896, 81897, 0} "\7\0\0\0\274\0\0\0\44\24\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\24\0\2\0\0\0\14\36Z\246DT\206ax\211\24\0\267?yl\12\0\0\0\0\0\0\0x\211\24\0(\0\0\0\200\211\24\0\377a\260\374\240\1\24\0(\0\0\0\202}\0\0\0\0\24\0\360\366\22\0\23\1\0\0\0\0\0\0X[\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\24\367\22\0\372\31\221|\250\376\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ) == 0x0
01774 896 NtRequestWaitReplyPort (140, {48, 72, new_msg, 0, 44, 3, 20, 0} (140, {48, 72, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\33\0gS\263F\252\227\2L\355h\28 \0"\0\377\377\377\377\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200D\0e\0" ... {96, 120, reply, 0, 1252, 896, 81898, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\31/\\7\271\346)E\242\237T\31D\323\36r\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ) \0\377\377\377\377\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200D\0e\0 (140, {48, 72, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\33\0gS\263F\252\227\2L\355h\28 \0"\0\377\377\377\377\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200D\0e\0" ... {96, 120, reply, 0, 1252, 896, 81898, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\31/\\7\271\346)E\242\237T\31D\323\36r\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ) \2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\31/\\7\271\346)E\242\237T\31D\323\36r\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ) == 0x0
01775 896 NtRequestWaitReplyPort (140, {100, 124, new_msg, 0, 1252, 896, 81898, 0} (140, {100, 124, new_msg, 0, 1252, 896, 81898, 0} "\1\356\0\0A\2\34\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\31/\\7\271\346)E\242\237T\31D\323\36r\11\0\0\0\0\0\0\0\11\0\0\0RpcPatch\0\0\0\0\377\1\17\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201\0\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81899, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\4\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81899, 0} (140, {100, 124, new_msg, 0, 1252, 896, 81898, 0} "\1\356\0\0A\2\34\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\31/\\7\271\346)E\242\237T\31D\323\36r\11\0\0\0\0\0\0\0\11\0\0\0RpcPatch\0\0\0\0\377\1\17\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201\0\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81899, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\4\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ) == 0x0
01776 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DLLCACHE\TFTPD.EXE"}, 1243000, ... ) }, 1243000, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01777 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1243248, (0x80100080, {24, 0, 0x40, 0, 1243248, "\??\C:\WINDOWS\system32\dllcache\tftpd.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01778 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DLLCACHE\TFTPD.EXE"}, 1243000, ... ) }, 1243000, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01779 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1243248, (0x80100080, {24, 0, 0x40, 0, 1243248, "\??\C:\WINDOWS\SYSTEM32\DLLCACHE\TFTPD.EXE"}, 0x0, 0, 3, 1, 2097252, 0, 0, ... ) }, 0x0, 0, 3, 1, 2097252, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01780 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DLLCACHE\TFTPD.EXE"}, 1243000, ... ) }, 1243000, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01781 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1243248, (0x80100080, {24, 0, 0x40, 0, 1243248, "\??\C:\WINDOWS\SYSTEM32\DLLCACHE\TFTPD.EXE"}, 0x0, 0, 1, 1, 100, 0, 0, ... ) }, 0x0, 0, 1, 1, 100, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01782 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DLLCACHE\TFTPD.EXE"}, 1243000, ... ) }, 1243000, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01783 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1243248, (0x80100080, {24, 0, 0x40, 0, 1243248, "\??\C:\WINDOWS\SYSTEM32\DLLCACHE\TFTPD.EXE"}, 0x0, 0, 3, 1, 100, 0, 0, ... ) }, 0x0, 0, 3, 1, 100, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01784 896 NtOpenEvent (0x100000, {24, 100, 0x0, 0, 0, (0x100000, {24, 100, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 180, ) }, ... 180, ) == 0x0
01785 896 NtWaitForSingleObject (180, 0, {-1800000000, -1}, ... ) == 0x0
01786 896 NtClose (180, ... ) == 0x0
01787 896 NtRequestWaitReplyPort (140, {48, 72, new_msg, 0, 1252, 896, 81899, 0} (140, {48, 72, new_msg, 0, 1252, 896, 81899, 0} "\1+\0\0A\2\33\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\0\0\0\0\0\0\0\0?\0\17\0\0\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81900, 0} "\2\0\370\0\1\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201\0\0\0\0L\317\255)z\4\255L\271t\2429&Dg\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\0\0\0z\0\0\0\1\0\0\0\0\00\0\5\0\0\0\0\0\0\0\5\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81900, 0} (140, {48, 72, new_msg, 0, 1252, 896, 81899, 0} "\1+\0\0A\2\33\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\0\0\0\0\0\0\0\0?\0\17\0\0\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81900, 0} "\2\0\370\0\1\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201\0\0\0\0L\317\255)z\4\255L\271t\2429&Dg\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\0\0\0z\0\0\0\1\0\0\0\0\00\0\5\0\0\0\0\0\0\0\5\0\0\0" ) ) == 0x0
01788 896 NtRequestWaitReplyPort (140, {44, 68, new_msg, 56, 1252, 896, 81900, 0} (140, {44, 68, new_msg, 56, 1252, 896, 81900, 0} "\1\0\0\0B\2\30\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\1\0\0\0\340\233\24\0\370\0\0\0" ... {124, 148, reply, 0, 1252, 896, 81901, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\0\0\0\03]d=\263\216,F\261P\34\351\263\227R~\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201\0\0\0\0\360\376?\300\0\0\0\0d\206\254\201\0\0\20\0\377\27\0\0\354Sn\201" ) ... {124, 148, reply, 0, 1252, 896, 81901, 0} (140, {44, 68, new_msg, 56, 1252, 896, 81900, 0} "\1\0\0\0B\2\30\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\1\0\0\0\340\233\24\0\370\0\0\0" ... {124, 148, reply, 0, 1252, 896, 81901, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\0\0\0\03]d=\263\216,F\261P\34\351\263\227R~\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201\0\0\0\0\360\376?\300\0\0\0\0d\206\254\201\0\0\20\0\377\27\0\0\354Sn\201" ) ) == 0x0
01789 896 NtRequestWaitReplyPort (140, {96, 120, new_msg, 0, 1252, 896, 81901, 0} (140, {96, 120, new_msg, 0, 1252, 896, 81901, 0} "\1\356\0\0A\2\34\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0L\317\255)z\4\255L\271t\2429&Dg\11\6\0\0\0\0\0\0\0\6\0\0\0MSDTC\0`\371\377\1\17\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ... {96, 120, reply, 0, 1252, 896, 81902, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0x\32\303\216yS\204G\225b~C.'\276\316\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81902, 0} (140, {96, 120, new_msg, 0, 1252, 896, 81901, 0} "\1\356\0\0A\2\34\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0L\317\255)z\4\255L\271t\2429&Dg\11\6\0\0\0\0\0\0\0\6\0\0\0MSDTC\0`\371\377\1\17\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ... {96, 120, reply, 0, 1252, 896, 81902, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0x\32\303\216yS\204G\225b~C.'\276\316\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ) == 0x0
01790 896 NtAllocateVirtualMemory (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
01791 896 NtRequestWaitReplyPort (140, {84, 108, new_msg, 0, 1252, 896, 81902, 0} (140, {84, 108, new_msg, 0, 1252, 896, 81902, 0} "\1+\0\0A\2&\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\0\0\0\0x\32\303\216yS\204G\225b~C.'\276\316\1\0\0\0\0\4\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0" ... {40, 64, reply, 0, 1252, 896, 81903, 0} "\2\0\370\0\4\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201(\4\0\0x~\15\0" ) ... {40, 64, reply, 0, 1252, 896, 81903, 0} (140, {84, 108, new_msg, 0, 1252, 896, 81902, 0} "\1+\0\0A\2&\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\0\0\0\0x\32\303\216yS\204G\225b~C.'\276\316\1\0\0\0\0\4\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0" ... {40, 64, reply, 0, 1252, 896, 81903, 0} "\2\0\370\0\4\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201(\4\0\0x~\15\0" ) ) == 0x0
01792 896 NtRequestWaitReplyPort (140, {64, 88, new_msg, 56, 1350960, 1242952, 1243052, 0} (140, {64, 88, new_msg, 56, 1350960, 1242952, 1243052, 0} "\10\367\22\0@\0\24\0\346\277\347w\254\367\22\0H\367\22\0\20\0\0\0\250\35\336w\244\235\24\0\1\0\0\0P\242\24\0(\4\0\0(\4\0\0x~\15\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {64, 88, reply, 56, 1252, 896, 81904, 0} "\10\367\22\0@\0\24\0\346\277\347w\254\367\22\0H\367\22\0\20\0\0\0\250\35\336w\244\235\24\0\1\0\0\0P\242\24\0(\4\0\0(\4\0\0x~\15\0\0\0\0\0\0\0\0\0\1\0\0\0" ) ... {64, 88, reply, 56, 1252, 896, 81904, 0} (140, {64, 88, new_msg, 56, 1350960, 1242952, 1243052, 0} "\10\367\22\0@\0\24\0\346\277\347w\254\367\22\0H\367\22\0\20\0\0\0\250\35\336w\244\235\24\0\1\0\0\0P\242\24\0(\4\0\0(\4\0\0x~\15\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {64, 88, reply, 56, 1252, 896, 81904, 0} "\10\367\22\0@\0\24\0\346\277\347w\254\367\22\0H\367\22\0\20\0\0\0\250\35\336w\244\235\24\0\1\0\0\0P\242\24\0(\4\0\0(\4\0\0x~\15\0\0\0\0\0\0\0\0\0\1\0\0\0" ) ) == 0x0
01793 896 NtRequestWaitReplyPort (140, {88, 112, new_msg, 0, 1252, 896, 81903, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81903, 0} "\1\0\0\0A\2\0\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\0\0\0\0x\32\303\216yS\204G\225b~C.'\276\316\1\0\0\0\0\4\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81905, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81905, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81903, 0} "\1\0\0\0A\2\0\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\0\0\0\0x\32\303\216yS\204G\225b~C.'\276\316\1\0\0\0\0\4\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81905, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ) == 0x0
01794 896 NtRequestWaitReplyPort (140, {44, 68, new_msg, 56, 1252, 896, 81905, 0} (140, {44, 68, new_msg, 56, 1252, 896, 81905, 0} "\1+\0\0B\2$\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\1\0\0\0P\242\24\0O\1\0\0" ... {40, 64, reply, 0, 1252, 896, 81906, 0} "\2\0\370\0\1\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201\0\0\0\0x~\15\0" ) ... {40, 64, reply, 0, 1252, 896, 81906, 0} (140, {44, 68, new_msg, 56, 1252, 896, 81905, 0} "\1+\0\0B\2$\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\1\0\0\0P\242\24\0O\1\0\0" ... {40, 64, reply, 0, 1252, 896, 81906, 0} "\2\0\370\0\1\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201\0\0\0\0x~\15\0" ) ) == 0x0
01795 896 NtRequestWaitReplyPort (140, {88, 112, new_msg, 0, 1252, 896, 81906, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81906, 0} "\1\0\0\0A\2\0\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\0\0\0\03]d=\263\216,F\261P\34\351\263\227R~\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81907, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ) ... {96, 120, reply, 0, 1252, 896, 81907, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81906, 0} "\1\0\0\0A\2\0\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\0\0\0\03]d=\263\216,F\261P\34\351\263\227R~\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81907, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ) ) == 0x0
01796 896 NtRequestWaitReplyPort (140, {88, 112, new_msg, 0, 1252, 896, 81907, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81907, 0} "\1\356\0\0A\2\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0L\317\255)z\4\255L\271t\2429&Dg\11\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201" ... {96, 120, reply, 0, 1252, 896, 81908, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81908, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81907, 0} "\1\356\0\0A\2\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0L\317\255)z\4\255L\271t\2429&Dg\11\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201" ... {96, 120, reply, 0, 1252, 896, 81908, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ) == 0x0
01797 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1243000, ... ) }, 1243000, ... ) == 0x0
01798 896 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
01799 896 NtSetInformationFile (180, 1242976, 40, Basic, ... ) == STATUS_ACCESS_DENIED
01800 896 NtClose (180, ... ) == 0x0
01801 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1243248, (0x80100080, {24, 0, 0x40, 0, 1243248, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
01802 896 NtQueryInformationFile (180, 1243684, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
01803 896 NtQueryInformationFile (180, 1243600, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
01804 896 NtQueryInformationFile (180, 1243416, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
01805 896 NtAllocateVirtualMemory (-1, 1355776, 0, 8192, 4096, 4, ... 1355776, 8192, ) == 0x0
01806 896 NtQueryInformationFile (180, 1352616, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
01807 896 NtQueryInformationFile (180, 1241864, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
01808 896 NtQueryInformationFile (180, 1242140, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
01809 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\WINS\DLLHOST.EXE"}, 1241336, ... ) }, 1241336, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01810 896 NtCreateFile (0x40110080, {24, 0, 0x40, 0, 1242016, (0x40110080, {24, 0, 0x40, 0, 1242016, "\??\C:\WINDOWS\system32\wins\DLLHOST.EXE"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
01811 896 NtClose (-2147482764, ... ) == 0x0
01810 896 NtCreateFile ... 184, {status=0x0, info=2}, ) == 0x0
01812 896 NtQueryVolumeInformationFile (184, 1242168, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
01813 896 NtQueryInformationFile (184, 1241752, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
01814 896 NtQueryVolumeInformationFile (180, 1242168, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
01815 896 NtSetInformationFile (184, 1242068, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
01816 896 NtCreateSection (0xf001f, 0x0, 0x0, 2, 134217728, 180, ... 188, ) == 0x0
01817 896 NtMapViewOfSection (188, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
01818 896 NtClose (188, ... ) == 0x0
01819 896 NtWriteFile (184, 0, 0, 0, (184, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0q\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0V^%\35\22?KN\22?KN\22?KNK\34XN\20?KN\2217\26N\30?KNi#GN\23?KN} AN\31?KN\221#EN\23?KN} ON\21?KN\22?JNv?KN\24\34@N\20?KNRich\22?KN\0\0\0\0\0\0\0\0PE\0\0L\1\3\0\10 \10\232\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\00\0\0\0\20\0\0\0`\0\0\0\242\0\0\0p\0\0\0\240\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0 \1\0\0\4\0\0\0\0\0\0\3\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\240\0\0\240\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\0\20\0\0\0\0\0\0\0\4\0\0\0\0\0\0", 19968, 0x0, 0, ... {status=0x0, info=19968}, ) , 19968, 0x0, 0, ... {status=0x0, info=19968}, ) == 0x0
01820 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
01821 896 NtSetInformationFile (184, 1243416, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
01822 896 NtClose (180, ... ) == 0x0
01823 896 NtClose (184, ... ) == 0x0
01824 896 NtOpenEvent (0x100000, {24, 100, 0x0, 0, 0, (0x100000, {24, 100, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 184, ) }, ... 184, ) == 0x0
01825 896 NtWaitForSingleObject (184, 0, {-1800000000, -1}, ... ) == 0x0
01826 896 NtClose (184, ... ) == 0x0
01827 896 NtRequestWaitReplyPort (140, {48, 72, new_msg, 0, 1252, 896, 81908, 0} (140, {48, 72, new_msg, 0, 1252, 896, 81908, 0} "\1+\0\0A\2\33\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\0\0\0\0\0\0\0\0?\0\17\0\0\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81909, 0} "\2\0\370\0\1\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201\0\0\0\0I\213\375\202\222>wH\214\230[v\4\22\245c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\0\0\0z\0\0\0\1\0\0\0\0\00\0\5\0\0\0\0\0\0\0\5\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81909, 0} (140, {48, 72, new_msg, 0, 1252, 896, 81908, 0} "\1+\0\0A\2\33\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\0\0\0\0\0\0\0\0?\0\17\0\0\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81909, 0} "\2\0\370\0\1\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201\0\0\0\0I\213\375\202\222>wH\214\230[v\4\22\245c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\0\0\0z\0\0\0\1\0\0\0\0\00\0\5\0\0\0\0\0\0\0\5\0\0\0" ) ) == 0x0
01828 896 NtRequestWaitReplyPort (140, {44, 68, new_msg, 56, 1252, 896, 81909, 0} (140, {44, 68, new_msg, 56, 1252, 896, 81909, 0} "\1\0\0\0B\2\30\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\1\0\0\0\310\232\24\0\350\0\0\0" ... {124, 148, reply, 0, 1252, 896, 81910, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\0\0\0\0\227\14>{z\307\36M\236\253\23\312\345>u\322\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201\0\0\0\0\360\376?\300\0\0\0\0d\206\254\201\0\0\20\0\377\27\0\0\354Sn\201" ) ... {124, 148, reply, 0, 1252, 896, 81910, 0} (140, {44, 68, new_msg, 56, 1252, 896, 81909, 0} "\1\0\0\0B\2\30\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\1\0\0\0\310\232\24\0\350\0\0\0" ... {124, 148, reply, 0, 1252, 896, 81910, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\0\0\0\0\227\14>{z\307\36M\236\253\23\312\345>u\322\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201\0\0\0\0\360\376?\300\0\0\0\0d\206\254\201\0\0\20\0\377\27\0\0\354Sn\201" ) ) == 0x0
01829 896 NtRequestWaitReplyPort (140, {96, 120, new_msg, 0, 1252, 896, 81910, 0} (140, {96, 120, new_msg, 0, 1252, 896, 81910, 0} "\1\356\0\0A\2\34\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0I\213\375\202\222>wH\214\230[v\4\22\245c\10\0\0\0\0\0\0\0\10\0\0\0Browser\0\377\1\17\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ... {96, 120, reply, 0, 1252, 896, 81911, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\307v\231\2503\242\376L\223\303\257\367:\34\353\313\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81911, 0} (140, {96, 120, new_msg, 0, 1252, 896, 81910, 0} "\1\356\0\0A\2\34\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0I\213\375\202\222>wH\214\230[v\4\22\245c\10\0\0\0\0\0\0\0\10\0\0\0Browser\0\377\1\17\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ... {96, 120, reply, 0, 1252, 896, 81911, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\307v\231\2503\242\376L\223\303\257\367:\34\353\313\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ) == 0x0
01830 896 NtRequestWaitReplyPort (140, {84, 108, new_msg, 0, 1252, 896, 81911, 0} (140, {84, 108, new_msg, 0, 1252, 896, 81911, 0} "\1+\0\0A\2&\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\0\0\0\0\307v\231\2503\242\376L\223\303\257\367:\34\353\313\1\0\0\0\0\4\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0" ... {40, 64, reply, 0, 1252, 896, 81912, 0} "\2\0\370\0\4\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201(\4\0\0x~\15\0" ) ... {40, 64, reply, 0, 1252, 896, 81912, 0} (140, {84, 108, new_msg, 0, 1252, 896, 81911, 0} "\1+\0\0A\2&\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\0\0\0\0\307v\231\2503\242\376L\223\303\257\367:\34\353\313\1\0\0\0\0\4\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0" ... {40, 64, reply, 0, 1252, 896, 81912, 0} "\2\0\370\0\4\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201(\4\0\0x~\15\0" ) ) == 0x0
01831 896 NtRequestWaitReplyPort (140, {64, 88, new_msg, 56, 1350960, 1242952, 1243052, 0} (140, {64, 88, new_msg, 56, 1350960, 1242952, 1243052, 0} "\10\367\22\0@\0\24\0\346\277\347w\254\367\22\0H\367\22\0\20\0\0\0\250\35\336w\244\235\24\0\1\0\0\0\250\243\24\0(\4\0\0(\4\0\0x~\15\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {64, 88, reply, 56, 1252, 896, 81913, 0} "\10\367\22\0@\0\24\0\346\277\347w\254\367\22\0H\367\22\0\20\0\0\0\250\35\336w\244\235\24\0\1\0\0\0\250\243\24\0(\4\0\0(\4\0\0x~\15\0\0\0\0\0\0\0\0\0\1\0\0\0" ) ... {64, 88, reply, 56, 1252, 896, 81913, 0} (140, {64, 88, new_msg, 56, 1350960, 1242952, 1243052, 0} "\10\367\22\0@\0\24\0\346\277\347w\254\367\22\0H\367\22\0\20\0\0\0\250\35\336w\244\235\24\0\1\0\0\0\250\243\24\0(\4\0\0(\4\0\0x~\15\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {64, 88, reply, 56, 1252, 896, 81913, 0} "\10\367\22\0@\0\24\0\346\277\347w\254\367\22\0H\367\22\0\20\0\0\0\250\35\336w\244\235\24\0\1\0\0\0\250\243\24\0(\4\0\0(\4\0\0x~\15\0\0\0\0\0\0\0\0\0\1\0\0\0" ) ) == 0x0
01832 896 NtRequestWaitReplyPort (140, {88, 112, new_msg, 0, 1252, 896, 81912, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81912, 0} "\1\0\0\0A\2\0\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\0\0\0\0\307v\231\2503\242\376L\223\303\257\367:\34\353\313\1\0\0\0\0\4\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81914, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81914, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81912, 0} "\1\0\0\0A\2\0\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\0\0\0\0\307v\231\2503\242\376L\223\303\257\367:\34\353\313\1\0\0\0\0\4\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81914, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ) == 0x0
01833 896 NtRequestWaitReplyPort (140, {44, 68, new_msg, 56, 1252, 896, 81914, 0} (140, {44, 68, new_msg, 56, 1252, 896, 81914, 0} "\1+\0\0B\2$\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\1\0\0\0 \214\24\0V\1\0\0" ... {40, 64, reply, 0, 1252, 896, 81915, 0} "\2\0\370\0\1\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201\0\0\0\0x~\15\0" ) ... {40, 64, reply, 0, 1252, 896, 81915, 0} (140, {44, 68, new_msg, 56, 1252, 896, 81914, 0} "\1+\0\0B\2$\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\1\0\0\1\0\0\0 \214\24\0V\1\0\0" ... {40, 64, reply, 0, 1252, 896, 81915, 0} "\2\0\370\0\1\0\335\341<\0\370\0\226\245\335\341\264\311\275\201:\332R\200X{\266\367\]\222\201\0\0\0\0x~\15\0" ) ) == 0x0
01834 896 NtRequestWaitReplyPort (140, {88, 112, new_msg, 0, 1252, 896, 81915, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81915, 0} "\1\0\0\0A\2\0\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\0\0\0\0\227\14>{z\307\36M\236\253\23\312\345>u\322\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81916, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ) ... {96, 120, reply, 0, 1252, 896, 81916, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81915, 0} "\1\0\0\0A\2\0\0<\0\370\0\226\245\335\341\264\311\275\201:\332R\200\377\377\377\377\]\222\201\0\0\0\0\227\14>{z\307\36M\236\253\23\312\345>u\322\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0" ... {96, 120, reply, 0, 1252, 896, 81916, 0} "\2\356Q\200\1\0\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300l\373`\371X\353Q\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201 Sn\201\1Sn\201" ) ) == 0x0
01835 896 NtRequestWaitReplyPort (140, {88, 112, new_msg, 0, 1252, 896, 81916, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81916, 0} "\1\356\0\0A\2\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0I\213\375\202\222>wH\214\230[v\4\22\245c\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201" ... {96, 120, reply, 0, 1252, 896, 81917, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ... {96, 120, reply, 0, 1252, 896, 81917, 0} (140, {88, 112, new_msg, 0, 1252, 896, 81916, 0} "\1\356\0\0A\2\0\0\30Un\201\0\340\375\177\220\373`\371\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0I\213\375\202\222>wH\214\230[v\4\22\245c\0\0\0\0\0\0\0\0\0\0\0\0\253\362Q\200\220\373`\371\0\0\0\0\0\0\0\0\0\0\0\0\210\205\234\201" ... {96, 120, reply, 0, 1252, 896, 81917, 0} "\2+\263\341\1\0T\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254f\12\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\14\0\0\0\0\0\0\0\14\0\0\0" ) ) == 0x0
01836 896 NtOpenKey (0x2000000, {24, 32, 0x40, 0, 0, (0x2000000, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 184, ) }, ... 184, ) == 0x0
01837 896 NtQueryValueKey (184, (184, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (184, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
01838 896 NtQueryValueKey (184, (184, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (184, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
01839 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 180, ) == 0x0
01840 896 NtOpenKey (0x2000000, {24, 184, 0x40, 0, 0, (0x2000000, {24, 184, 0x40, 0, 0, "Protocol_Catalog9"}, ... 188, ) }, ... 188, ) == 0x0
01841 896 NtQueryValueKey (188, (188, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
01842 896 NtNotifyChangeKey (188, 180, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
01843 896 NtQueryValueKey (188, (188, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
01844 896 NtOpenKey (0x2000000, {24, 188, 0x40, 0, 0, (0x2000000, {24, 188, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01845 896 NtQueryValueKey (188, (188, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
01846 896 NtQueryValueKey (188, (188, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
01847 896 NtOpenKey (0x2000000, {24, 188, 0x40, 0, 0, (0x2000000, {24, 188, 0x40, 0, 0, "Catalog_Entries"}, ... 192, ) }, ... 192, ) == 0x0
01848 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000001"}, ... 196, ) }, ... 196, ) == 0x0
01849 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01850 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01851 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0<\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0=\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0>\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0<\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0=\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0>\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0<\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0=\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0>\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01852 896 NtClose (196, ... ) == 0x0
01853 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000002"}, ... 196, ) }, ... 196, ) == 0x0
01854 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01855 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01856 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0A\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0A\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0B\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0C\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0A\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0A\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0B\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0C\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0A\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0A\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0B\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0C\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01857 896 NtClose (196, ... ) == 0x0
01858 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000003"}, ... 196, ) }, ... 196, ) == 0x0
01859 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01860 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01861 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0F\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0F\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0G\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0H\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0F\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0F\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0G\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0H\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0F\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0F\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0G\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0H\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01862 896 NtClose (196, ... ) == 0x0
01863 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000004"}, ... 196, ) }, ... 196, ) == 0x0
01864 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01865 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01866 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0K\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0K\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0L\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0M\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0K\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0K\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0L\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0M\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0K\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0K\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0L\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0M\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01867 896 NtClose (196, ... ) == 0x0
01868 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000005"}, ... 196, ) }, ... 196, ) == 0x0
01869 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01870 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01871 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0P\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0P\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0Q\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0R\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0P\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0P\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0Q\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0R\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0P\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0P\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0Q\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0R\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01872 896 NtClose (196, ... ) == 0x0
01873 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000006"}, ... 196, ) }, ... 196, ) == 0x0
01874 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01875 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01876 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0U\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0U\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0V\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0W\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0U\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0U\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0V\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0W\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0U\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0U\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0V\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0W\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01877 896 NtClose (196, ... ) == 0x0
01878 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000007"}, ... 196, ) }, ... 196, ) == 0x0
01879 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01880 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01881 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Z\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0Z\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0[\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0[\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0]\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Z\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0Z\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0[\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0[\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0]\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0]\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Z\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0Z\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0[\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0[\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0]\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01882 896 NtClose (196, ... ) == 0x0
01883 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000008"}, ... 196, ) }, ... 196, ) == 0x0
01884 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01885 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01886 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0_\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0_\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0`\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0a\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0_\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0_\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0`\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0a\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0_\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0_\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0`\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0a\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01887 896 NtClose (196, ... ) == 0x0
01888 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000009"}, ... 196, ) }, ... 196, ) == 0x0
01889 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01890 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01891 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0d\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0d\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0e\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0f\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0d\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0d\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0e\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0f\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0d\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0d\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0e\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0f\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01892 896 NtClose (196, ... ) == 0x0
01893 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000010"}, ... 196, ) }, ... 196, ) == 0x0
01894 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01895 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01896 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0i\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0i\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0j\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0k\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0i\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0i\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0j\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0k\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0i\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0i\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0j\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0k\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01897 896 NtClose (196, ... ) == 0x0
01898 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000011"}, ... 196, ) }, ... 196, ) == 0x0
01899 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01900 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01901 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0n\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0n\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0o\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0p\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0n\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0n\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0o\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0p\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0n\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0n\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0o\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0p\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01902 896 NtClose (196, ... ) == 0x0
01903 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000012"}, ... 196, ) }, ... 196, ) == 0x0
01904 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01905 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01906 896 NtAllocateVirtualMemory (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
01907 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0t\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0t\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0u\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0v\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0t\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0t\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0u\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0v\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0t\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0t\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0u\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0v\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01908 896 NtClose (196, ... ) == 0x0
01909 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000013"}, ... 196, ) }, ... 196, ) == 0x0
01910 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01911 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01912 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0y\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0y\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0z\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0{\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0{\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0|\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0y\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0y\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0z\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0{\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0{\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0|\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0{\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0|\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0y\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0y\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0z\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0{\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0{\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0|\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01913 896 NtClose (196, ... ) == 0x0
01914 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000014"}, ... 196, ) }, ... 196, ) == 0x0
01915 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01916 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01917 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0~\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0~\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\177\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\200\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\200\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\201\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0~\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0~\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\177\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\200\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\200\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\201\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\200\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\201\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0~\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0~\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\177\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\200\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\200\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\201\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01918 896 NtClose (196, ... ) == 0x0
01919 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000015"}, ... 196, ) }, ... 196, ) == 0x0
01920 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01921 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01922 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\203\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\203\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\204\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\205\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\205\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\206\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\203\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\203\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\204\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\205\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\205\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\206\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\205\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\206\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\203\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\203\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\204\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\205\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\205\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\206\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01923 896 NtClose (196, ... ) == 0x0
01924 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000016"}, ... 196, ) }, ... 196, ) == 0x0
01925 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01926 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01927 896 NtAllocateVirtualMemory (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
01928 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\211\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\211\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\212\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\213\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\211\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\211\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\212\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\213\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\211\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\211\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\212\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\213\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01929 896 NtClose (196, ... ) == 0x0
01930 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000017"}, ... 196, ) }, ... 196, ) == 0x0
01931 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01932 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01933 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\216\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\216\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\217\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\220\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\216\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\216\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\217\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\220\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\216\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\216\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\217\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\220\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01934 896 NtClose (196, ... ) == 0x0
01935 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000018"}, ... 196, ) }, ... 196, ) == 0x0
01936 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01937 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01938 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\223\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\223\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\224\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\224\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\225\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\225\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\226\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\223\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\223\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\224\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\224\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\225\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\225\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\226\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\225\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\226\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\223\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\223\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\224\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\224\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\225\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\225\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\226\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01939 896 NtClose (196, ... ) == 0x0
01940 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000019"}, ... 196, ) }, ... 196, ) == 0x0
01941 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01942 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01943 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\230\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\230\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\231\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\231\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\230\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\230\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\231\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\231\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\230\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\230\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\231\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\231\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01944 896 NtClose (196, ... ) == 0x0
01945 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000020"}, ... 196, ) }, ... 196, ) == 0x0
01946 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01947 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01948 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\235\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\235\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\236\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\236\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\235\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\235\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\236\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\236\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\235\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\235\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\236\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\236\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01949 896 NtClose (196, ... ) == 0x0
01950 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000021"}, ... 196, ) }, ... 196, ) == 0x0
01951 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01952 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01953 896 NtAllocateVirtualMemory (-1, 1372160, 0, 4096, 4096, 4, ... 1372160, 4096, ) == 0x0
01954 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0 (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\300\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310\222\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\304\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\304\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
01955 896 NtClose (196, ... ) == 0x0
01956 896 NtOpenKey (0x20019, {24, 192, 0x40, 0, 0, (0x20019, {24, 192, 0x40, 0, 0, "000000000022"}, ... 196, ) }, ... 196, ) == 0x0
01957 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01958 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
01959 896 NtQueryValueKey (196, (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\250\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\250\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\300\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\264\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\300\0\0\0\254\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\270\0\0\0\234\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0Pt\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (196, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\250\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\250\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\300\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\264\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\300\0\0\0\254\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\270\0\0\0\234\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0Pt\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\250\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\304\0\0\0\250\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\300\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\264\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\300\0\0\0\254\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\270\0\0\0\234\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0Pt\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
01960 896 NtClose (196, ... ) == 0x0
01961 896 NtClose (192, ... ) == 0x0
01962 896 NtWaitForSingleObject (180, 0, {0, 0}, ... ) == 0x102
01963 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 192, ) == 0x0
01964 896 NtOpenKey (0x2000000, {24, 184, 0x40, 0, 0, (0x2000000, {24, 184, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 196, ) }, ... 196, ) == 0x0
01965 896 NtQueryValueKey (196, (196, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (196, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
01966 896 NtNotifyChangeKey (196, 192, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
01967 896 NtQueryValueKey (196, (196, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (196, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
01968 896 NtOpenKey (0x2000000, {24, 196, 0x40, 0, 0, (0x2000000, {24, 196, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01969 896 NtQueryValueKey (196, (196, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (196, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
01970 896 NtOpenKey (0x2000000, {24, 196, 0x40, 0, 0, (0x2000000, {24, 196, 0x40, 0, 0, "Catalog_Entries"}, ... 200, ) }, ... 200, ) == 0x0
01971 896 NtOpenKey (0x20019, {24, 200, 0x40, 0, 0, (0x20019, {24, 200, 0x40, 0, 0, "000000000001"}, ... 204, ) }, ... 204, ) == 0x0
01972 896 NtQueryValueKey (204, (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
01973 896 NtQueryValueKey (204, (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
01974 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
01975 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
01976 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
01977 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
01978 896 NtQueryValueKey (204, (204, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (204, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
01979 896 NtQueryValueKey (204, (204, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01980 896 NtQueryValueKey (204, (204, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
01981 896 NtQueryValueKey (204, (204, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
01982 896 NtQueryValueKey (204, (204, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
01983 896 NtQueryValueKey (204, (204, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
01984 896 NtClose (204, ... ) == 0x0
01985 896 NtOpenKey (0x20019, {24, 200, 0x40, 0, 0, (0x20019, {24, 200, 0x40, 0, 0, "000000000002"}, ... 204, ) }, ... 204, ) == 0x0
01986 896 NtQueryValueKey (204, (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
01987 896 NtQueryValueKey (204, (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
01988 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
01989 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
01990 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
01991 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
01992 896 NtQueryValueKey (204, (204, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (204, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
01993 896 NtQueryValueKey (204, (204, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
01994 896 NtQueryValueKey (204, (204, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
01995 896 NtQueryValueKey (204, (204, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
01996 896 NtQueryValueKey (204, (204, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
01997 896 NtQueryValueKey (204, (204, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
01998 896 NtClose (204, ... ) == 0x0
01999 896 NtOpenKey (0x20019, {24, 200, 0x40, 0, 0, (0x20019, {24, 200, 0x40, 0, 0, "000000000003"}, ... 204, ) }, ... 204, ) == 0x0
02000 896 NtQueryValueKey (204, (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
02001 896 NtQueryValueKey (204, (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
02002 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
02003 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
02004 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
02005 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
02006 896 NtQueryValueKey (204, (204, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (204, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
02007 896 NtQueryValueKey (204, (204, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02008 896 NtQueryValueKey (204, (204, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
02009 896 NtQueryValueKey (204, (204, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
02010 896 NtQueryValueKey (204, (204, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
02011 896 NtQueryValueKey (204, (204, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
02012 896 NtClose (204, ... ) == 0x0
02013 896 NtOpenKey (0x20019, {24, 200, 0x40, 0, 0, (0x20019, {24, 200, 0x40, 0, 0, "000000000004"}, ... 204, ) }, ... 204, ) == 0x0
02014 896 NtQueryValueKey (204, (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
02015 896 NtQueryValueKey (204, (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
02016 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
02017 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
02018 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
02019 896 NtAllocateVirtualMemory (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0
02020 896 NtQueryValueKey (204, (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
02021 896 NtQueryValueKey (204, (204, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (204, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
02022 896 NtQueryValueKey (204, (204, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02023 896 NtQueryValueKey (204, (204, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
02024 896 NtQueryValueKey (204, (204, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
02025 896 NtQueryValueKey (204, (204, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
02026 896 NtQueryValueKey (204, (204, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
02027 896 NtClose (204, ... ) == 0x0
02028 896 NtClose (200, ... ) == 0x0
02029 896 NtWaitForSingleObject (192, 0, {0, 0}, ... ) == 0x102
02030 896 NtClose (184, ... ) == 0x0
02031 896 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
02032 896 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
02033 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 184, ) }, ... 184, ) == 0x0
02034 896 NtQueryValueKey (184, (184, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02035 896 NtClose (184, ... ) == 0x0
02036 896 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 184, ) == 0x0
02037 896 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 3801088, 65536, ) == 0x0
02038 896 NtQuerySystemInformation (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
02039 896 NtCreateSection (0xf0007, 0x0, {18400, 0}, 4, 134217728, 0, ... 200, ) == 0x0
02040 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3b0000), {0, 0}, 20480, ) == 0x0
02041 896 NtUnmapViewOfSection (-1, 0x3b0000, ... ) == 0x0
02042 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3b0000), {0, 0}, 20480, ) == 0x0
02043 896 NtFreeVirtualMemory (-1, (0x3a0000), 0, 32768, ... (0x3a0000), 65536, ) == 0x0
02044 896 NtUnmapViewOfSection (-1, 0x3b0000, ... ) == 0x0
02045 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02046 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02047 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02048 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02049 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02050 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02051 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02052 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02053 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02054 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02055 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02056 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02057 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02058 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02059 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02060 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02061 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02062 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02063 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02064 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02065 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02066 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02067 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02068 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02069 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02070 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02071 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02072 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02073 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02074 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02075 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02076 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02077 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02078 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02079 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02080 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02081 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02082 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02083 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02084 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02085 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02086 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02087 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02088 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02089 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02090 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02091 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02092 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02093 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02094 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02095 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02096 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02097 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02098 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02099 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02100 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02101 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02102 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02103 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02104 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02105 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02106 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02107 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02108 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02109 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02110 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02111 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3a0000), {0, 0}, 20480, ) == 0x0
02112 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02113 896 NtClose (200, ... ) == 0x0
02114 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msblast.exe"}, 1244192, ... ) }, 1244192, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02115 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\MSBLAST.EXE"}, 1243984, ... ) }, 1243984, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02116 896 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msblast.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02117 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\MSBLAST.EXE"}, 1244016, ... ) }, 1244016, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02118 896 NtOpenFile (0x10080, {24, 0, 0x40, 0, 0, (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msblast.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02119 896 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 9437184, 1048576, ) == 0x0
02120 896 NtAllocateVirtualMemory (-1, 9437184, 0, 72104, 4096, 4, ... 9437184, 73728, ) == 0x0
02121 896 NtDelayExecution (0, {-1000000, -1}, ... ) == 0x0
02122 896 NtWaitForSingleObject (192, 0, {0, 0}, ... ) == 0x102
02123 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 1240664, ... ) }, 1240664, ... ) == 0x0
02124 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 5, 96, ... 200, {status=0x0, info=1}, ) }, 5, 96, ... 200, {status=0x0, info=1}, ) == 0x0
02125 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 200, ... 204, ) == 0x0
02126 896 NtClose (200, ... ) == 0x0
02127 896 NtMapViewOfSection (204, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3a0000), 0x0, 245760, ) == 0x0
02128 896 NtClose (204, ... ) == 0x0
02129 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02130 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 1240972, ... ) }, 1240972, ... ) == 0x0
02131 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 5, 96, ... 204, {status=0x0, info=1}, ) }, 5, 96, ... 204, {status=0x0, info=1}, ) == 0x0
02132 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 204, ... 200, ) == 0x0
02133 896 NtQuerySection (200, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
02134 896 NtClose (204, ... ) == 0x0
02135 896 NtMapViewOfSection (200, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
02136 896 NtClose (200, ... ) == 0x0
02137 896 NtProtectVirtualMemory (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
02138 896 NtProtectVirtualMemory (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
02139 896 NtFlushInstructionCache (-1, 1906642944, 1060, ... ) == 0x0
02140 896 NtProtectVirtualMemory (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
02141 896 NtProtectVirtualMemory (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
02142 896 NtFlushInstructionCache (-1, 1906642944, 1060, ... ) == 0x0
02143 896 NtProtectVirtualMemory (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
02144 896 NtProtectVirtualMemory (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
02145 896 NtFlushInstructionCache (-1, 1906642944, 1060, ... ) == 0x0
02146 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02147 896 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
02148 896 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
02149 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 200, ) == 0x0
02150 896 NtOpenSection (0xe, {24, 12, 0x40, 0, 0, (0xe, {24, 12, 0x40, 0, 0, "DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02151 896 NtAllocateVirtualMemory (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0
02152 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 1240768, ... ) }, 1240768, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02153 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 1240768, ... ) }, 1240768, ... ) == 0x0
02154 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... 204, {status=0x0, info=1}, ) }, 5, 96, ... 204, {status=0x0, info=1}, ) == 0x0
02155 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 204, ... 208, ) == 0x0
02156 896 NtQuerySection (208, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
02157 896 NtClose (204, ... ) == 0x0
02158 896 NtMapViewOfSection (208, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
02159 896 NtClose (208, ... ) == 0x0
02160 896 NtProtectVirtualMemory (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
02161 896 NtProtectVirtualMemory (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
02162 896 NtFlushInstructionCache (-1, 1995575296, 616, ... ) == 0x0
02163 896 NtProtectVirtualMemory (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
02164 896 NtProtectVirtualMemory (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
02165 896 NtFlushInstructionCache (-1, 1995575296, 616, ... ) == 0x0
02166 896 NtProtectVirtualMemory (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
02167 896 NtProtectVirtualMemory (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
02168 896 NtFlushInstructionCache (-1, 1995575296, 616, ... ) == 0x0
02169 896 NtProtectVirtualMemory (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
02170 896 NtProtectVirtualMemory (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
02171 896 NtFlushInstructionCache (-1, 1995575296, 616, ... ) == 0x0
02172 896 NtProtectVirtualMemory (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
02173 896 NtProtectVirtualMemory (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
02174 896 NtFlushInstructionCache (-1, 1995575296, 616, ... ) == 0x0
02175 896 NtProtectVirtualMemory (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
02176 896 NtProtectVirtualMemory (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
02177 896 NtFlushInstructionCache (-1, 1995575296, 616, ... ) == 0x0
02178 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02179 896 NtCreateKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 208, 2, ) }, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 208, 2, ) , 0, ... 208, 2, ) == 0x0
02180 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 204, ) }, ... 204, ) == 0x0
02181 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02182 896 NtQueryValueKey (204, (204, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02183 896 NtQueryValueKey (208, (208, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02184 896 NtQueryValueKey (204, (204, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02185 896 NtQueryValueKey (208, (208, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
02186 896 NtQueryValueKey (204, (204, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02187 896 NtQueryValueKey (208, (208, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02188 896 NtQueryValueKey (204, (204, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02189 896 NtQueryValueKey (208, (208, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02190 896 NtQueryValueKey (204, (204, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02191 896 NtQueryValueKey (204, (204, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02192 896 NtQueryValueKey (204, (204, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02193 896 NtQueryValueKey (204, (204, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02194 896 NtQueryValueKey (204, (204, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02195 896 NtQueryValueKey (204, (204, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02196 896 NtQueryValueKey (204, (204, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02197 896 NtQueryValueKey (204, (204, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02198 896 NtQueryValueKey (204, (204, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02199 896 NtQueryValueKey (208, (208, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02200 896 NtQueryValueKey (204, (204, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02201 896 NtQueryValueKey (204, (204, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02202 896 NtQueryValueKey (208, (208, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02203 896 NtQueryValueKey (204, (204, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02204 896 NtQueryValueKey (208, (208, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02205 896 NtQueryValueKey (204, (204, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02206 896 NtQueryValueKey (208, (208, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02207 896 NtQueryValueKey (204, (204, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02208 896 NtQueryValueKey (208, (208, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02209 896 NtQueryValueKey (204, (204, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02210 896 NtQueryValueKey (208, (208, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02211 896 NtQueryValueKey (204, (204, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02212 896 NtQueryValueKey (208, (208, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02213 896 NtQueryValueKey (204, (204, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02214 896 NtQueryValueKey (208, (208, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02215 896 NtQueryValueKey (204, (204, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02216 896 NtQueryValueKey (204, (204, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02217 896 NtQueryValueKey (204, (204, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02218 896 NtQueryValueKey (204, (204, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02219 896 NtQueryValueKey (204, (204, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02220 896 NtQueryValueKey (204, (204, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02221 896 NtQueryValueKey (204, (204, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02222 896 NtQueryValueKey (204, (204, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02223 896 NtQueryValueKey (204, (204, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02224 896 NtQueryValueKey (204, (204, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02225 896 NtQueryValueKey (204, (204, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02226 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "System\Setup"}, ... 212, ) }, ... 212, ) == 0x0
02227 896 NtQueryValueKey (212, (212, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
02228 896 NtClose (212, ... ) == 0x0
02229 896 NtClose (208, ... ) == 0x0
02230 896 NtClose (204, ... ) == 0x0
02231 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 204, ) }, ... 204, ) == 0x0
02232 896 NtQueryValueKey (204, (204, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02233 896 NtQueryValueKey (204, (204, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02234 896 NtQueryValueKey (204, (204, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02235 896 NtClose (204, ... ) == 0x0
02236 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 204, ) == 0x0
02237 896 NtConnectPort ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 1241228, 188, ... 208, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241228, 188, ... 208, 0x0, 0x0, 0x0, 188, ) == 0x0
02238 896 NtRequestWaitReplyPort (208, {200, 224, new_msg, 0, 1343328, 12, 2, 1310721} (208, {200, 224, new_msg, 0, 1343328, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0\310\20\25\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\36;\316\10\260 HM\300\20\25\0h\1\24\0\12\0\0\0\0\0\0\0\300\20\25\0(\0\0\0\310\20\25\0\303\335S0x\1\24\0(\0\0\0n\317\0\0\0\0\24\0\350\356\22\0\225\310\210<\0\0\0\0H\3\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\14\357\22\0\372\31\221|\240\366\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 1252, 896, 81919, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\310\20\25\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\36;\316\10\260 HM\300\20\25\0h\1\24\0\12\0\0\0\0\0\0\0\300\20\25\0(\0\0\0\310\20\25\0\303\335S0x\1\24\0(\0\0\0n\317\0\0\0\0\24\0\350\356\22\0\225\310\210<\0\0\0\0H\3\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\14\357\22\0\372\31\221|\240\366\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ... {200, 224, reply, 0, 1252, 896, 81919, 0} (208, {200, 224, new_msg, 0, 1343328, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0\310\20\25\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\36;\316\10\260 HM\300\20\25\0h\1\24\0\12\0\0\0\0\0\0\0\300\20\25\0(\0\0\0\310\20\25\0\303\335S0x\1\24\0(\0\0\0n\317\0\0\0\0\24\0\350\356\22\0\225\310\210<\0\0\0\0H\3\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\14\357\22\0\372\31\221|\240\366\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 1252, 896, 81919, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\310\20\25\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\36;\316\10\260 HM\300\20\25\0h\1\24\0\12\0\0\0\0\0\0\0\300\20\25\0(\0\0\0\310\20\25\0\303\335S0x\1\24\0(\0\0\0n\317\0\0\0\0\24\0\350\356\22\0\225\310\210<\0\0\0\0H\3\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\14\357\22\0\372\31\221|\240\366\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ) == 0x0
02239 896 NtRequestWaitReplyPort (208, {64, 88, new_msg, 0, 0, 0, 0, 0} (208, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 1252, 896, 81920, 0} "\2\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\37\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" ) ... {52, 76, reply, 0, 1252, 896, 81920, 0} (208, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 1252, 896, 81920, 0} "\2\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\37\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" ) ) == 0x0
02240 896 NtClose (204, ... ) == 0x0
02241 896 NtClose (208, ... ) == 0x0
02242 896 NtCreateKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 208, 2, ) }, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 208, 2, ) , 0, ... 208, 2, ) == 0x0
02243 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 204, ) }, ... 204, ) == 0x0
02244 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02245 896 NtQueryValueKey (208, (208, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
02246 896 NtQueryValueKey (208, (208, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
02247 896 NtClose (208, ... ) == 0x0
02248 896 NtClose (204, ... ) == 0x0
02249 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 204, ) == 0x0
02250 896 NtConnectPort ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 1241076, 188, ... 208, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241076, 188, ... 208, 0x0, 0x0, 0x0, 188, ) == 0x0
02251 896 NtRequestWaitReplyPort (208, {200, 224, new_msg, 0, 1343328, 12, 2, 1310721} (208, {200, 224, new_msg, 0, 1343328, 12, 2, 1310721} "\0\0\0\0\274\0\0\0D6\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0T\323\324\200\243'\266\365\376\353\362u4\370\250d\12\0\0\0\323\352\341*\315\225m\254\0\0\0\0H\16\25\0\374\305D\205\312\372\355\353(\0\0\01\253\0>\0\0\24\0P\356\22\07w\251]\0\0\0\0H\3\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0t\356\22\0\372\31\221|\10\366\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 1252, 896, 81923, 0} "\7\0\0\0\274\0\0\0D6\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0T\323\324\200\243'\266\365\376\353\362u4\370\250d\12\0\0\0\323\352\341*\315\225m\254\0\0\0\0H\16\25\0\374\305D\205\312\372\355\353(\0\0\01\253\0>\0\0\24\0P\356\22\07w\251]\0\0\0\0H\3\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0t\356\22\0\372\31\221|\10\366\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ... {200, 224, reply, 0, 1252, 896, 81923, 0} (208, {200, 224, new_msg, 0, 1343328, 12, 2, 1310721} "\0\0\0\0\274\0\0\0D6\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0T\323\324\200\243'\266\365\376\353\362u4\370\250d\12\0\0\0\323\352\341*\315\225m\254\0\0\0\0H\16\25\0\374\305D\205\312\372\355\353(\0\0\01\253\0>\0\0\24\0P\356\22\07w\251]\0\0\0\0H\3\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0t\356\22\0\372\31\221|\10\366\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 1252, 896, 81923, 0} "\7\0\0\0\274\0\0\0D6\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0T\323\324\200\243'\266\365\376\353\362u4\370\250d\12\0\0\0\323\352\341*\315\225m\254\0\0\0\0H\16\25\0\374\305D\205\312\372\355\353(\0\0\01\253\0>\0\0\24\0P\356\22\07w\251]\0\0\0\0H\3\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0t\356\22\0\372\31\221|\10\366\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ) == 0x0
02252 896 NtRequestWaitReplyPort (208, {44, 68, new_msg, 0, 1252, 896, 81920, 0} (208, {44, 68, new_msg, 0, 1252, 896, 81920, 0} "\1\0\0\0A\2\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 1252, 896, 81924, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\320\1\0\0X-\12\0" ) ... {40, 64, reply, 0, 1252, 896, 81924, 0} (208, {44, 68, new_msg, 0, 1252, 896, 81920, 0} "\1\0\0\0A\2\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 1252, 896, 81924, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\320\1\0\0X-\12\0" ) ) == 0x0
02253 896 NtRequestWaitReplyPort (208, {64, 88, new_msg, 56, 1348600, 1241588, 1241688, 0} (208, {64, 88, new_msg, 56, 1348600, 1241588, 1241688, 0} "\10\362\22\0@\0\24\0\346\277\347wX\362\22\0\364\361\22\0\20\0\0\0\250.\362vl\224\24\0\1\0\0\0\30\22\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\310\16\25\0" ... {64, 88, reply, 56, 1252, 896, 81925, 0} "\10\362\22\0@\0\24\0\346\277\347wX\362\22\0\364\361\22\0\20\0\0\0\250.\362vl\224\24\0\1\0\0\0\30\22\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\310\16\25\0" ) ... {64, 88, reply, 56, 1252, 896, 81925, 0} (208, {64, 88, new_msg, 56, 1348600, 1241588, 1241688, 0} "\10\362\22\0@\0\24\0\346\277\347wX\362\22\0\364\361\22\0\20\0\0\0\250.\362vl\224\24\0\1\0\0\0\30\22\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\310\16\25\0" ... {64, 88, reply, 56, 1252, 896, 81925, 0} "\10\362\22\0@\0\24\0\346\277\347wX\362\22\0\364\361\22\0\20\0\0\0\250.\362vl\224\24\0\1\0\0\0\30\22\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\310\16\25\0" ) ) == 0x0
02254 896 NtClose (204, ... ) == 0x0
02255 896 NtClose (208, ... ) == 0x0
02256 896 NtCreateKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 208, 2, ) }, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 208, 2, ) , 0, ... 208, 2, ) == 0x0
02257 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 204, ) }, ... 204, ) == 0x0
02258 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02259 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02260 896 NtQueryValueKey (208, (208, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
02261 896 NtQueryValueKey (208, (208, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
02262 896 NtClose (208, ... ) == 0x0
02263 896 NtClose (204, ... ) == 0x0
02264 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 204, ) }, ... 204, ) == 0x0
02265 896 NtQueryValueKey (204, (204, "DnsNbtLookupOrder", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02266 896 NtClose (204, ... ) == 0x0
02267 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 1240664, ... ) }, 1240664, ... ) == 0x0
02268 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 204, {status=0x0, info=1}, ) }, 5, 96, ... 204, {status=0x0, info=1}, ) == 0x0
02269 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 204, ... 208, ) == 0x0
02270 896 NtClose (204, ... ) == 0x0
02271 896 NtMapViewOfSection (208, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3a0000), 0x0, 20480, ) == 0x0
02272 896 NtClose (208, ... ) == 0x0
02273 896 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0
02274 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 1240972, ... ) }, 1240972, ... ) == 0x0
02275 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 208, {status=0x0, info=1}, ) }, 5, 96, ... 208, {status=0x0, info=1}, ) == 0x0
02276 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 208, ... 204, ) == 0x0
02277 896 NtQuerySection (204, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
02278 896 NtClose (208, ... ) == 0x0
02279 896 NtMapViewOfSection (204, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fb0000), 0x0, 32768, ) == 0x0
02280 896 NtClose (204, ... ) == 0x0
02281 896 NtProtectVirtualMemory (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
02282 896 NtProtectVirtualMemory (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
02283 896 NtFlushInstructionCache (-1, 1996165120, 232, ... ) == 0x0
02284 896 NtProtectVirtualMemory (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
02285 896 NtProtectVirtualMemory (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
02286 896 NtFlushInstructionCache (-1, 1996165120, 232, ... ) == 0x0
02287 896 NtOpenSection (0xe, {24, 12, 0x40, 0, 0, (0xe, {24, 12, 0x40, 0, 0, "WLDAP32.dll"}, ... 204, ) }, ... 204, ) == 0x0
02288 896 NtMapViewOfSection (204, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0
02289 896 NtClose (204, ... ) == 0x0
02290 896 NtProtectVirtualMemory (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
02291 896 NtProtectVirtualMemory (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
02292 896 NtFlushInstructionCache (-1, 1995837440, 228, ... ) == 0x0
02293 896 NtProtectVirtualMemory (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
02294 896 NtProtectVirtualMemory (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
02295 896 NtFlushInstructionCache (-1, 1995837440, 228, ... ) == 0x0
02296 896 NtProtectVirtualMemory (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
02297 896 NtProtectVirtualMemory (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
02298 896 NtFlushInstructionCache (-1, 1996165120, 232, ... ) == 0x0
02299 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02300 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 204, ) == 0x0
02301 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 208, ) }, ... 208, ) == 0x0
02302 896 NtQueryValueKey (208, (208, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
02303 896 NtClose (208, ... ) == 0x0
02304 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02305 896 NtQueryPerformanceCounter (... {-1436517085, 16}, {3579545, 0}, ) == 0x0
02306 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 1240664, ... ) }, 1240664, ... ) == 0x0
02307 896 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
02308 896 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 3801088, 65536, ) == 0x0
02309 896 NtAllocateVirtualMemory (-1, 3801088, 0, 4096, 4096, 4, ... 3801088, 4096, ) == 0x0
02310 896 NtAllocateVirtualMemory (-1, 3805184, 0, 8192, 4096, 4, ... 3805184, 8192, ) == 0x0
02311 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 1240664, ... ) }, 1240664, ... ) == 0x0
02312 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 208, {status=0x0, info=1}, ) }, 5, 96, ... 208, {status=0x0, info=1}, ) == 0x0
02313 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 208, ... 212, ) == 0x0
02314 896 NtClose (208, ... ) == 0x0
02315 896 NtMapViewOfSection (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3b0000), 0x0, 110592, ) == 0x0
02316 896 NtClose (212, ... ) == 0x0
02317 896 NtUnmapViewOfSection (-1, 0x3b0000, ... ) == 0x0
02318 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 1240972, ... ) }, 1240972, ... ) == 0x0
02319 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 212, {status=0x0, info=1}, ) }, 5, 96, ... 212, {status=0x0, info=1}, ) == 0x0
02320 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 212, ... 208, ) == 0x0
02321 896 NtQuerySection (208, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
02322 896 NtClose (212, ... ) == 0x0
02323 896 NtMapViewOfSection (208, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x751d0000), 0x0, 122880, ) == 0x0
02324 896 NtClose (208, ... ) == 0x0
02325 896 NtProtectVirtualMemory (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
02326 896 NtProtectVirtualMemory (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
02327 896 NtFlushInstructionCache (-1, 1964838912, 224, ... ) == 0x0
02328 896 NtProtectVirtualMemory (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
02329 896 NtProtectVirtualMemory (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
02330 896 NtFlushInstructionCache (-1, 1964838912, 224, ... ) == 0x0
02331 896 NtOpenSection (0xe, {24, 12, 0x40, 0, 0, (0xe, {24, 12, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02332 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1240148, ... ) }, 1240148, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02333 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 1240148, ... ) }, 1240148, ... ) == 0x0
02334 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 208, {status=0x0, info=1}, ) }, 5, 96, ... 208, {status=0x0, info=1}, ) == 0x0
02335 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 208, ... 212, ) == 0x0
02336 896 NtQuerySection (212, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
02337 896 NtClose (208, ... ) == 0x0
02338 896 NtMapViewOfSection (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0
02339 896 NtClose (212, ... ) == 0x0
02340 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
02341 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
02342 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0
02343 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
02344 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
02345 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0
02346 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
02347 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
02348 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0
02349 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
02350 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
02351 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0
02352 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
02353 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
02354 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0
02355 896 NtProtectVirtualMemory (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
02356 896 NtProtectVirtualMemory (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
02357 896 NtFlushInstructionCache (-1, 1964838912, 224, ... ) == 0x0
02358 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02359 896 NtQueryDefaultUILanguage (2090319928, ...
02360 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
02361 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147481628, ) == 0x0
02362 896 NtQueryInformationToken (-2147481628, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
02363 896 NtClose (-2147481628, ... ) == 0x0
02364 896 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481628, ) }, ... -2147481628, ) == 0x0
02365 896 NtOpenKey (0x80000000, {24, -2147481628, 0x240, 0, 0, (0x80000000, {24, -2147481628, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02366 896 NtOpenKey (0x80000000, {24, -2147481628, 0x640, 0, 0, (0x80000000, {24, -2147481628, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482680, ) }, ... -2147482680, ) == 0x0
02367 896 NtQueryValueKey (-2147482680, (-2147482680, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02368 896 NtClose (-2147482680, ... ) == 0x0
02369 896 NtClose (-2147481628, ... ) == 0x0
02359 896 NtQueryDefaultUILanguage ... ) == 0x0
02370 896 NtQueryInstallUILanguage (2090319930, ... ) == 0x0
02371 896 NtQueryDefaultLocale (1, 1240868, ... ) == 0x0
02372 896 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
02373 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\Setup"}, ... 212, ) }, ... 212, ) == 0x0
02374 896 NtQueryValueKey (212, (212, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
02375 896 NtClose (212, ... ) == 0x0
02376 896 NtUserGetProcessWindowStation (... ) == 0x14
02377 896 NtUserGetObjectInformation (20, 1, 1240464, 12, 1240476, ... ) == 0x1
02378 896 NtOpenKey (0xf003f, {24, 32, 0x40, 0, 0, (0xf003f, {24, 32, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02379 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "System\WPA\PnP"}, ... 212, ) }, ... 212, ) == 0x0
02380 896 NtQueryValueKey (212, (212, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
02381 896 NtClose (212, ... ) == 0x0
02382 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "SYSTEM\Setup"}, ... 212, ) }, ... 212, ) == 0x0
02383 896 NtQueryValueKey (212, (212, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
02384 896 NtQueryValueKey (212, (212, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
02385 896 NtClose (212, ... ) == 0x0
02386 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "SYSTEM\Setup"}, ... 212, ) }, ... 212, ) == 0x0
02387 896 NtQueryValueKey (212, (212, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
02388 896 NtQueryValueKey (212, (212, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
02389 896 NtClose (212, ... ) == 0x0
02390 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 212, ) }, ... 212, ) == 0x0
02391 896 NtQueryValueKey (212, (212, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
02392 896 NtQueryValueKey (212, (212, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
02393 896 NtClose (212, ... ) == 0x0
02394 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 212, ) }, ... 212, ) == 0x0
02395 896 NtQueryValueKey (212, (212, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
02396 896 NtQueryValueKey (212, (212, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
02397 896 NtClose (212, ... ) == 0x0
02398 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 212, ) }, ... 212, ) == 0x0
02399 896 NtQueryValueKey (212, (212, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
02400 896 NtQueryValueKey (212, (212, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
02401 896 NtClose (212, ... ) == 0x0
02402 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 212, ) }, ... 212, ) == 0x0
02403 896 NtQueryValueKey (212, (212, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
02404 896 NtQueryValueKey (212, (212, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
02405 896 NtClose (212, ... ) == 0x0
02406 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 212, ) }, ... 212, ) == 0x0
02407 896 NtQueryValueKey (212, (212, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
02408 896 NtQueryValueKey (212, (212, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (212, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
02409 896 NtAllocateVirtualMemory (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0
02410 896 NtClose (212, ... ) == 0x0
02411 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 212, ) == 0x0
02412 896 NtCreateMutant (0x1f0001, 0x0, 0, ... 208, ) == 0x0
02413 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 216, ) == 0x0
02414 896 NtCreateMutant (0x1f0001, 0x0, 0, ... 220, ) == 0x0
02415 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 224, ) == 0x0
02416 896 NtCreateMutant (0x1f0001, 0x0, 0, ... 228, ) == 0x0
02417 896 NtOpenKey (0x1, {24, 32, 0x40, 0, 0, (0x1, {24, 32, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 232, ) }, ... 232, ) == 0x0
02418 896 NtQueryValueKey (232, (232, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
02419 896 NtQueryValueKey (232, (232, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
02420 896 NtQueryValueKey (232, (232, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02421 896 NtOpenKey (0x1, {24, 232, 0x40, 0, 0, (0x1, {24, 232, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02422 896 NtClose (232, ... ) == 0x0
02423 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1240380, ... ) }, 1240380, ... ) == 0x0
02424 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 232, ) }, ... 232, ) == 0x0
02425 896 NtQueryValueKey (232, (232, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (232, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (232, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
02426 896 NtClose (232, ... ) == 0x0
02427 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 232, ) }, ... 232, ) == 0x0
02428 896 NtQueryValueKey (232, (232, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (232, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (232, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
02429 896 NtClose (232, ... ) == 0x0
02430 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02431 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 232, ) }, ... 232, ) == 0x0
02432 896 NtQueryValueKey (232, (232, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (232, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (232, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
02433 896 NtClose (232, ... ) == 0x0
02434 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshbth.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02435 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 232, ) == 0x0
02436 896 NtConnectPort ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 1240880, 188, ... 236, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1240880, 188, ... 236, 0x0, 0x0, 0x0, 188, ) == 0x0
02437 896 NtRequestWaitReplyPort (236, {200, 224, new_msg, 0, 3276848, 1384056, 12, 2} (236, {200, 224, new_msg, 0, 3276848, 1384056, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\1\0\5\0\4\0\0\0\2001\24\0P\36\25\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0%\233Uu\261\341:\17H\36\25\0h\1\24\0\12\0\0\0\0\0\0\0H\36\25\0(\0\0\0P\36\25\0\373 \241\374x\1\24\0(\0\0\0\347\252\0\0\0\0\24\0\214\355\22\0$\276\22\0\0\0\0X\26\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\260\355\22\0\372\31\221|D\365\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1252, 896, 81928, 0} "\7\0\24\0\10\0\0\0\274\0\0\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\2001\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0%\233Uu\261\341:\17H\36\25\0h\1\24\0\12\0\0\0\0\0\0\0H\36\25\0(\0\0\0P\36\25\0\373 \241\374x\1\24\0(\0\0\0\347\252\0\0\0\0\24\0\214\355\22\0$\276\22\0\0\0\0X\26\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\260\355\22\0\372\31\221|D\365\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) ... {200, 224, reply, 0, 1252, 896, 81928, 0} (236, {200, 224, new_msg, 0, 3276848, 1384056, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\1\0\5\0\4\0\0\0\2001\24\0P\36\25\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0%\233Uu\261\341:\17H\36\25\0h\1\24\0\12\0\0\0\0\0\0\0H\36\25\0(\0\0\0P\36\25\0\373 \241\374x\1\24\0(\0\0\0\347\252\0\0\0\0\24\0\214\355\22\0$\276\22\0\0\0\0X\26\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\260\355\22\0\372\31\221|D\365\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1252, 896, 81928, 0} "\7\0\24\0\10\0\0\0\274\0\0\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\2001\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0%\233Uu\261\341:\17H\36\25\0h\1\24\0\12\0\0\0\0\0\0\0H\36\25\0(\0\0\0P\36\25\0\373 \241\374x\1\24\0(\0\0\0\347\252\0\0\0\0\24\0\214\355\22\0$\276\22\0\0\0\0X\26\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\260\355\22\0\372\31\221|D\365\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) ) == 0x0
02438 896 NtRequestWaitReplyPort (236, {96, 120, new_msg, 0, 1252, 896, 81924, 0} (236, {96, 120, new_msg, 0, 1252, 896, 81924, 0} "\1\356\0\0A\2\11\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0,h\24\0\16\0\0\0\0\0\0\0\16\0\0\0m\0i\0c\0r\0o\0s\0o\0f\0t\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 1252, 896, 81929, 0} "\2\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" ) ... {44, 68, reply, 0, 1252, 896, 81929, 0} (236, {96, 120, new_msg, 0, 1252, 896, 81924, 0} "\1\356\0\0A\2\11\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0,h\24\0\16\0\0\0\0\0\0\0\16\0\0\0m\0i\0c\0r\0o\0s\0o\0f\0t\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 1252, 896, 81929, 0} "\2\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" ) ) == 0x0
02439 896 NtClose (232, ... ) == 0x0
02440 896 NtClose (236, ... ) == 0x0
02441 896 NtOpenKey (0x20019, {24, 32, 0x40, 0, 0, (0x20019, {24, 32, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Linkage"}, ... 236, ) }, ... 236, ) == 0x0
02442 896 NtQueryValueKey (236, (236, "Export", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
02443 896 NtQueryValueKey (236, (236, "Export", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
02444 896 NtQueryValueKey (236, (236, "Export", Partial, 958, ... TitleIdx=0, Type=7, Data="\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\04\07\02\0-\06\09\07\02\08\0E\0B\08\0A\07\0D\07\0}\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\06\0C\01\0-\05\04\02\05\0C\00\0D\0E\02\07\0B\06\0}\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0C\09\0C\0-\0E\0E\0A\0F\0B\07\06\0F\0F\0A\02\0F\0}\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\08\02\00\0-\09\02\07\0E\02\00\07\06\00\0A\0B\04\0}\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0\0\0\0\0\276\3\0\0\215\11\0\0\344\4\0\0\200\3\0\0\27\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\20 \0\0\0\0\30\0\0\0\0\0\0\0p\365\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\0v\0\270\36\25\0\0\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\04\07\02\0-\06\09\07\02\08\0E\0B\08\0A\07\0D\07\0}\0\377\377\377\377\0\0\0\0\0\0\0\0\3\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\215\11\0\0\344\4\0\0\200\3\0\0\27\0\0\0\1\0\1\04\0\0\300\0\0\0\0\216\11\0\0\344\4\0\0\200\3\0\0\27\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\20 \0\0\0\0\30\0\0\0\0\0\0\0p\365\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\0v\0.\37\25\0\0\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\06\0C\01\0-\05\04\02\05\0C\00\0D\0E\02\07\0B\06\0}\0\377\377\377\377\0\0"}, 958, ) , Partial, 958, ... TitleIdx=0, Type=7, Data= (236, "Export", Partial, 958, ... TitleIdx=0, Type=7, Data="\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\04\07\02\0-\06\09\07\02\08\0E\0B\08\0A\07\0D\07\0}\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\06\0C\01\0-\05\04\02\05\0C\00\0D\0E\02\07\0B\06\0}\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0C\09\0C\0-\0E\0E\0A\0F\0B\07\06\0F\0F\0A\02\0F\0}\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\08\02\00\0-\09\02\07\0E\02\00\07\06\00\0A\0B\04\0}\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0\0\0\0\0\276\3\0\0\215\11\0\0\344\4\0\0\200\3\0\0\27\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\20 \0\0\0\0\30\0\0\0\0\0\0\0p\365\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\0v\0\270\36\25\0\0\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\04\07\02\0-\06\09\07\02\08\0E\0B\08\0A\07\0D\07\0}\0\377\377\377\377\0\0\0\0\0\0\0\0\3\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\215\11\0\0\344\4\0\0\200\3\0\0\27\0\0\0\1\0\1\04\0\0\300\0\0\0\0\216\11\0\0\344\4\0\0\200\3\0\0\27\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\20 \0\0\0\0\30\0\0\0\0\0\0\0p\365\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0t\0v\0.\37\25\0\0\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\06\0C\01\0-\05\04\02\05\0C\00\0D\0E\02\07\0B\06\0}\0\377\377\377\377\0\0"}, 958, ) }, 958, ) == 0x0
02445 896 NtCreateFile (0x20100000, {24, 0, 0x40, 0, 0, (0x20100000, {24, 0, 0x40, 0, 0, "\Device\NetBT_Tcpip_{FCC03A41-8CCC-4919-A472-69728EB8A7D7}"}, 0x0, 0, 3, 3, 0, 0, 0, ... ) }, 0x0, 0, 3, 3, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02446 896 NtCreateFile (0x20100000, {24, 0, 0x40, 0, 0, (0x20100000, {24, 0, 0x40, 0, 0, "\Device\NetBT_Tcpip_{AE7421B5-732D-4567-A6C1-5425C0DE27B6}"}, 0x0, 0, 3, 3, 0, 0, 0, ... ) }, 0x0, 0, 3, 3, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02447 896 NtCreateFile (0x20100000, {24, 0, 0x40, 0, 0, (0x20100000, {24, 0, 0x40, 0, 0, "\Device\NetBT_Tcpip_{97C2D9F4-6954-4EB3-8C9C-EEAFB76FFA2F}"}, 0x0, 0, 3, 3, 0, 0, 0, ... ) }, 0x0, 0, 3, 3, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02448 896 NtCreateFile (0x20100000, {24, 0, 0x40, 0, 0, (0x20100000, {24, 0, 0x40, 0, 0, "\Device\NetBT_Tcpip_{0D430A6F-0410-4A68-9820-927E20760AB4}"}, 0x0, 0, 3, 3, 0, 0, 0, ... 232, {status=0x0, info=0}, ) }, 0x0, 0, 3, 3, 0, 0, 0, ... 232, {status=0x0, info=0}, ) == 0x0
02449 896 NtCreateFile (0x20100000, {24, 0, 0x40, 0, 0, (0x20100000, {24, 0, 0x40, 0, 0, "\Device\NetBT_Tcpip_{8AD4D806-081B-4446-A4DB-6273DFAED94F}"}, 0x0, 0, 3, 3, 0, 0, 0, ... ) }, 0x0, 0, 3, 3, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02450 896 NtCreateFile (0x20100000, {24, 0, 0x40, 0, 0, (0x20100000, {24, 0, 0x40, 0, 0, "\Device\NetBT_Tcpip_{E559B0C1-FA46-464D-B965-7E2AC2627EE9}"}, 0x0, 0, 3, 3, 0, 0, 0, ... ) }, 0x0, 0, 3, 3, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02451 896 NtCreateFile (0x20100000, {24, 0, 0x40, 0, 0, (0x20100000, {24, 0, 0x40, 0, 0, "\Device\NetBT_Tcpip_{CD3C64B8-DB76-44C8-9C02-70E6C1185259}"}, 0x0, 0, 3, 3, 0, 0, 0, ... ) }, 0x0, 0, 3, 3, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02452 896 NtCreateFile (0x20100000, {24, 0, 0x40, 0, 0, (0x20100000, {24, 0, 0x40, 0, 0, "\Device\NetBT_Tcpip_{21B8E9D5-3FC3-4F9D-8FA8-4CA01330DCD8}"}, 0x0, 0, 3, 3, 0, 0, 0, ... ) }, 0x0, 0, 3, 3, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02453 896 NtClose (236, ... ) == 0x0
02454 896 NtCreateEvent (0x1f0003, 0x0, 0, 1, ... 236, ) == 0x0
02455 896 NtDeviceIoControlFile (232, 236, 0x0, 0x0, 0x210096, (232, 236, 0x0, 0x0, 0x210096, "\0\0\0\0\0\0\0\0MICROSOFT.COM \0", 24, 1160, ... {status=0x140178, info=1311096}, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 24, 1160, ... {status=0x140178, info=1311096}, (232, 236, 0x0, 0x0, 0x210096, "\0\0\0\0\0\0\0\0MICROSOFT.COM \0", 24, 1160, ... {status=0x140178, info=1311096}, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
02456 896 NtWaitForMultipleObjects (1, (236, ), 1, 0, 0x0, ... ) == 0x0
02457 896 NtClose (236, ... ) == 0x0
02458 896 NtOpenKey (0x2000000, {24, 32, 0x40, 0, 0, (0x2000000, {24, 32, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 236, ) }, ... 236, ) == 0x0
02459 896 NtQueryValueKey (236, (236, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
02460 896 NtQueryValueKey (236, (236, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
02461 896 NtQueryValueKey (236, (236, "AutodialDLL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02462 896 NtClose (236, ... ) == 0x0
02463 896 NtOpenSection (0xe, {24, 12, 0x40, 0, 0, (0xe, {24, 12, 0x40, 0, 0, "rasadhlp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02464 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\rasadhlp.dll"}, 1241712, ... ) }, 1241712, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02465 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rasadhlp.dll"}, 1241712, ... ) }, 1241712, ... ) == 0x0
02466 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rasadhlp.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0
02467 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 236, ... 240, ) == 0x0
02468 896 NtQuerySection (240, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
02469 896 NtClose (236, ... ) == 0x0
02470 896 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fc0000), 0x0, 24576, ) == 0x0
02471 896 NtClose (240, ... ) == 0x0
02472 896 NtProtectVirtualMemory (-1, (0x76fc1000), 152, 4, ... (0x76fc1000), 4096, 32, ) == 0x0
02473 896 NtProtectVirtualMemory (-1, (0x76fc1000), 4096, 32, ... (0x76fc1000), 4096, 4, ) == 0x0
02474 896 NtFlushInstructionCache (-1, 1996230656, 152, ... ) == 0x0
02475 896 NtProtectVirtualMemory (-1, (0x76fc1000), 152, 4, ... (0x76fc1000), 4096, 32, ) == 0x0
02476 896 NtProtectVirtualMemory (-1, (0x76fc1000), 4096, 32, ... (0x76fc1000), 4096, 4, ) == 0x0
02477 896 NtFlushInstructionCache (-1, 1996230656, 152, ... ) == 0x0
02478 896 NtProtectVirtualMemory (-1, (0x76fc1000), 152, 4, ... (0x76fc1000), 4096, 32, ) == 0x0
02479 896 NtProtectVirtualMemory (-1, (0x76fc1000), 4096, 32, ... (0x76fc1000), 4096, 4, ) == 0x0
02480 896 NtFlushInstructionCache (-1, 1996230656, 152, ... ) == 0x0
02481 896 NtProtectVirtualMemory (-1, (0x76fc1000), 152, 4, ... (0x76fc1000), 4096, 32, ) == 0x0
02482 896 NtProtectVirtualMemory (-1, (0x76fc1000), 4096, 32, ... (0x76fc1000), 4096, 4, ) == 0x0
02483 896 NtFlushInstructionCache (-1, 1996230656, 152, ... ) == 0x0
02484 896 NtProtectVirtualMemory (-1, (0x76fc1000), 152, 4, ... (0x76fc1000), 4096, 32, ) == 0x0
02485 896 NtProtectVirtualMemory (-1, (0x76fc1000), 4096, 32, ... (0x76fc1000), 4096, 4, ) == 0x0
02486 896 NtFlushInstructionCache (-1, 1996230656, 152, ... ) == 0x0
02487 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rasadhlp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
02488 896 NtQueryPerformanceCounter (... {-1428460996, 16}, {3579545, 0}, ) == 0x0
02489 896 NtCreateFile (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 240, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 240, {status=0x0, info=0}, ) == 0x0
02490 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 236, ) == 0x0
02491 896 NtDeviceIoControlFile (240, 236, 0x0, 0x0, 0xf14014, (240, 236, 0x0, 0x0, 0xf14014, "\3\0\0\0microsoft.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
02492 896 NtClose (236, ... ) == 0x0
02493 896 NtClose (240, ... ) == 0x0
02494 896 NtDelayExecution (0, {-1705032704, -2}, ...