Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtOpenMutant(>) 
 2 
NtGdiGetDCObject(>) 
 7 
NtCreateEvent(>) 
 16 

NtCallbackReturn(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 2 
NtGdiGetDCforBitmap(>) 
 7 
NtGdiDeleteObjectApp(>) 
 18 

NtCreateMutant(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtGdiGetStockObject(>) 
 7 
NtUserCallOneParam(>) 
 20 

NtCreateProcessEx(>) 
 1 
NtReadVirtualMemory(>) 
 2 
NtGdiRestoreDC(>) 
 7 
NtQueryInformationProcess(>) 
 21 

NtDelayExecution(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 2 
NtGdiSaveDC(>) 
 7 
NtReadFile(>) 
 21 

NtEnumerateValueKey(>) 
 1 
NtReleaseMutant(>) 
 2 
NtGdiSetDIBitsToDeviceInternal(>) 
 7 
NtCreateFile(>) 
 23 

NtGdiCreatePaletteInternal(>) 
 1 
NtResumeThread(>) 
 2 
NtSetInformationProcess(>) 
 7 
NtWriteFile(>) 
 24 

NtGdiInit(>) 
 1 
NtSetEventBoostPriority(>) 
 2 
NtSetValueKey(>) 
 7 
NtOpenSection(>) 
 25 

NtGdiQueryFontAssocInfo(>) 
 1 
NtTestAlert(>) 
 2 
NtUserDestroyCursor(>) 
 7 
NtOpenProcessTokenEx(>) 
 27 

NtNotifyChangeKey(>) 
 1 
NtUserWaitForInputIdle(>) 
 2 
NtUserSetCursorIconData(>) 
 7 
NtOpenThreadTokenEx(>) 
 27 

NtOpenEvent(>) 
 1 
NtAddAtom(>) 
 3 
NtEnumerateKey(>) 
 8 
NtQueryDirectoryFile(>) 
 30 

NtOpenKeyedEvent(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtGdiCreateBitmap(>) 
 8 
NtQuerySystemInformation(>) 
 31 

NtOpenProcess(>) 
 1 
NtQueryPerformanceCounter(>) 
 3 
NtQueryDefaultUILanguage(>) 
 8 
NtQueryAttributesFile(>) 
 33 

NtQueryInformationJobObject(>) 
 1 
NtSetInformationObject(>) 
 3 
NtQuerySection(>) 
 9 
NtQueryInformationToken(>) 
 34 

NtQueryInformationThread(>) 
 1 
NtTerminateProcess(>) 
 3 
NtQueryVolumeInformationFile(>) 
 9 
NtOpenFile(>) 
 38 

NtQueryInstallUILanguage(>) 
 1 
NtContinue(>) 
 4 
NtSetInformationThread(>) 
 9 
NtMapViewOfSection(>) 
 41 

NtQueryObject(>) 
 1 
NtCreateSemaphore(>) 
 4 
NtGdiCreateCompatibleDC(>) 
 10 
NtUserGetAtomName(>) 
 47 

NtQuerySystemTime(>) 
 1 
NtDuplicateObject(>) 
 4 
NtGdiExtGetObjectW(>) 
 10 
NtUserUnregisterClass(>) 
 47 

NtSecureConnectPort(>) 
 1 
NtFreeVirtualMemory(>) 
 4 
NtOpenProcessToken(>) 
 10 
NtAllocateVirtualMemory(>) 
 51 

NtUserCallNoParam(>) 
 1 
NtSetEvent(>) 
 4 
NtQueryDebugFilterState(>) 
 10 
NtGdiSelectBitmap(>) 
 57 

NtUserEnumDisplayMonitors(>) 
 1 
NtWaitForMultipleObjects(>) 
 4 
NtQueryVirtualMemory(>) 
 10 
NtUserRegisterClassExWOW(>) 
 61 

NtUserGetKeyboardLayoutList(>) 
 1 
NtWaitForSingleObject(>) 
 4 
NtRequestWaitReplyPort(>) 
 11 
NtCreateSection(>) 
 71 

NtUserGetThreadDesktop(>) 
 1 
NtWriteVirtualMemory(>) 
 4 
NtUserGetDC(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 74 

NtUserSetWindowsHookEx(>) 
 1 
NtAccessCheck(>) 
 5 
NtDeviceIoControlFile(>) 
 12 
NtQueryValueKey(>) 
 77 

NtCreateIoCompletion(>) 
 2 
NtFsControlFile(>) 
 5 
NtSetInformationFile(>) 
 13 
NtFlushInstructionCache(>) 
 87 

NtCreateThread(>) 
 2 
NtOpenThreadToken(>) 
 5 
NtQueryDefaultLocale(>) 
 14 
NtOpenKey(>) 
 147 

NtDeleteAtom(>) 
 2 
NtUserRegisterWindowMessage(>) 
 5 
NtUnmapViewOfSection(>) 
 14 
NtProtectVirtualMemory(>) 
 174 

NtDuplicateToken(>) 
 2 
NtCreateKey(>) 
 6 
NtUserSelectPalette(>) 
 14 
NtClose(>) 
 315 

NtGdiCreateSolidBrush(>) 
 2 
NtGdiBitBlt(>) 
 7 
NtUserSystemParametersInfo(>) 
 14 

NtOpenDirectoryObject(>) 
 2 
NtGdiCreateDIBitmapInternal(>) 
 7 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482756, {status=0x0, info=1}, ) }, 0, 32, ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482756, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482756, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482756, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482756, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482756, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482756, 0, 0x0, 0x0, 0x90120,  (-2147482756, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00059   896   NtClose  (-2147482104, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482592, ) == 0x0
 00061   896   NtClose  (-2147482592, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482592, ... -2147481624, ) == 0x0
 00063   896   NtClose  (-2147481624, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481624, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147482104, ... ) == 0x0
 00105   896   NtClose  (-2147482592, ... ) == 0x0
 00106   896   NtClose  (-2147481624, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481624, ) == 0x0
 00145   896   NtClose  (-2147481624, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481624, ... -2147482592, ) == 0x0
 00147   896   NtClose  (-2147482592, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482592, ... -2147482104, ) == 0x0
 00149   896   NtClose  (-2147482104, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482104, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481624, ... ) == 0x0
 00178   896   NtClose  (-2147482592, ... ) == 0x0
 00179   896   NtClose  (-2147482104, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482756, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 128, ... (0x31428000), 8192, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00249   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00250   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00251   896   NtClose  (16, ... ) == 0x0
 00252   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00253   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00254   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00255   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00256   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00257   896   NtClose  (16, ... ) == 0x0
 00258   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00259   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00260   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00261   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00262   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00263   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00264   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00265   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00266   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00267   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00268   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00269   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00270   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00271   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00272   896   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00273   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00274   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00275   896   NtClose  (16, ... ) == 0x0
 00276   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00277   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00278   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00282   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00283   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00284   896   NtClose  (16, ... ) == 0x0
 00285   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00286   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00287   896   NtClose  (16, ... ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00289   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00290   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00291   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00292   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00293   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00294   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00295   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00296   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00297   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00298   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00299   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00300   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00301   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00302   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00303   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00304   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00305   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00306   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00307   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00308   896   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00309   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00310   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 00311   896   NtClose  (16, ... ) == 0x0
 00312   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00313   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00314   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00315   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00316   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00317   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00318   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00319   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00320   896   NtClose  (16, ... ) == 0x0
 00321   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00322   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00323   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00324   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00325   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00326   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00327   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00328   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00329   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00330   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00331   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00332   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00333   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00334   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00335   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00336   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00337   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00338   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00339   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00340   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00341   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00342   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00343   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00344   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00345   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00346   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00347   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00348   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00349   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x400000), 0x0, 36864, ) == 0x0
 00350   896   NtClose  (16, ... ) == 0x0
 00351   896   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00352   896   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00353   896   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00354   896   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00355   896   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00356   896   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00357   896   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00358   896   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00359   896   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00360   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00361   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00362   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00363   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00364   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 00365   896   NtClose  (16, ... ) == 0x0
 00366   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00367   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00368   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00369   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00370   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00371   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00372   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00373   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00374   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00375   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00376   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00377   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00378   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00379   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00380   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00381   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00382   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00383   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00384   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00385   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00386   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00387   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00388   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00389   896   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00390   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00391   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00392   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00393   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00394   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == 0x0
 00395   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00396   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00397   896   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00398   896   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00399   896   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00400   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00401   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00402   896   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00403   896   NtClose  (36, ... ) == 0x0
 00404   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00405   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00406   896   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00407   896   NtClose  (36, ... ) == 0x0
 00408   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00409   896   NtClose  (32, ... ) == 0x0
 00410   896   NtClose  (16, ... ) == 0x0
 00411   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00412   896   NtClose  (28, ... ) == 0x0
 00413   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00414   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00415   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00416   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00417   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00418   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == 0x0
 00419   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00420   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 16, ) == 0x0
 00421   896   NtQuerySection  (16, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00422   896   NtClose  (28, ... ) == 0x0
 00423   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00424   896   NtClose  (16, ... ) == 0x0
 00425   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00426   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00427   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00428   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00429   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00430   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00431   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00432   896   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00433   896   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00434   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00435   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00436   896   NtReadFile  (16, 0, 0, 0, 4, {187356, 0}, 0, ... {status=0x0, info=4},  (16, 0, 0, 0, 4, {187356, 0}, 0, ... {status=0x0, info=4}, "T\236\32\0", ) , ) == 0x0
 00437   896   NtClose  (16, ... ) == 0x0
 00438   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00439   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00440   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00441   896   NtClose  (16, ... ) == 0x0
 00442   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00443   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00444   896   NtClose  (16, ... ) == 0x0
 00445   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00446   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00447   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00448   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00449   896   NtQueryValueKey  (16,  (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00450   896   NtClose  (16, ... ) == 0x0
 00451   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 16, ) }, ... 16, ) == 0x0
 00452   896   NtQueryValueKey  (16,  (16, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00453   896   NtClose  (16, ... ) == 0x0
 00454   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 16, ) }, ... 16, ) == 0x0
 00455   896   NtSetInformationObject  (16, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00456   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00457   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCRT.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00458   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00459   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00460   896   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00461   896   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00462   896   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00463   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 28, ) }, ... 28, ) == 0x0
 00464   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00465   896   NtClose  (28, ... ) == 0x0
 00466   896   NtAllocateVirtualMemory  (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0
 00467   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00468   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00469   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00470   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00471   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00472   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00473   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00474   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836}  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6!\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6!\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00475   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 28, ) }, ... 28, ) == 0x0
 00476   896   NtQueryValueKey  (28,  (28, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00477   896   NtClose  (28, ... ) == 0x0
 00478   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00479   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0
 00480   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00481   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 32, ) == 0x0
 00482   896   NtClose  (28, ... ) == 0x0
 00483   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00484   896   NtClose  (32, ... ) == 0x0
 00485   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00486   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0
 00487   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00488   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 32, ... 28, ) == 0x0
 00489   896   NtClose  (32, ... ) == 0x0
 00490   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00491   896   NtClose  (28, ... ) == 0x0
 00492   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00493   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0
 00494   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00495   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0
 00496   896   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00497   896   NtClose  (28, ... ) == 0x0
 00498   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00499   896   NtClose  (32, ... ) == 0x0
 00500   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00501   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00502   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00503   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00504   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00505   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00506   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00507   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00508   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00509   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00510   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00511   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00512   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0
 00513   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00514   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00515   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00516   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00517   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00518   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WININET.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00519   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00520   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00521   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0
 00522   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00523   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0
 00524   896   NtQueryValueKey  (32,  (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00525   896   NtClose  (32, ... ) == 0x0
 00526   896   NtMapViewOfSection  (-2147482756, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4e0000), 0x0, 1060864, ) == 0x0
 00527   896   NtClose  (-2147482756, ... ) == 0x0
 00528   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00529   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00530   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482756, ) == 0x0
 00531   896   NtQueryInformationToken  (-2147482756, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00532   896   NtQueryInformationToken  (-2147482756, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00533   896   NtClose  (-2147482756, ... ) == 0x0
 00534   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00535   896   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00536   896   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00537   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00538   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00539   896   NtClose  (-2147482756, ... ) == 0x0
 00540   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00541   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00542   896   NtClose  (-2147482756, ... ) == 0x0
 00543   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00544   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00545   896   NtUserCallNoParam  (24, ... ) == 0x0
 00546   896   NtGdiCreateCompatibleDC  (0, ...
 00547   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00546   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00548   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00549   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00550   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00551   896   NtGdiCreateSolidBrush  (0, 0, ...
 00552   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00551   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00553   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00554   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00555   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00556   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x24
 00557   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00558   896   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00559   896   NtClose  (44, ... ) == 0x0
 00560   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00561   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x8177c017
 00562   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00563   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x8177c01c
 00564   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00565   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x8177c01e
 00566   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00567   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x81778002
 00568   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10013
 00569   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x8177c018
 00570   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00571   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x8177c01a
 00572   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00573   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x8177c01d
 00574   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00575   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x8177c026
 00576   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00577   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x8177c019
 00578   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c020
 00579   896   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8177c022
 00580   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c023
 00581   896   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8177c024
 00582   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c025
 00583   896   NtCallbackReturn  (0, 0, 0, ...
 00584   896   NtGdiInit  (... ) == 0x1
 00585   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00586   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00587   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00588   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 44, ) }, ... 44, ) == 0x0
 00589   896   NtCreateSemaphore  (0x1f0003, {24, 44, 0x80, 1329368, 0,  (0x1f0003, {24, 44, 0x80, 1329368, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 48, ) }, 0, 2147483647, ... 48, ) == STATUS_OBJECT_NAME_EXISTS
 00590   896   NtQueryPerformanceCounter  (... {-1450601080, 16}, {3579545, 0}, ) == 0x0
 00591   896   NtQueryPerformanceCounter  (... {-1450596375, 16}, {3579545, 0}, ) == 0x0
 00592   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 8192, 4096, 4, ... 1331200, 8192, ) == 0x0
 00593   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00594   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9371648, 1048576, ) == 0x0
 00595   896   NtAllocateVirtualMemory  (-1, 9371648, 0, 4096, 4096, 4, ... 9371648, 4096, ) == 0x0
 00596   896   NtAllocateVirtualMemory  (-1, 9375744, 0, 8192, 4096, 4, ... 9375744, 8192, ) == 0x0
 00597   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00598   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242800,  (0xc0100080, {24, 0, 0x40, 0, 1242800, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 56, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 56, {status=0x0, info=0}, ) == 0x0
 00599   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 60, ) == 0x0
 00600   896   NtDeviceIoControlFile  (56, 60, 0x0, 0x12f710, 0x22414c,  (56, 60, 0x0, 0x12f710, 0x22414c, "X\367\22\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00601   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00602   896   NtQueryValueKey  (-2147482756,  (-2147482756, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00603   896   NtQueryValueKey  (-2147482756,  (-2147482756, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00604   896   NtClose  (-2147482756, ... ) == 0x0
 00605   896   NtClose  (892, ... ) == 0x0
 00600   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, "\330\34\34\341\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#u\0l\0t\0\16\0\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00606   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243016,  (0xc0100080, {24, 0, 0x40, 0, 1243016, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 68, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 68, {status=0x0, info=0}, ) == 0x0
 00607   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 72, ) == 0x0
 00608   896   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 76, ) == 0x0
 00609   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 80, ) == 0x0
 00610   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 84, ) == 0x0
 00611   896   NtAllocateVirtualMemory  (-1, 9383936, 0, 8192, 4096, 4, ... 9383936, 8192, ) == 0x0
 00612   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10420224, 1048576, ) == 0x0
 00613   896   NtAllocateVirtualMemory  (-1, 11460608, 0, 8192, 4096, 4, ... 11460608, 8192, ) == 0x0
 00614   896   NtProtectVirtualMemory  (-1, (0xaee000), 4096, 260, ... (0xaee000), 4096, 4, ) == 0x0
 00615   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1242100, 1242044, 1, ... 88, {1252, 2016}, ) == 0x0
 00616   896   NtQueryInformationThread  (88, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffde000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 00617   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024}  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81835, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81835, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81835, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 00618   896   NtResumeThread  (88, ... 1, ) == 0x0
 00619   896   NtClose  (88, ... ) == 0x0
 00620   896   NtSetEvent  (72, ... 0x0, ) == 0x0
 00621  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 88, ) == 0x0
 00622  2016   NtWaitForSingleObject  (88, 0, 0x0, ...
 00623   896   NtSetEvent  (52, ... 0x0, ) == 0x0
 00624   896   NtClose  (52, ... ) == 0x0
 00625   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00626   896   NtAllocateVirtualMemory  (-1, 9392128, 0, 4096, 4096, 4, ... 9392128, 4096, ) == 0x0
 00627   896   NtDeviceIoControlFile  (56, 60, 0x0, 0x12f710, 0x22414c,  (56, 60, 0x0, 0x12f710, 0x22414c, "X\367\22\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00628   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00629   896   NtQueryValueKey  (-2147482756,  (-2147482756, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00630   896   NtQueryValueKey  (-2147482756,  (-2147482756, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00631   896   NtClose  (-2147482756, ... ) == 0x0
 00632   896   NtClose  (892, ... ) == 0x0
 00627   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " \30P\342\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344j\0e\0c\0t\0\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00633   896   NtSetEvent  (72, ... 0x0, ) == 0x0
 00634   896   NtSetEvent  (52, ... 0x0, ) == 0x0
 00635   896   NtClose  (52, ... ) == 0x0
 00636   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 00637   896   NtOpenProcessToken  (-1, 0xa, ... 52, ) == 0x0
 00638   896   NtDuplicateToken  (52, 0xc, {24, 0, 0x0, 0, 1243284, 0x0}, 0, 2, ... 96, ) == 0x0
 00639   896   NtClose  (52, ... ) == 0x0
 00640   896   NtAccessCheck  (1335152, 96, 0x1, 1243360, 1243412, 56, 1243392, ... (0x1), ) == 0x0
 00641   896   NtClose  (96, ... ) == 0x0
 00642   896   NtQueryDefaultUILanguage  (1242164, ...
 00643   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00644   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 00645   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00646   896   NtClose  (-2147482756, ... ) == 0x0
 00647   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00648   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00649   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00650   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00651   896   NtClose  (-2147481452, ... ) == 0x0
 00652   896   NtClose  (-2147482756, ... ) == 0x0
 00642   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00653   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00654   896   NtQueryDefaultUILanguage  (2090319928, ...
 00655   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00656   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 00657   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00658   896   NtClose  (-2147482756, ... ) == 0x0
 00659   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00660   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00661   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00662   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00663   896   NtClose  (-2147481452, ... ) == 0x0
 00664   896   NtClose  (-2147482756, ... ) == 0x0
 00654   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00665   896   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00666   896   NtQueryDefaultLocale  (1, 1240260, ... ) == 0x0
 00667   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00668   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020}  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81836, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81836, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81836, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" )  ) == 0x0
 00669   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00670   896   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00671   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00672   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00673   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1239488, ... ) }, 1239488, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00674   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00675   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00676   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00677   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1239552, ... ) }, 1239552, ... ) == 0x0
 00678   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 96, {status=0x0, info=1}, ) }, 3, 33, ... 96, {status=0x0, info=1}, ) == 0x0
 00679   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00680   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00681   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00682   896   NtClose  (52, ... ) == 0x0
 00683   896   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xaf0000), 0x0, 1056768, ) == 0x0
 00684   896   NtClose  (100, ... ) == 0x0
 00685   896   NtUnmapViewOfSection  (-1, 0xaf0000, ... ) == 0x0
 00686   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00687   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 100, ... 52, ) == 0x0
 00688   896   NtQuerySection  (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00689   896   NtClose  (100, ... ) == 0x0
 00690   896   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 00691   896   NtClose  (52, ... ) == 0x0
 00692   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00693   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00694   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00695   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00696   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00697   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00698   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00699   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00700   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00701   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00702   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00703   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00704   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00705   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00706   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00707   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00708   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00709   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00710   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00711   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00712   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00713   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00714   896   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1241032, ... ) , 42, 1241032, ... ) == 0x0
 00715   896   NtQueryDefaultUILanguage  (1239716, ...
 00716   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00717   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 00718   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00719   896   NtClose  (-2147482756, ... ) == 0x0
 00720   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00721   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00722   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00723   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00724   896   NtClose  (-2147481452, ... ) == 0x0
 00725   896   NtClose  (-2147482756, ... ) == 0x0
 00715   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00726   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238556, ... ) }, 1238556, ... ) == 0x0
 00727   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00728   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00729   896   NtClose  (52, ... ) == 0x0
 00730   896   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x370000), 0x0, 4096, ) == 0x0
 00731   896   NtClose  (100, ... ) == 0x0
 00732   896   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00733   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238152, ... ) }, 1238152, ... ) == 0x0
 00734   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238896,  (0x80100080, {24, 0, 0x40, 0, 1238896, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 100, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 100, {status=0x0, info=1}, ) == 0x0
 00735   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 100, ... 52, ) == 0x0
 00736   896   NtClose  (100, ... ) == 0x0
 00737   896   NtMapViewOfSection  (52, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x370000), {0, 0}, 4096, ) == 0x0
 00738   896   NtClose  (52, ... ) == 0x0
 00739   896   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00740   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 52, {status=0x0, info=1}, ) }, 1, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00741   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 52, ... 100, ) == 0x0
 00742   896   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x370000), 0x0, 4096, ) == 0x0
 00743   896   NtQueryInformationFile  (52, 1238548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00744   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00745   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572}  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81839, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81839, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81839, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" )  ) == 0x0
 00746   896   NtClose  (52, ... ) == 0x0
 00747   896   NtClose  (100, ... ) == 0x0
 00748   896   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00749   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00750   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00751   896   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 00752   896   NtUserGetDC  (0, ... ) == 0x1010052
 00753   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00754   896   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 00755   896   NtUserSystemParametersInfo  (66, 12, 1240548, 0, ... ) == 0x1
 00756   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00757   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00758   896   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00759   896   NtClose  (100, ... ) == 0x0
 00760   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 100, ) }, ... 100, ) == 0x0
 00761   896   NtOpenProcessToken  (-1, 0x8, ... 52, ) == 0x0
 00762   896   NtAccessCheck  (1335152, 52, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00763   896   NtClose  (52, ... ) == 0x0
 00764   896   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Control Panel\Desktop"}, ... 52, ) }, ... 52, ) == 0x0
 00765   896   NtQueryValueKey  (52,  (52, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00766   896   NtClose  (52, ... ) == 0x0
 00767   896   NtUserSystemParametersInfo  (41, 500, 1240576, 0, ... ) == 0x1
 00768   896   NtOpenProcessToken  (-1, 0x8, ... 52, ) == 0x0
 00769   896   NtAccessCheck  (1335152, 52, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00770   896   NtClose  (52, ... ) == 0x0
 00771   896   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 52, ) }, ... 52, ) == 0x0
 00772   896   NtQueryValueKey  (52,  (52, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00773   896   NtClose  (52, ... ) == 0x0
 00774   896   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 00775   896   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 00776   896   NtClose  (100, ... ) == 0x0
 00777   896   NtUserSystemParametersInfo  (4130, 0, 1241080, 0, ... ) == 0x1
 00778   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 100, ) }, ... 100, ) == 0x0
 00779   896   NtEnumerateValueKey  (100, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00780   896   NtClose  (100, ... ) == 0x0
 00781   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00782   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03b
 00783   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03d
 00784   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00785   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03f
 00786   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00787   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c041
 00788   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00789   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c043
 00790   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c045
 00791   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00792   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c047
 00793   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00794   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c049
 00795   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00796   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04b
 00797   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00798   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04d
 00799   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00800   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04f
 00801   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c051
 00802   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00803   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c053
 00804   896   NtUserFindExistingCursorIcon  (1240324, 1240340, 1240388, ... ) == 0x10011
 00805   896   NtUserRegisterClassExWOW  (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8177c055
 00806   896   NtUserFindExistingCursorIcon  (1240324, 1240340, 1240388, ... ) == 0x10011
 00807   896   NtUserRegisterClassExWOW  (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8177c057
 00808   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00809   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c059
 00810   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10013
 00811   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05b
 00812   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00813   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05d
 00814   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00815   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05f
 00816   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00817   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c017
 00818   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00819   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c019
 00820   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10013
 00821   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c018
 00822   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00823   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01a
 00824   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00825   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01c
 00826   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00827   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01e
 00828   896   NtUserFindExistingCursorIcon  (1240320, 1240336, 1240384, ... ) == 0x10011
 00829   896   NtUserRegisterClassExWOW  (1240320, 1240388, 1240404, 1240420, 0, 384, 0, ... ) == 0x8177c01b
 00830   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00831   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c068
 00832   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00833   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c06a
 00834   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00835   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00836   896   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00837   896   NtClose  (100, ... ) == 0x0
 00838   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 100, ) }, ... 100, ) == 0x0
 00839   896   NtSetInformationObject  (100, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00840   896   NtCreateKey  (0x2001f, {24, 100, 0x40, 0, 0,  (0x2001f, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 52, 2, ) }, 0, 0x0, 0, ... 52, 2, ) == 0x0
 00841   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00842   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00843   896   NtSetEventBoostPriority  (88, ...
 00622  2016   NtWaitForSingleObject  ... ) == 0x0
 00844  2016   NtTestAlert  (... ) == 0x0
 00845  2016   NtContinue  (11468080, 1, ...
 00846  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00847  2016   NtDeviceIoControlFile  (68, 80, 0x0, 0x77e466a0, 0x228144,  (68, 80, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0L\0\0\0\0\0\0\0\\0\0\0\0\0\0\0@\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00848  2016   NtWaitForMultipleObjects  (2, (72, 80, ), 1, 1, {1294967296, -1}, ...
 00843   896   NtSetEventBoostPriority  ... ) == 0x0
 00849   896   NtTestAlert  (... ) == 0x0
 00850   896   NtContinue  (1244464, 1, ...
 00851   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x3142a000,}, 4, ... ) == 0x0
 00852   896   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 104, ) }, ... 104, ) == 0x0
 00853   896   NtQueryValueKey  (104,  (104, "PINF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00848  2016   NtWaitForMultipleObjects  ... ) == 0x0
 00854  2016   NtDeviceIoControlFile  (68, 84, 0x0, 0x77e46680, 0x228144,  (68, 84, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0L\0\0\0\0\0\0\0\\0\0\0\0\0\0\0@\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00855  2016   NtWaitForMultipleObjects  (2, (72, 84, ), 1, 1, {1294967296, -1}, ...
 00856   896   NtClose  (104, ... ) == 0x0
 00857   896   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00858   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1234112,  (0x80100080, {24, 0, 0x40, 0, 1234112, "\??\u:\work\packed.exe"}, 0x0, 1, 1, 1, 96, 0, 0, ... 104, {status=0x0, info=1}, ) }, 0x0, 1, 1, 1, 96, 0, 0, ... 104, {status=0x0, info=1}, ) == 0x0
 00859   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp"}, 1233816, ... ) }, 1233816, ... ) == 0x0
 00860   896   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\0\0\0\0\220\207\0\0\2\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\220\207\0\0\3\0\0\0" )  ... {20, 48, reply, 0, 1252, 896, 81840, 0}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\0\0\0\0\220\207\0\0\2\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\220\207\0\0\3\0\0\0" )  ) == 0x0
 00861   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233824,  (0x80100080, {24, 0, 0x40, 0, 1233824, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.tmp"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 00862   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00863   896   NtClose  (-2147482756, ... ) == 0x0
 00864   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00865   896   NtClose  (-2147482756, ... ) == 0x0
 00866   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00867   896   NtClose  (-2147482756, ... ) == 0x0
 00861   896   NtCreateFile  ... 108, {status=0x0, info=2}, ) == 0x0
 00868   896   NtClose  (108, ... ) == 0x0
 00869   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234112,  (0xc0100080, {24, 0, 0x40, 0, 1234112, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.tmp"}, 0x0, 128, 1, 5, 96, 0, 0, ... }, 0x0, 128, 1, 5, 96, 0, 0, ...
 00870   896   NtClose  (-2147482756, ... ) == 0x0
 00871   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00872   896   NtClose  (-2147482756, ... ) == 0x0
 00873   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00874   896   NtClose  (-2147482756, ... ) == 0x0
 00875   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00876   896   NtClose  (-2147482756, ... ) == 0x0
 00869   896   NtCreateFile  ... 108, {status=0x0, info=3}, ) == 0x0
 00877   896   NtSetInformationFile  (104, 1234204, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00878   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\31\304J\0V\236\32\0P\236\25\0\253a\32\0\354\236\32\0T\236\32\0\24\236\0\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\234\32\0\356\216\32\16K*\23\315u&\33L\231\277\212\220\0\366sst\356ho3\354{mt\363os \276xet\354ont\353td1\354:W=\360)2Y\224>7T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0T\236\32\0", ) , ) == 0x0
 00879   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "MZP\0\2\0\0\0\4\0\17\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\32\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 10240, 0x0, 0, ... , 10240, 0x0, 0, ...
 00880   896   NtContinue  (-135750188, 0, ...
 00879   896   NtWriteFile  ... {status=0x0, info=10240}, ) == 0x0
 00881   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\1\226,\34;\242WE;\354c,\364\363{\10d\235\233\7\234V|\3316^[\304\234\335\322\376K\271P\205f\377r\B}\3211\24D\176\322\270\334\317e\3002\25J\1\4\10qg5\234Z\315(\241\33\2\352\3327\32\327\\37R\241\253K\21\336G)et.\260K*\366Y,\274<\310\305W\247\362\353\12\311\306\200S\31\232\302\203\225mCx\2178\301E\236\20^\11\342\248\31\17\3031\11\205\14\31\304\16\302\225\357,J\12\370\211\221Q\33\226~\203\304\232\22#\230L6\210dXa\22\25\220\373\311\254\3302I\260\250\1\37PQ\352f\204b\2563R]\373\15e\34\3424\212\362X\266\4\372\352Xj\250\310 \220\254]W\234\32\322\257\30\260kP\275\332\32(UB\232\24\327\2440\12$\233\37\34?5\314\12\274\316\310\370\361\343Ou\224\25G\304\237\307\214\357\330]\262\306\370.\256F\4\220\373\224lVI\1\3126-\225rJ2\217\347-\337\223\242\244=\250\365\236\244m;\246\231x\14\363*\213\340\25PXy\272\35\220+V:^M}1\227@a\345\12x\346&\231u\206~\360\200\17b]i\260\271\261\200\373\375\354UE\26p^@\351P3\375\322\266J\3349\350-v\215=(\376&\260\306\25\11\211C*\2V\376Z\3\306\326\262\211\26\306!2p\305\375\324\200\315\271\17\320\217\250\1\270\201\253\220\326\322\324SZ@\27417\375$_\225\1a\322R\234[\370n\307\17", ) , ) == 0x0
 00882   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "U\106\34o\301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00883   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\203\\21X\354\214\17we\224\26H\207\323\331\30\36\10V\340\1;\250HT5\210\345\344\33\255}L\332Z\221\261\16\177Z0\302BYZ\305\200\0\6\325yT\4\372#dO\374\1660\376\213\345\304\373p!8\366K\226\27\10h\14 \3566\35\235\376\321z(\253b@~\37\202CD\342\0\301+\33\216\235\317\376}\20\372\356\241\363m5L%F\26\269\177\32\12\274S\25\2349\316\337\226\14\334\361Z\323\253i0\276|\24]\10nNn9\242\330\2413\376\327\317\256\314BM\4\255\362_]\343\232\4\247\330\5\306\342\334\16\270\372r\16\5X\320\37>P\11PVd\350\270\310\276\30'\366Q\225\232K\24\306\331\13\306\31O?_\356\331k\373\263\361\221\350z\322\257`V\33\367U\260\342\27\260\330{l'\31t\31\260\35IT&\353\177\1z\235\222\4;k+\322\336\316\14DD\234-\304\321\340\221wo\257\323\212\34\335^\10\250aX\267\13\236\22\215!\221\221|\\231+\300\336\220!J\250\353\255~\365\305\224\^l\6\16\242]\305\237\35\353\370o\175\353\371C\336>\16U\247\342~\211;}\5yZ!\200l\271\25MP\305\341\302&z\237\257;)\245\202 1\223\321]\377\21\212\23\240\201\244\314\364\356\265a\305\177\217\24Bc\300\24D\12\321\305Io8\342\4\13B\206\225\36Y\247\356\355Y`B\32\324y\3059\237b\255\0\33\217\2\33!r\367\355b\234\253 \303u\322?\324{\305:\342^\367\355Nu\370\35\336\362\0\2218\206X\305\306a\330\11\254yQu\244\21\271:\337\241\251\4\324\241\37\266\11=\35\203\205\321\33\267[l\345\255\376)P\20.\231\344\261&\225m\15[!\323\3\36B\260\5hY\345\321\332D\345B\261\20#\1", ) , ) == 0x0
 00884   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\327\302\13X\270\22\25w1\12\14H\323M\303\30J\226L\340U\245\262H\0\253\222\345\260\205\267}\30D@\221\345\220eZd\XY\16[\232\0RKcTPd9d\33b\246d`\221\345\220ej!lhQ\226C\226r\14tp,\35\311`\313z|5x@*\201\230C\20|\32\301\177\205\224\235\233`g\20\256p\273\3639\253V%\22\210\149+\204\20\274\7\213\2069\232A\214\14\210o@\323\377\367*\276(\212G\10:\320t9\366F\2733\252I\325\256\230\334W\4\371lE]\267\4F4\363F\37\306\266B\24\270\256\354\24\5\14N\5>\4\227JV0v\242\310\352\206=\366\5\13\200K@X\303\13\222\207U?\13p\303k\257-\353\221\274\344\310\2574\310\1\367\1.\370\27\344Fals\207n\31\344\203STrue\1.\3\210\4o\3651\322\212P\26D\20\27\304\205~\213w;1\311\212HCD\10\374\377B\267_\0\10\215u\17\213|\10\71\300\212\16;J\374u\267~\241[\216\\12\362\34\16\366\303\337\237Iu\342o[\253\361\371\27@$\16\19\370~\335\245g\5-\304;\2008'\17M\4[\373\302r\344\205\257o\267\277\202t\257\211\321\11a\13\212G\212*\201\360R\356\356\341\377\337\177\333\212Xc\224\212^\12\205[Sol|\36\13\26\30\217\36\159\364\355\15\376X\32\200\347\3379\313\374\267\0O\21\30\33u\354\355\3556\2\261 \227\353\310?\200\345\337:\266\300\355\355\32\353\342\35\212l\32\221l\30B\305\222\377\302\11\370\347Ku\360\217\243:\213?\263\4\200?\5\266]\243\7\203\321O\1\267\17\362\377\255\252\267J\20z\7\376\261r\13w\15\17\277\311\3J\334\252\5<\307\377\321\216\332\377B\345\2169\1", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00885   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\302u\347\265\324I\266f\7\27\237\6B\36\220\265#X\237\227+\220m\212!\256\22\1\222\177\211]>C\6\347Y{\35d"\6\210\340\345\205\240\336\23\217>^\236\256\2743\260]\263%\264\3320M\307\2014UY\30\316\320\361\1\226H"\23\36\3345\334\22_\13\34\34\261\200\372\24\26&}\36+\254iz\361\12I\225m\266\242\30\347\13\33\24O\373C\317_va\370\333id\37\3761\223\302l\214q\3466\2^\336\230\32\320\225\342B\363\210\232{a(\12\31\232\0j\353S\272\316\350g\36\214t\327\334=!<\307Z{\307\234\227\5@x\331\377y\263\366N2?\215\36029:\364A\30\272\266\200\224\356\364\204T\12\240v\316\252\326yG\35C\250\323u\0o\316&/x\2779\207D\351&8O\354\322\310h\246&8}\277<\205\363yU\210SE!w\17\220\216\341U\222\272\346\225\3\32\233\\344\34\243O\2344,\221YL\272\376\257\14z\242\\12\360\5\23\210`\327\210\16\310\260\302\210\246\364-UX\244u\6\30\10>\261a\234-\12\35gWN\17\303\24\1\0\323r\2\1\226\356\303\22\366\220\331^k\237\350\204\17\311\271\1`\356\15\341h\36\322)h_\376#\310\302\353~\2176\332V\330\346\26\212\343):h\343\21`\300\207P\33Z\4rO\305\332G\25\\2728\16U\202[\3404\11x\364\27\24\10\20\240\304\274\266R\227u\21\254n\266\0L~\36Uz\2273*]\232\275\26\\316v\253\350j\11\4\237\26=\247\26\2300H\274\6\3519\215\320\257j\241\230\352\354\272\365H\321\207\336\342\234\226\234.\0\7\351d\350+\356q\330\370\216\5\322\254\313G8", ) \6\210\340\345\205\240\336\23\217>^\236\256\2743\260]\263%\264\3320M\307\2014UY\30\316\320271\335\11.t\\304\36\310\311\32\214\244\177@\353t7\305I\364\1\314>\361\1\226H (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\302u\347\265\324I\266f\7\27\237\6B\36\220\265#X\237\227+\220m\212!\256\22\1\222\177\211]>C\6\347Y{\35d"\6\210\340\345\205\240\336\23\217>^\236\256\2743\260]\263%\264\3320M\307\2014UY\30\316\320\361\1\226H"\23\36\3345\334\22_\13\34\34\261\200\372\24\26&}\36+\254iz\361\12I\225m\266\242\30\347\13\33\24O\373C\317_va\370\333id\37\3761\223\302l\214q\3466\2^\336\230\32\320\225\342B\363\210\232{a(\12\31\232\0j\353S\272\316\350g\36\214t\327\334=!<\307Z{\307\234\227\5@x\331\377y\263\366N2?\215\36029:\364A\30\272\266\200\224\356\364\204T\12\240v\316\252\326yG\35C\250\323u\0o\316&/x\2779\207D\351&8O\354\322\310h\246&8}\277<\205\363yU\210SE!w\17\220\216\341U\222\272\346\225\3\32\233\\344\34\243O\2344,\221YL\272\376\257\14z\242\\12\360\5\23\210`\327\210\16\310\260\302\210\246\364-UX\244u\6\30\10>\261a\234-\12\35gWN\17\303\24\1\0\323r\2\1\226\356\303\22\366\220\331^k\237\350\204\17\311\271\1`\356\15\341h\36\322)h_\376#\310\302\353~\2176\332V\330\346\26\212\343):h\343\21`\300\207P\33Z\4rO\305\332G\25\\2728\16U\202[\3404\11x\364\27\24\10\20\240\304\274\266R\227u\21\254n\266\0L~\36Uz\2273*]\232\275\26\\316v\253\350j\11\4\237\26=\247\26\2300H\274\6\3519\215\320\257j\241\230\352\354\272\365H\321\207\336\342\234\226\234.\0\7\351d\350+\356q\330\370\216\5\322\254\313G8", ) , ) == 0x0
 00886   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240 (108, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00887   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "K\361\330#u\216\332\11\354\262\310\3450\221\263y2\\233\307\24\374\1\341J\274\230|U\226\230.\14\210\17&w5\362{\25,\331\270Z\222\242%\25"\313\273\335\306"\322a\350?_ \201M\307Z\225\30Cq\266\2008\277\237\365\305\366\275t\5\344WlY\270\363\27Pz\303\366\271#\322b\353i/\240\370D\352\23F\210\206t\303\8=\25\210\200\22D+\6\367\2427\276\257\347\224\336\243\14g\337\317\222(\237\244v\334\277\2350\340Pj\302MWSq\3\315!\370\347\301\16\237!\327\276;\21\36o>0\363\302C\0\350.J\0]\222=T\224\360\4\344\244:mn\367\241\3032Wr*b\207\317\241\244\212\30a.\261\366fF~$\312\367\27Xc\=h\330\255\301\265O\36\3660cW\356\246M\225\2225\3769,\31b\260k\265\\210\12\214\276\211\223\342xS\307q<6\252$\20+S\4T\213\222\367^\300J\345l\5v\362F\356_\344\4&\3F\316\22\21\254\321\376\223\24\202\36\236\35>\332.=R\3769F\217\23\274H\372!\226\2\22 \361 <\374\215\213\330\237\33X\354\34\277IX\307\375\362F~y\2\206\16\376iX\360\372\14\246\233\37\333U\204\372\262[\31\207\330^\26!tf`\244j^\7\372\340\62!\205\351\351\274\21\350\277\252\177\344W\214\30X\10I|\2<[\357\324/RiG\204\15\217\3LA\370=\243\14\311fF\210\215BR3\343_\324R\7", ) \313\273\335\306202\23j\30C&\253\263\223\224\223\34\235\214g\314\22$\21 \\310\201\301\3026\300\2339\223\374{\330\236\364Y\216\364\6\334\210\266\35\361!K\267\210V\232\335]T ;\264\262v\13xn\370\5a\344Vz\315\240\203\346\252\1\140\262\376\236O\315*\11 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "K\361\330#u\216\332\11\354\262\310\3450\221\263y2\\233\307\24\374\1\341J\274\230|U\226\230.\14\210\17&w5\362{\25,\331\270Z\222\242%\25"\313\273\335\306"\322a\350?_ \201M\307Z\225\30Cq\266\2008\277\237\365\305\366\275t\5\344WlY\270\363\27Pz\303\366\271#\322b\353i/\240\370D\352\23F\210\206t\303\8=\25\210\200\22D+\6\367\2427\276\257\347\224\336\243\14g\337\317\222(\237\244v\334\277\2350\340Pj\302MWSq\3\315!\370\347\301\16\237!\327\276;\21\36o>0\363\302C\0\350.J\0]\222=T\224\360\4\344\244:mn\367\241\3032Wr*b\207\317\241\244\212\30a.\261\366fF~$\312\367\27Xc\=h\330\255\301\265O\36\3660cW\356\246M\225\2225\3769,\31b\260k\265\\210\12\214\276\211\223\342xS\307q<6\252$\20+S\4T\213\222\367^\300J\345l\5v\362F\356_\344\4&\3F\316\22\21\254\321\376\223\24\202\36\236\35>\332.=R\3769F\217\23\274H\372!\226\2\22 \361 <\374\215\213\330\237\33X\354\34\277IX\307\375\362F~y\2\206\16\376iX\360\372\14\246\233\37\333U\204\372\262[\31\207\330^\26!tf`\244j^\7\372\340\62!\205\351\351\274\21\350\277\252\177\344W\214\30X\10I|\2<[\357\324/RiG\204\15\217\3LA\370=\243\14\311fF\210\215BR3\343_\324R\7", ) , ) == 0x0
 00888   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\37o\302#!\20\300\11\270,\322\345d\17\251yf\302\201\307@b\33\341\36"\202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00889   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "f\0J\20\223\276Z\12\346\326&\350\212\225L\34\\263?\14`L\33\324\237\271\356\377\324\303\243Av\20\201\275\213\326\21\250\213\270\350+\223\300H HU\344\342\26+\312R\310\200\221\373\304\361\361\22\17\211\24\3322a\14-P\371\247K\273\245\361J?\41U \306-Wb\276}\22W\272?\21\247\252;%\373\12\232\341\21NGN\316\21\177\377\260\271c\336F\354\224\252\321\217n%bV{\267\266\331\234\312\272\374\352\330\36\230v\25W\265Jj\322\336\367u\12)\200[AZ>\1\321\7\323\325\3168\243tWk\320\21y\320u\11\3478s\237\214zV\223m\362\177\206\35\366\1\3\233\236J\137\216:kE\200\204\212\362\276\362\13/\301\0\3\36\303\233x@Z@\357z\246d\23\1\270\273'\30(q'#\372N\317\6\230\12S\10\372Qc\337\203\343Jl\265v\260\203\17\0\304_\220\310 \1\253v\24[\201\264\32@\340\302;\7\272\262\345\222?\270]Q\11Y\30\332Z\367\200\241\322\266#\204\278\306\27\231\237\373\237\255\363\1\205Z0eT\337\236\12\2:q\337*a\11\211PXZ,T\235?@9\252\30\324\307\262|\210\311\366~\242POa~t~\13\360+\242\375:\166`\237\242\333n\371XEW\21O\204\326-`Nd\4;u6\215\20e\34\205\206\343\30\300\177\232\11\353\237\310\270j\1\203\4\14 \220\36\217\355\3237\27D\265\330\263a\351m\4*\230\302\344\234\265\320\15b\3746>\337\221G\20 \203\256\205\304\337\240\0\215&\2323\15q\330\342\252\311[\36`\33w\200\217\245stMn\26PI\254\23'\232\246\323;d\36F\310T**\366u>i0\347\221\222\4\350\263\226\204c\315"\27\335\316"\221\3254\213&\346\235\16\275", ) \27\335\316 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "f\0J\20\223\276Z\12\346\326&\350\212\225L\34\\263?\14`L\33\324\237\271\356\377\324\303\243Av\20\201\275\213\326\21\250\213\270\350+\223\300H HU\344\342\26+\312R\310\200\221\373\304\361\361\22\17\211\24\3322a\14-P\371\247K\273\245\361J?\41U \306-Wb\276}\22W\272?\21\247\252;%\373\12\232\341\21NGN\316\21\177\377\260\271c\336F\354\224\252\321\217n%bV{\267\266\331\234\312\272\374\352\330\36\230v\25W\265Jj\322\336\367u\12)\200[AZ>\1\321\7\323\325\3168\243tWk\320\21y\320u\11\3478s\237\214zV\223m\362\177\206\35\366\1\3\233\236J\137\216:kE\200\204\212\362\276\362\13/\301\0\3\36\303\233x@Z@\357z\246d\23\1\270\273'\30(q'#\372N\317\6\230\12S\10\372Qc\337\203\343Jl\265v\260\203\17\0\304_\220\310 \1\253v\24[\201\264\32@\340\302;\7\272\262\345\222?\270]Q\11Y\30\332Z\367\200\241\322\266#\204\278\306\27\231\237\373\237\255\363\1\205Z0eT\337\236\12\2:q\337*a\11\211PXZ,T\235?@9\252\30\324\307\262|\210\311\366~\242POa~t~\13\360+\242\375:\166`\237\242\333n\371XEW\21O\204\326-`Nd\4;u6\215\20e\34\205\206\343\30\300\177\232\11\353\237\310\270j\1\203\4\14 \220\36\217\355\3237\27D\265\330\263a\351m\4*\230\302\344\234\265\320\15b\3746>\337\221G\20 \203\256\205\304\337\240\0\215&\2323\15q\330\342\252\311[\36`\33w\200\217\245stMn\26PI\254\23'\232\246\323;d\36F\310T**\366u>i0\347\221\222\4\350\263\226\204c\315"\27\335\316"\221\3254\213&\346\235\16\275", ) , ) == 0x0
 00890   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211 (108, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00891   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "Vm\302H!4\260\277\234\3378\210\211\35\227\327\7\301\252\337C^\322dF\3072`\2\233\256aO\214\247\377BN\371'\354\304#\212\30\237\345\200\275\224\224\375\216\304\242\4W\1P\215r\372.?Sk\227I\24\324o\336\13\354\261\14\210\361\30\25$\222\350L\267\227`\4\223\340\273\4\376=\350dU\273m\2wb\3302v\334\241\31\22{T5\246\335\324W\\214nh\336}\222Nn\373s\325\371fI=n\25%\355\214\274\300\370\240(#\325H(\314Y!O\7;x\274\211\335\334~b\0\2444H*Y\315\356-\306\275\250\215)f\277v>\37\3000 ]\222\0.\227\26\254\267\31\344 t<\13\3\266C\304\201N\177i\36\276\0\325\223U=\31} \352t\243\32\250>]8\340H\16\200i\242"K\303R\354\|Xn_,\33\12\276W\24Ic\250\331\3V\26\323\26\244\200\2426\10N#0(j,\213\350\245\205\220\336\207I\32\20\323\347\372\360j\211\307\333\214\10DF\3239<\324\315\16CU$\212j\304\371\211&\335M["*\215\357C\\376\26tO\263\345\257P\34u\272F\37Y\4\336\316]\351\35\260\331\35\277\357\25\270\254\31&\344\304f\342CPf\322\0&\273\342\3701^\371M\254\354\243kp\233\237\344r\16\251<#\222\220\343\242&\336\2244\336\333p\217\25\333 (\336\336\30\260\270\3137p\247\261\362L\5\220S\23\31\24\16T:\26\353ml\17HQ-\30(\\35H\362Q\234=\350H\24ER\25.\243h \350\322\246\326_\222m\304'r\214\222\264[\24\34M\211T\244[\3620?\234\32\311GW=\357V\266\25aR\216\247oT\321Ba\5OxHD\271\261\360d\12~\24h\236\`\227\266R`s\206+\30", ) K\303R\354\|Xn_,\33\12\276W\24Ic\250\331\3V\26\323\26\244\200\2426\10N#0(j,\213\350\245\205\220\336\207I\32\20\323\347\372\360j\211\307\333\214\10DF\3239<\324\315\16CU$\212j\304\371\211&\335M[ (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "Vm\302H!4\260\277\234\3378\210\211\35\227\327\7\301\252\337C^\322dF\3072`\2\233\256aO\214\247\377BN\371'\354\304#\212\30\237\345\200\275\224\224\375\216\304\242\4W\1P\215r\372.?Sk\227I\24\324o\336\13\354\261\14\210\361\30\25$\222\350L\267\227`\4\223\340\273\4\376=\350dU\273m\2wb\3302v\334\241\31\22{T5\246\335\324W\\214nh\336}\222Nn\373s\325\371fI=n\25%\355\214\274\300\370\240(#\325H(\314Y!O\7;x\274\211\335\334~b\0\2444H*Y\315\356-\306\275\250\215)f\277v>\37\3000 ]\222\0.\227\26\254\267\31\344 t<\13\3\266C\304\201N\177i\36\276\0\325\223U=\31} \352t\243\32\250>]8\340H\16\200i\242"K\303R\354\|Xn_,\33\12\276W\24Ic\250\331\3V\26\323\26\244\200\2426\10N#0(j,\213\350\245\205\220\336\207I\32\20\323\347\372\360j\211\307\333\214\10DF\3239<\324\315\16CU$\212j\304\371\211&\335M["*\215\357C\\376\26tO\263\345\257P\34u\272F\37Y\4\336\316]\351\35\260\331\35\277\357\25\270\254\31&\344\304f\342CPf\322\0&\273\342\3701^\371M\254\354\243kp\233\237\344r\16\251<#\222\220\343\242&\336\2244\336\333p\217\25\333 (\336\336\30\260\270\3137p\247\261\362L\5\220S\23\31\24\16T:\26\353ml\17HQ-\30(\\35H\362Q\234=\350H\24ER\25.\243h \350\322\246\326_\222m\304'r\214\222\264[\24\34M\211T\244[\3620?\234\32\311GW=\357V\266\25aR\216\247oT\321Ba\5OxHD\271\261\360d\12~\24h\236\`\227\266R`s\206+\30", ) , ) == 0x0
 00892   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022 (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \332\370\364\2669\325\34\266\326Yu\321\35;, (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00893   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ",\3764\230\37\320u\374Cl5{\37\215RS$\362st\22\373,u\301W\4=\316\343b+\307\235S\5\322Ma|\375\36\205\324\33\37\323\340\271\30\366D\323\32\227P\231. 5%\326\327\17\226-\260\17i\201\0c\3741zW\215)\25\346\272-\12\317\323\252\17W\2619\340T\311\221\326\35\212&\0<\341RS\35\332\33\340Y\346\303\220\326|\367\353D\277\321I\356fB\305U|y\262g\226\203\260f\342Y\214@\D}\331\315\33\271U\335[\202\336\2158|!\236!\200M\34T`\216\213\222\267W~\22*Q?\23\12l\233#\327\376\256\230\216"\361\25\271y\373%\242\366*'\215B\27\263(D"\7 \307\237\216<\341\237\336u\253\36\16\6A\243\232XDy#\242\1\240\30\201H\236}\307v>\35\25\266\2202h\235-\266\221[\317\21\5\224\215`r;\205\270\362\240\245b\4xa\31\24o\310\22I\0\215\220|\237\231\6\325\370\374\257\252PJ\226\325Q\204n\364\304\261\262\11+e\342\207>\227K-L\24\222;\374\235\215\200\300\307\230'\20\361\312\4\331\323\342\346\324\376\333\11\274\277\22\313w\221\261\252C\345\216q\314\2258XP\327\25\244\367\36\24\10a\204_\22v\251\254\24\0-y\33)w\16q\230&\30\0\310\216\25\377\230\216\247\2j\323RuY\313\237"\242cC8\277\243\244\16\220\242\251 TZ\361&\374\17\5*<\213\357\205P\16\32|\21\3510\12>\234\255\252\3433\270G\210`oG\223\304\33\3V\374~\236xU\250lQ\222\26\20D\212\250,\237,\16\30L\276:\313\346\262\321$p\2662,x\212\201\06I\353\202\4\337\226\355\0\236\261S[k\222f\5!Q\242w\304\30\213\205\235\360\11\200=\277v4r\26\3", ) \361\25\271y\373%\242\366*'\215B\27\263(D (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ",\3764\230\37\320u\374Cl5{\37\215RS$\362st\22\373,u\301W\4=\316\343b+\307\235S\5\322Ma|\375\36\205\324\33\37\323\340\271\30\366D\323\32\227P\231. 5%\326\327\17\226-\260\17i\201\0c\3741zW\215)\25\346\272-\12\317\323\252\17W\2619\340T\311\221\326\35\212&\0<\341RS\35\332\33\340Y\346\303\220\326|\367\353D\277\321I\356fB\305U|y\262g\226\203\260f\342Y\214@\D}\331\315\33\271U\335[\202\336\2158|!\236!\200M\34T`\216\213\222\267W~\22*Q?\23\12l\233#\327\376\256\230\216"\361\25\271y\373%\242\366*'\215B\27\263(D"\7 \307\237\216<\341\237\336u\253\36\16\6A\243\232XDy#\242\1\240\30\201H\236}\307v>\35\25\266\2202h\235-\266\221[\317\21\5\224\215`r;\205\270\362\240\245b\4xa\31\24o\310\22I\0\215\220|\237\231\6\325\370\374\257\252PJ\226\325Q\204n\364\304\261\262\11+e\342\207>\227K-L\24\222;\374\235\215\200\300\307\230'\20\361\312\4\331\323\342\346\324\376\333\11\274\277\22\313w\221\261\252C\345\216q\314\2258XP\327\25\244\367\36\24\10a\204_\22v\251\254\24\0-y\33)w\16q\230&\30\0\310\216\25\377\230\216\247\2j\323RuY\313\237"\242cC8\277\243\244\16\220\242\251 TZ\361&\374\17\5*<\213\357\205P\16\32|\21\3510\12>\234\255\252\3433\270G\210`oG\223\304\33\3V\374~\236xU\250lQ\222\26\20D\212\250,\237,\16\30L\276:\313\346\262\321$p\2662,x\212\201\06I\353\202\4\337\226\355\0\236\261S[k\222f\5!Q\242w\304\30\213\205\235\360\11\200=\277v4r\26\3", ) \242cC8\277\243\244\16\220\242\251 TZ\361&\374\17\5*<\213\357\205P\16\32|\21\3510\12>\234\255\252\3433\270G\210`oG\223\304\33\3V\374~\236xU\250lQ\222\26\20D\212\250,\237,\16\30L\276:\313\346\262\321$p\2662,x\212\201\06I\353\202\4\337\226\355\0\236\261S[k\222f\5!Q\242w\304\30\213\205\235\360\11\200=\277v4r\26\3", ) == 0x0
 00894   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) |u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307 (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) X\4I\17\244\243\200\16\105\32E\22 (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00895   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "Ay\325o\321\274\131\217u\32\314H\312\11\32;\350{'\207\263\276PH6\352\354{\344N\36\233\306C>!@\10\234\266\227v\1P!V \342\312\26\360e\231\340\17\36\322\260~t\205\201l\15\346\363P\37\202\24\212\213TS\25\250\2 P\5\355\315\16E\237\30\216\333\327\17\4\367\275b\203A\236\275\322\310\266\310w\375\21|H\30\258\232\231\12\213\21n\232\0x\0q6D\343\316H*[\7 \1n\300\25\305\254\240d/\336\4\3252L\356Y\\234\212CZ\247\31\4Q\325\260`&\255\332\3032r\1\311\201\363\252h\360\222\17<\306\313\304\222\266\216\2I\217Pl\11\324_0\3369<\277_\344\206:\206X\326^\3\334W\21\211\2\247\314\23\27\344H1\304\27W\354\237\346\366\205\204\15\222\\202\204]`\20q\331O\14H\350\300\256\366E:E:\1S\340a\321\30\237tz\354\257\376\27%\374^K#K\222LM\232*\37\240\276:\200\250\234\315\25\34_\370\262\206\334N\27Z\216\16h\1\267Z\0\237\250\357$B0\221\1\206n\356z\225\205\21\200\23\232\2779F\226\372%yn\376\200 \217\276\344\203\202>15\231\364\223\354\273\322\34400{M\237KEF\314\227H\5\262\343\332\214\225!\203\1\235a.\23}m\24\302\226\2`\213\371\317#]\346\220\206\223A\31348I\302\22\253MP\333\14\235\21\372|\333\340\232\365\201\265\300u\350\250\3\\225\22$z\322b\24#\204\3\177\222\306\26\11\227s\355\336\3626\236\\214\332\2655\5\262\201\220\246\213\25\320\260\310\251\356(\324?\320\265\6E)\217XP\271\330mu\241\231!\271\352\234X\242]4\232\200\350\312\365\2U\366\15\13}\304\353=\254C\250\375\336\317\234\246\323\13\202\14", ) , ) == 0x0
 00896   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\25\347\317o\205"\211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00897   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "U?\345N\360K\22\22\13\203~\262\210\321q\177\337\3\367\334\251\374\366\23\230:\333\320\250C:\362C\205*\276)\31q\3246\13\377\230\232\1\315\336\244&s\237\30\20\4\360{\315\220\355U6\334\31\22\370\277\230 \7\357kJ\2019\235\373\367n\234\201\315\0\357o\32=,\210\254\6\304\6\254\25\31\315/\300\262jx\325C\15\367\6\2034\14\346\332\256\254\30\230)\204\345\364S\23\234PA\251\2126<\330\272\26Y\20\242\246\353E$\33\325\300, ) , ) == 0x0
 00898   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27 (108, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00899   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ">\232\350\30*p\231\332\25>\316|\334\221\251\237\232\374\177\204\274~\331{\337\222_\332>\6\3210\322O#\35E\11\372DG\21\326]\324I~D|\11d"\364\345o\15&\237d\34\2\0S\217\3623\342\226A\263\235f\11R\336\353$\204\203\14D\227\21\25\230\233\2568K_~\333\32Fe\360Z\234N\5\227\235\370yI\31\11\376\327i\267\376SN\23K\270Y\271\222\36@Q\244\210y\275\305\342\230\233\335z \234\30\354\2367\v\226\341\31\34\212\343ie\2333@\257A\244\235\24\30\216\352\16.\262z\26\242\1\226\37\341W^\220E\343*\227\335\20\u\3110V\246\233m\340\213\374\216zl\213\217\323\263\30~Q\25\37\340\342\302\213\311\270\10\253\30\37\210\216\13\250j\232\3FC1\336 M3\221\302\312\37Dvf+!\324\37\1\234EKR\26;\232\241\235\325\220\213\35\215\372\222K\302\342\366\250,\217\23E\305n\6\330\257\14h\263\210\375\355\31\31\307O\211\250i0*\2524;\3\251\2\333L@\377\371|[\232\36\373\304V\25\267\235\214\222!\340|)\5\266L\34\32\177\264\5bK\202A\30]\313G\364\335\356g\254\336\33g\102\37\320\265\226\305\232\16\222\323\16\243\366\266,\25\274\343Gdp\374P\365\244\3302D/(\207\353c\31\3158l\27b\344\260Tly)\272"\364\320\333H\24\340\211\240\222t\36\261\4\234\374Y`\245J\344\0\12\224^\211\266\16/\375P\270t3+Na\14v\237\356\256B1\23s\\265\355a\227\314\2478C\245\324\302\245\207\31\307\245\312\16\217\24\262\33sX\230\272\350u\37\331f\314BF\276\251\227n\142a\323\4\277\216\223P_\237\34\3\4\264[=\5\221ZS\34\277\235\214\347\15\242DU\271;\353", ) \364\345o\15&\237d\34\2\0S\217\3623\342\226A\263\235f\11R\336\353$\204\203\14D\227\21\25\230\233\2568K_~\333\32Fe\360Z\234N\5\227\235\370yI\31\11\376\327i\267\376SN\23K\270Y\271\222\36@Q\244\210y\275\305\342\230\233\335z \234\30\354\2367\v\226\341\31\34\212\343ie\2333@\257A\244\235\24\30\216\352\16.\262z\26\242\1\226\37\341W^\220E\343*\227\335\20\u\3110V\246\233m\340\213\374\216zl\213\217\323\263\30~Q\25\37\340\342\302\213\311\270\10\253\30\37\210\216\13\250j\232\3FC1\336 M3\221\302\312\37Dvf+!\324\37\1\234EKR\26;\232\241\235\325\220\213\35\215\372\222K\302\342\366\250,\217\23E\305n\6\330\257\14h\263\210\375\355\31\31\307O\211\250i0*\2524;\3\251\2\333L@\377\371|[\232\36\373\304V\25\267\235\214\222!\340|)\5\266L\34\32\177\264\5bK\202A\30]\313G\364\335\356g\254\336\33g\102\37\320\265\226\305\232\16\222\323\16\243\366\266,\25\274\343Gdp\374P\365\244\3302D/(\207\353c\31\3158l\27b\344\260Tly)\272 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ">\232\350\30*p\231\332\25>\316|\334\221\251\237\232\374\177\204\274~\331{\337\222_\332>\6\3210\322O#\35E\11\372DG\21\326]\324I~D|\11d"\364\345o\15&\237d\34\2\0S\217\3623\342\226A\263\235f\11R\336\353$\204\203\14D\227\21\25\230\233\2568K_~\333\32Fe\360Z\234N\5\227\235\370yI\31\11\376\327i\267\376SN\23K\270Y\271\222\36@Q\244\210y\275\305\342\230\233\335z \234\30\354\2367\v\226\341\31\34\212\343ie\2333@\257A\244\235\24\30\216\352\16.\262z\26\242\1\226\37\341W^\220E\343*\227\335\20\u\3110V\246\233m\340\213\374\216zl\213\217\323\263\30~Q\25\37\340\342\302\213\311\270\10\253\30\37\210\216\13\250j\232\3FC1\336 M3\221\302\312\37Dvf+!\324\37\1\234EKR\26;\232\241\235\325\220\213\35\215\372\222K\302\342\366\250,\217\23E\305n\6\330\257\14h\263\210\375\355\31\31\307O\211\250i0*\2524;\3\251\2\333L@\377\371|[\232\36\373\304V\25\267\235\214\222!\340|)\5\266L\34\32\177\264\5bK\202A\30]\313G\364\335\356g\254\336\33g\102\37\320\265\226\305\232\16\222\323\16\243\366\266,\25\274\343Gdp\374P\365\244\3302D/(\207\353c\31\3158l\27b\344\260Tly)\272"\364\320\333H\24\340\211\240\222t\36\261\4\234\374Y`\245J\344\0\12\224^\211\266\16/\375P\270t3+Na\14v\237\356\256B1\23s\\265\355a\227\314\2478C\245\324\302\245\207\31\307\245\312\16\217\24\262\33sX\230\272\350u\37\331f\314BF\276\251\227n\142a\323\4\277\216\223P_\237\34\3\4\264[=\5\221ZS\34\277\235\214\347\15\242DU\271;\353", ) , ) == 0x0
 00900   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D (108, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00901   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "G\271\11\223/\267F\15\256ve\3[\337\277\2409\363\332+m\272\306?\35$7\335\372nx\215\11\260\330\10\257\226o\323`Sm\367\231\2719\363\273\335\3114\31\200\0$t\315:w\242]\O\366JF\273\277S\254\306@fA\373\37\244\356\212r\36\346+*\2327u\210\254\376\271\311(\314.\374\337\0\5g\326\232\341\375K^\7\24l\214\222\344\221-\17\210\345[\277\26\271\303\253\340\222\12\222\205f\14\15B\345M\214\340q\245\256\353\354\353Ya\27\261\227zd\22\277\337\310cO\102CJ\225Q\21\264\340+}\346\200\272\212\340\225q\271R4o\353J\3\20\27u\305\300\25\4}\25\262\234l\226M>\216O.\352\226)F\375\312R\322NV<\303\2\315\1\371x\362\367O\3734\34\343\270\3267\10\342a\14\16O;?\364V\243\34uv\370\355\240\236\313\335FR\0\13\35 \177|\226Q\340\27\3\24\367\334C\352\262j\267\270w_@\217\260\250?=^\12M\322\25\30\336Q_\342\20)w\357\227\274\263\305\370\215\177\3201\34G\346\333y\25p\13\2138j\330\215\5\307\202\317\315\350\350\213\374gA \227\300\273\272f\305u\262\23a\3\253s\5\202p\5\220DA{\306\300\274\232\232\344[\370\37\360\271)\3000d\177{\353f^\260\213\260\235g\10-?\374\340\11l\230;)\222!\4\254\340\341\27.\214i'b\245\315&\273\334DR\236UxY`\373n\253y\35\22m\351\367\353K\370\335\245e\236{\13;.\255^\353\14>\31t>\353\333o>r\360Of|\301\276\364\223\7D~\342\3\334\315\30\303\25W\30\340\371\234#\310_Tg\201\17\17\16\373-\231l\367\214\35\300\12\3243*\122\225W|\254h!zP\342\5\277Z\3377!", ) , ) == 0x0
 00902   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\23'\23\223{)\\15\372\350\177\3\17A\245\240mm\300+9$\334?I\272-\335\256\360b\215].\302\10\373\10u\3234\315w\367\315'#\363\357C\3234M\36\32$ S w\366\303FO\242\324\\273\353\315\266\306\24\370[\373K:\364\212&\200\374+~\4-u\3342\344\271\235\266\326.\250AF0Q\371\314\232\265cQ^S\212v\214\306z\213-[\26\377[\353\210\243\303\377~\210\12\306\33|\14Y\334\377M\330~k\245\372u\366\353\15\377\15\261\303\344~\22\353A\322c\33\226(C\36\13K\21\340~1}\262\36\240\212\264\13k\271\6\252u\353\36\235\12\27![\332\25P\343\17\262\310\362\214Mj\20U.\276\103F\251TH\322\32\310&\303VS\33\371,l\355O\257\252\6\343\354H-\10\266\377\26\16\33\245%\364\2=\6u"f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00903   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "d\2772\336\302\222\361'B\235L\15\322`\215\254Y\202\15\213\213\245\361u\226\13\14\13~ \337\237\270\270.7^\307\332Z\17N\341\213;j1\240f\5hl\32\235P\4/\255\33\4k\365\327w\12\217\243\255\20\313B\273U\340\302\31\24.\37)\354\332~\20%},\353\302\224\221\377WP[\304"\265(\27oQ\347)B\236\243\266\311\270\16A\356\353\313(\366\33\324\213\277\36L\24F6\3164\2\264"\331\320u\26n\7\336\252F\250\205!\373!\33\316\221\375\310\265Yw\303\223\30\311\240\307\236R\267\233\306`\37\374\350\332\276\345\232Uh_\313HuK\346\37\315r\331\36$\15\234\366\24#\350\3010\215\368\243\270\26\22R\20\232!\270\265\22G\350\272\235\337\211\241\25\7TC\204dN\277\317\350s\333pm\14\210\2636\200W\350!\31#\245!c\374\344\202\333\322\27\37\24X\350!b\327#6t\2\354\237\12\223K{\234\356\233_\250\314\221\305\251\266Z\265\252\14\353\275Qm\333uk\225;\245\31Z\227\32\360U\332\12\344B\237'\334\\223\264[\353\16\272\10\17N\221\352\325\34t[\205{\32\376W\222\233\302a\5a\233Y\37\370\16\222\247^(\270\376ET\305[_\213aP\223\216v\376&\316*"\254\335>\375\341\217"\224\307;/\226\243/[\211\306\213Qal\36\3\2161\373\3/\7v\352\315\332B\361u\236q\227\220\317Z'\246\210\246\207,&\177+\351\241\325x\323\20\260\250.\235\277\235U\310\235\377\307F\242\265\34A\320\246\314m;\241\6$'\235\221\4oqi\214", ) \265(\27oQ\347)B\236\243\266\311\270\16A\356\353\313(\366\33\324\213\277\36L\24F6\3164\2\264 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "d\2772\336\302\222\361'B\235L\15\322`\215\254Y\202\15\213\213\245\361u\226\13\14\13~ \337\237\270\270.7^\307\332Z\17N\341\213;j1\240f\5hl\32\235P\4/\255\33\4k\365\327w\12\217\243\255\20\313B\273U\340\302\31\24.\37)\354\332~\20%},\353\302\224\221\377WP[\304"\265(\27oQ\347)B\236\243\266\311\270\16A\356\353\313(\366\33\324\213\277\36L\24F6\3164\2\264"\331\320u\26n\7\336\252F\250\205!\373!\33\316\221\375\310\265Yw\303\223\30\311\240\307\236R\267\233\306`\37\374\350\332\276\345\232Uh_\313HuK\346\37\315r\331\36$\15\234\366\24#\350\3010\215\368\243\270\26\22R\20\232!\270\265\22G\350\272\235\337\211\241\25\7TC\204dN\277\317\350s\333pm\14\210\2636\200W\350!\31#\245!c\374\344\202\333\322\27\37\24X\350!b\327#6t\2\354\237\12\223K{\234\356\233_\250\314\221\305\251\266Z\265\252\14\353\275Qm\333uk\225;\245\31Z\227\32\360U\332\12\344B\237'\334\\223\264[\353\16\272\10\17N\221\352\325\34t[\205{\32\376W\222\233\302a\5a\233Y\37\370\16\222\247^(\270\376ET\305[_\213aP\223\216v\376&\316*"\254\335>\375\341\217"\224\307;/\226\243/[\211\306\213Qal\36\3\2161\373\3/\7v\352\315\332B\361u\236q\227\220\317Z'\246\210\246\207,&\177+\351\241\325x\323\20\260\250.\235\277\235U\310\235\377\307F\242\265\34A\320\246\314m;\241\6$'\235\221\4oqi\214", ) \254\335>\375\341\217 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "d\2772\336\302\222\361'B\235L\15\322`\215\254Y\202\15\213\213\245\361u\226\13\14\13~ \337\237\270\270.7^\307\332Z\17N\341\213;j1\240f\5hl\32\235P\4/\255\33\4k\365\327w\12\217\243\255\20\313B\273U\340\302\31\24.\37)\354\332~\20%},\353\302\224\221\377WP[\304"\265(\27oQ\347)B\236\243\266\311\270\16A\356\353\313(\366\33\324\213\277\36L\24F6\3164\2\264"\331\320u\26n\7\336\252F\250\205!\373!\33\316\221\375\310\265Yw\303\223\30\311\240\307\236R\267\233\306`\37\374\350\332\276\345\232Uh_\313HuK\346\37\315r\331\36$\15\234\366\24#\350\3010\215\368\243\270\26\22R\20\232!\270\265\22G\350\272\235\337\211\241\25\7TC\204dN\277\317\350s\333pm\14\210\2636\200W\350!\31#\245!c\374\344\202\333\322\27\37\24X\350!b\327#6t\2\354\237\12\223K{\234\356\233_\250\314\221\305\251\266Z\265\252\14\353\275Qm\333uk\225;\245\31Z\227\32\360U\332\12\344B\237'\334\\223\264[\353\16\272\10\17N\221\352\325\34t[\205{\32\376W\222\233\302a\5a\233Y\37\370\16\222\247^(\270\376ET\305[_\213aP\223\216v\376&\316*"\254\335>\375\341\217"\224\307;/\226\243/[\211\306\213Qal\36\3\2161\373\3/\7v\352\315\332B\361u\236q\227\220\317Z'\246\210\246\207,&\177+\351\241\325x\323\20\260\250.\235\277\235U\310\235\377\307F\242\265\34A\320\246\314m;\241\6$'\235\221\4oqi\214", ) , ) == 0x0
 00904   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216 (108, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00905   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "G\263\221\274\327\244$\334\251\253W\15^\27\33\241RB\334\0Z\347f\3642U0\263\353\21M\2\203\233\217\32\223\227\336\231\316\277\22\17\320\15=\353\177\333\376\35\4\265\36\202\255\4\7\257\4wg\217\\316\130\306\207l\11\\20\216c\13\275: \353QNp\314,\324\207'\10~\177\302\342\326-\334\302\254;\320{\4\0\225\326O|\377\246\36\270\243\3357\170\312X\0t]\365Te\210\5\20\200\215\264\265\36\230\275~^\221A\25\30\377\5ti\367MP\224\210}\34\33;\261\255\306b\266DM\252b\353\6\311I\246\31\353n_\3\236\16\360L\246\244\240d\23j\30\243:I\300\24\337\337\261\216\356\27\211^\34\361.M\14Q+\350\16\262\222]\247P\320\374\307\33d0\16\262\33\310\247*5GYy\227\4\212\332\3\317\305OP\376\36\30\22\363\30\241\220,\200*\3100\351\21\230\255>\223\312\5\363BL\225T\214\320^\231\255S\371\234\352Z\%e\331t6\217\202P\237\303\233\25C)\213\236\11\205#\177\36\345\260u\245\344ru\3527\375M\234b\255y\27147\270\363w\261J\242\346\261\250\221\\2577\242\215\177\35\21M\212\244.9\340\357\216J\212\264i\330\374\31\303|\253\254)u\231\331\322\15\374R\331\30\213S_\360\3F\373\301\3329\231\21\4\36A\37\10\\222\214e\15\10=\20@\200\2\34\15\10\177YA\276>\14|\325\37\277\21\224e0\36\353\322\350\25\226|\255\351btm^\231\303[\367q\25\13\334\231\344\312\346\376^\27\253\213t\257!-\221\2052\221\315\36325\205\2\14h\3\357\312\254\332$\250\16\345\374\2460\227w\253\25g\14\177g\235\367|nW\218\177_\250W\3537\213\211\310\327\1X\204\322\1T\37D\340\343S\370\200", ) , ) == 0x0
 00906   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\23-\213\274\203:>\334\3755M\15\12\211\1\241\6\334\306\0\16y|\364f\313*\263\277\217W\2\327\5\225\32\307\11\304\231\232!\10\17\204\223'\353+E\344\35P+\4\202\371\232\35\257P\351}\217\10P\210\222\31v\11\10\216\224c_#  \277\317Tp\230\262\316\207s\226d\177\226|\314-\210\\266;\204\345\36\0\301HU|\2538\4\270\367C-\17dTB\0 \303\357T1\26\37\20\324\23\256\265J\6\247~\12\17[\25La\37t=iWP\300\26g\34O\245\253\255\222\374\254D\314x\353RWS\246Mut_W\0\24\360\308\276\2400\215p\30\367\244S\300@A\305\261\332p\15\211\12\202\353.\31\222K+\274\220\250\222\119J\320\250Y\1dd\220\250\33\234905\23\307c\227P\24\300\3\233[UP\252\200\2\22\247\206\273\220x\360\310dw\13\230\371\240\211\312QmXL\301\312\226\320\12\7\267S\255\2\360Z\10\273\177\331 \250\225\202\4\1\331\233A\3353\213\312\227\237#+\200\377\260!;\376r!t-\375\31\2x\255-'.7\354mm\261\36<\374\261\374\17F\257c<\227\177I\217W\212\360\260#\340\273\20P\212\340\367\302\374M]f\253\370\267o\231\215L\27\374\6G\2\213\7\301\352\3\22e\333\332m\7\13\4J\337\5\10\10\14\226eY\226'\20\24\36\30\34Y\226eY\25 $\14(K\5\277E\12\1770Ju\310\350A\10f\255\275\374nm\12\7\331[\243\357\17\13\210\7\376\312\262`D\27\377\25n\257u\263\213\205f\17\327\363f\253\237\2X\366\31\357\2362\300$\374\220\377\374\362\256\215w\377\213}\14+\371\207\367(\360M\21l\341E\250\3u-\213\335V\315\1\14\32\310\1\0\201^\340\267\315\342\200", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00907   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "wk\17\2052\330\346\6O\352\221\22QE\22s{E\204\242:\252 C\312\234\370\6Eq\322\340\354\364/\371d!\373#\0T/o\213\340\314\341x\235\306\3270\210\371[`\277o\304\5\)7\227\260\30\206\231\361v\312\16\220\206\254\375\254\231\362\13 \266\3WA\303\261\200C\332\227_P\320\240\24\264\2500\32\236\313\2\24\235\207\242?f\245-|\276\361\265\330\263\37\232\14\214\216\372\2024O\210\330\257\364\34\304X*\374o\265\363\215\267\327a\367h\25\343\37\5\354\304\34\15\256\307\277\32\254w\10\17\337\255DN\20\34\203\350\15o\342\226\305\36\256\36\344z\252\17~\36m\30G\35f\223\233\310y\201\26\341\363t\22\236\7\247|\36\233\21\367K\21\14/\263\301\213L\317M\341j\333\5\237\2Y\311\364k\257\261w\343\17M\3pa\27~\201[\2_g\265N\224\350\243$\301\302\221\231%\350\374\204\360r\32[\13U\324\203\3F\236\3236@fKn\3636\213\12\36\361\347\336\23-\30\316G#\27\22D\206 \237\352\2639\367!U\365\363\361\324u\370\34$\217\34\367\221\353kI<\13m\310jK\303;\234\37\346H\316Ia\33n\232n$c3\376\366g\12\1\236\314[\301\252R\263"4\217\342\273\320\377\32,\334\15\31\370!\257\350\243\11\316K\351\377\376\331\202G\372"\213\236$\2O\\206\33\346\15\306N2\3247\324\370\0,\312\262F&\310\22C\252\15(C\265\352\323\260\307\332c\2\232y\17R\255\215D\227*\21\260\374\30Bx\7\213J\376\217\237\233{\303\23\6\224\21\231\33\1)\210\207|p\262\362\0 \25(]>\202\\354Ej0\361\217\335\335k\273\350\31\", ) \0T/o\213\340\314\341x\235\306\3270\210\371[`\277o\304\5\)7\227\260\30\206\231\361v\312\16\220\206\254\375\254\231\362\13 \266\3WA\303\261\200C\332\227_P\320\240\24\264\2500\32\236\313\2\24\235\207\242?f\245-|\276\361\265\330\263\37\232\14\214\216\372\2024O\210\330\257\364\34\304X*\374o\265\363\215\267\327a\367h\25\343\37\5\354\304\34\15\256\307\277\32\254w\10\17\337\255DN\20\34\203\350\15o\342\226\305\36\256\36\344z\252\17~\36m\30G\35f\223\233\310y\201\26\341\363t\22\236\7\247|\36\233\21\367K\21\14/\263\301\213L\317M\341j\333\5\237\2Y\311\364k\257\261w\343\17M\3pa\27~\201[\2_g\265N\224\350\243$\301\302\221\231%\350\374\204\360r\32[\13U\324\203\3F\236\3236@fKn\3636\213\12\36\361\347\336\23-\30\316G#\27\22D\206 \237\352\2639\367!U\365\363\361\324u\370\34$\217\34\367\221\353kI<\13m\310jK\303;\234\37\346H\316Ia\33n\232n$c3\376\366g\12\1\236\314[\301\252R\263 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "wk\17\2052\330\346\6O\352\221\22QE\22s{E\204\242:\252 C\312\234\370\6Eq\322\340\354\364/\371d!\373#\0T/o\213\340\314\341x\235\306\3270\210\371[`\277o\304\5\)7\227\260\30\206\231\361v\312\16\220\206\254\375\254\231\362\13 \266\3WA\303\261\200C\332\227_P\320\240\24\264\2500\32\236\313\2\24\235\207\242?f\245-|\276\361\265\330\263\37\232\14\214\216\372\2024O\210\330\257\364\34\304X*\374o\265\363\215\267\327a\367h\25\343\37\5\354\304\34\15\256\307\277\32\254w\10\17\337\255DN\20\34\203\350\15o\342\226\305\36\256\36\344z\252\17~\36m\30G\35f\223\233\310y\201\26\341\363t\22\236\7\247|\36\233\21\367K\21\14/\263\301\213L\317M\341j\333\5\237\2Y\311\364k\257\261w\343\17M\3pa\27~\201[\2_g\265N\224\350\243$\301\302\221\231%\350\374\204\360r\32[\13U\324\203\3F\236\3236@fKn\3636\213\12\36\361\347\336\23-\30\316G#\27\22D\206 \237\352\2639\367!U\365\363\361\324u\370\34$\217\34\367\221\353kI<\13m\310jK\303;\234\37\346H\316Ia\33n\232n$c3\376\366g\12\1\236\314[\301\252R\263"4\217\342\273\320\377\32,\334\15\31\370!\257\350\243\11\316K\351\377\376\331\202G\372"\213\236$\2O\\206\33\346\15\306N2\3247\324\370\0,\312\262F&\310\22C\252\15(C\265\352\323\260\307\332c\2\232y\17R\255\215D\227*\21\260\374\30Bx\7\213J\376\217\237\233{\303\23\6\224\21\231\33\1)\210\207|p\262\362\0 \25(]>\202\\354Ej0\361\217\335\335k\273\350\31\", ) \213\236$\2O\\206\33\346\15\306N2\3247\324\370\0,\312\262F&\310\22C\252\15(C\265\352\323\260\307\332c\2\232y\17R\255\215D\227*\21\260\374\30Bx\7\213J\376\217\237\233{\303\23\6\224\21\231\33\1)\210\207|p\262\362\0 \25(]>\202\\354Ej0\361\217\335\335k\273\350\31\", ) == 0x0
 00908   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "#\365\25\205fF\374\6\33t\213\22\5\333\10s/\333\236\242n4:C\236\2\342\6\21\357\02\264r\356/\255\372;\373w\242}\31\260\21\35\353\373v\357\377l\377\7\16 \242\225\12;M\370\177\220\38\0\0\261u\213\264R\373x\311X\3150\334gA`\353\361\336\5\10\267-\227\344\206\234\231\245\350\320\16\304\30\266\375\370\7\350\13t(\31W\25]\253\200\27D\215_\4N\272\24\3406*\32\312U\30\24\311\31\270?2;7|\352o\257\330\347\201\200\14\330\20\340\202`\321\222\330\373j\6\304\14\264\346o\341m\227\267\203\377\355hA}\5\5\270Z\6\15\372Y\245\32\370\351\22\17\2133^ND\202\231\350Y\361\370\226\221\200\264\36\260\344\260\17*\200w\30\23\203|\223\317Vc\201B\177\351tF\0\35\247(\200\201\21\243\325\13\14{-\333\213\30QW\341>E\37\237V\307\323\364?1\253w\267\221W\3$\377\15~\325\305\30_3+T\224\274=>\301\226\17\203%\274b\236\360&\204A\13\1J\231\3\22\0\3116\24\370Qn\247\250\221\12Jo\375\336G\263\2\316\23\275\15\22\20\30:\237\276-#\367u\313\357\363\245Jo\370H\272\225\34\243\17\361k\35\242\21m\234\364Q\303o\2\5\346\34PSaO\360\200np\375)\376\242\371\20\1\312RA\301\376\314\251"`\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) `\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00909   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "7\320\2!x\2459\264\316\235lB\25\312\21D@\237yt\24\320~t@\371[\14\234\373\327\4@\2469\220\370\325\215<\327\272F\310k\326\363^5\2\222\233\26\3069\364\27W\177((\327\26\240\374\300N\5'\201\322\3U5PDQ\335\2\316SW\321HU\235\177\30T\240>\313\366\264\302\7\204L\220A~\36\212\204\20d\36\231\324U\23:t\333L\7\215u4Mx\351\36\306_zV\201\27\336-\3\242V@+\27\22\21|<\336T\232@\237\206\254\304\11\353JS\321\274\357\5\303\314*/\261K\274\247\11\31%\344\362\32O\353\321;\2334A^\24\20\252\22KRr\177\13\20\21698\347\211\323\215\320\335\10\24\20z\311\14,\232\10S\21\226\241\11m\13\206Sa\333"\35\226\316\302SH\361b3X\11'\204\300\301\321E\374\301Na\350Vl/\1\226\351E\214\361\313\267\230\352O\303\333\221.t{\247\213_\21b\\30;\12P\232y\179H\354\31\232\220O\362\31w\272$Wp\317\311]\30W\371\35\2464\276\243\1\326\271\33\271<\235\343 \255\236\114T\311"\217\251\230\376\0\5~\30i\346\316h\3\1\372|T@QjTT\276\230*\354G\264\27\6\246\12\344#\310\323&S\206\14PE\351L\1\341P\13\27\257\355\332\354\370\224'\347k\315z\20D\14\33Ed\12JT\264`%S\234\217u\351\356r\236\346_\312H\2\213\302\321\30t/\214\334\217\235\224pU\214\361\2\237\331\246\367~gf\4T\331\302H@\275P.\27\327\2428\15V\34\244^\206F\242Pe\26\2\31\353\12\257\34\235~\2\3668Bh?{}pO\207\376\3\373\262\323\360mi\36\4G\16\30\3\206\223\36\266X\236\32\10H\235\320\226`\235Z G#\237M", ) \35\226\316\302SH\361b3X\11'\204\300\301\321E\374\301Na\350Vl/\1\226\351E\214\361\313\267\230\352O\303\333\221.t{\247\213_\21b\\30;\12P\232y\179H\354\31\232\220O\362\31w\272$Wp\317\311]\30W\371\35\2464\276\243\1\326\271\33\271<\235\343 \255\236\114T\311 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "7\320\2!x\2459\264\316\235lB\25\312\21D@\237yt\24\320~t@\371[\14\234\373\327\4@\2469\220\370\325\215<\327\272F\310k\326\363^5\2\222\233\26\3069\364\27W\177((\327\26\240\374\300N\5'\201\322\3U5PDQ\335\2\316SW\321HU\235\177\30T\240>\313\366\264\302\7\204L\220A~\36\212\204\20d\36\231\324U\23:t\333L\7\215u4Mx\351\36\306_zV\201\27\336-\3\242V@+\27\22\21|<\336T\232@\237\206\254\304\11\353JS\321\274\357\5\303\314*/\261K\274\247\11\31%\344\362\32O\353\321;\2334A^\24\20\252\22KRr\177\13\20\21698\347\211\323\215\320\335\10\24\20z\311\14,\232\10S\21\226\241\11m\13\206Sa\333"\35\226\316\302SH\361b3X\11'\204\300\301\321E\374\301Na\350Vl/\1\226\351E\214\361\313\267\230\352O\303\333\221.t{\247\213_\21b\\30;\12P\232y\179H\354\31\232\220O\362\31w\272$Wp\317\311]\30W\371\35\2464\276\243\1\326\271\33\271<\235\343 \255\236\114T\311"\217\251\230\376\0\5~\30i\346\316h\3\1\372|T@QjTT\276\230*\354G\264\27\6\246\12\344#\310\323&S\206\14PE\351L\1\341P\13\27\257\355\332\354\370\224'\347k\315z\20D\14\33Ed\12JT\264`%S\234\217u\351\356r\236\346_\312H\2\213\302\321\30t/\214\334\217\235\224pU\214\361\2\237\331\246\367~gf\4T\331\302H@\275P.\27\327\2428\15V\34\244^\206F\242Pe\26\2\31\353\12\257\34\235~\2\3668Bh?{}pO\207\376\3\373\262\323\360mi\36\4G\16\30\3\206\223\36\266X\236\32\10H\235\320\226`\235Z G#\237M", ) , ) == 0x0
 00910   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "cN\30!,;#\264\232\3vBAT\13D\24\1ct@Ndt\24gA\14\310e\315\4\248#\220\254K\227<\203$\\310?H\351^a\234\210\233BX#\364C\311e(|I\14\240\250^T\5s\37\310\3\1\253JD\5C\30\316\7\311\313H\1\3e\30\0>$\313\242*\330\7\320\322\212A*\200\220\204D\372\4\231\200\313\11: EV\7\331\353.M,w\4\306\13\344L\201C@7\3\366\310Z+C\214\13|h@N\232\24\1\234\254\220\227\361J\7O\246\357Q]\326*{/Q\274\363\227\3%\260l\0O\277O!\233`\337D\24D4\10K\6\354e\13D\20#8\263\27\311\215\204C\22\24D\344\323\14x\4\22SE\10\273\119\225\234S5E8\35\302P\330S\34ox3\14\227=\204\224_\313E\250_Ta\274\310v/U\10\363E\330o\321\267\314tU\303\217\174t/9\221_E\374F\30o\224J\232-\221#H\270\207\200\220\33l\3w\356\272Mp\233WG\30\3g\7\246` \271\1\202'\1\271h\3\371 \371\0\234\0W8\217\375\6\344\0Q\340\2i\262Pr\3UdfT\24\317pT\0 \202*\270\331\256\27R8\20\344wV\311&\7\30\26P\21wV\1\265\316\21\27\373s\300\354\254\12=\347?S`\20\20\222\1E0\224PT\340\376?S\310\21o\351\272\354\204\346\13TR\2\337\\313\30 \261\226\334\333\3\216p\1\22\353\2\313G\274\367*\371|\4\0G\330H\24#J.CI\2708Y\310\6\244\12\30\\242\4\373\14\2Mu\20\257H\3d\2\242\246Xhk\345gp\33\31\344\3\257,\311\3609\367\4\4\23\220\2\3\322\15\4\266\14\0\0\10\34\3\312\2264\3@ \23\275\205M", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00911   896   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\316\336\12\214V\202\12\205\337\317\1\27\224\245V8\5\277\377R99L\210\244 \31|\236\362\204\11t\300\212\346O^\337h\242\2217\330D\257\252F\277bV\150\225a\301X\236\302\17h\224\\21\220\210Fk\256\276|AI\237\316k\34\15\20\345\267x\222a;F\21+_\362\254\214v \12\201V<\361\301\353\237|@\350G1v\332\220\302\262t\336\25\21\344\256\202\315\36\254W\263\270\273\201@,\220\234\14\235S\10\226|\326\24\13p\336\331@D\333\220\261\15\205\233|0\224\23\221c\5\37\20\363\217I\360\351]\250\11\35\225FB\223\235\4\357\343\222\334\217\252\334J\261\320\264F\2035_X\20\336e<\364\\34\260\211n/v\26\360\20\10\14r\355+\353\303\234\201\11:\272\12s\225\260`\266m\3034Y\330\254}\20\217\352J\5\347\2243\370\346\227\321\352C*\325:X\272\1B\4\224N\20\\210\36MR\3176\2PZedQ\365\16\6\22:\212\11B\225\230\242?\270\4#\15\203\30=\274R\202\5\265\13\3718D\205\3\263Q\321n\242\276\214\214\260G\267/\26o\206\34\234\2\373!;\220\374V\20\330\215\271\104-"$\370\271\13I\34\6q\4Z\256j\232y\345\13nYvz\300\327\377*\211{\262\303\214\215\356\16\2\250\2209\250L\B\337\10W\204-[\353x\236\21\310K\21P\200\25\22\26\222\@+\314\250C\236\224\250\14\211 \22\322\344370\271\13I\34\6q\4Z\256j\232y\345\13nYvz\300\327\377*\211{\262\303\214\215\356\16\2\250\2209\250L\B\337\10W\204-[\353x\236\21\310K\21P\200\25\22\26\222\@+\314\250C\236\224\250\14\211 \22\322\3443449\232vY\2275\\16\326\207\251%\311\221\270\336g\352\321F\205\362\226X\376\205)vc\240AX\306\332\3405\242[\315x\11\247\26\317&s@\232\353N\254\314\354h\37\4B\237E\247\350\1|\374\247\11\263\251\211\226\231B\26\224]\303\302\222\225,~\20\243\216@x\342d\14\4", ) == 0x0
 00912   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237) (108, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00913   896   NtReadFile  (104, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048},  (104, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\24\325\32\0\4\325\32\00\305\32\0 \305\32\0\260\367\32\0\240\367\32\0P\364\32\0X\364\32\0@\364\32\0H\364\32\0p\364\32\0x\364\32\0`\364\32\0h\364\32\0\20\364\32\0\30\364\32\0\364\364\32\0\340\364\32\0\214\364\32\0H\365\32\0\4\365\32\0\374\365\32\0\204\365\32\0D\362\32\0\304\362\32\0\274\362\32\0\320\360\32\0\244\361\32\0d\356\32\0@\357\32\0\364\357\32\0 \355\32\0(\353\32\0\20\351\32\0|\346\32\0\234\346\32\0\34\347\32\0\334\347\32\0(\344\32\0\310\344\32\0\224\344\32\0\244\344\32\0\314\335\37\0\264\335\37\0\203\267\35\0\277\267\35\0V\264\35\0N\264\35\0`\264\35\0\32\264\35\0=\264\35\0\320\264\35\0\364\264\35\0\355\264\35\0\200\264\35\0\274\264\35\0\252\264\35\0F\265\35\0|\265\35\0\25\265\35\0\4\265\35\0)\265\35\0\302\265\35\0\343\265\35\0\205\265\35\0\254\265\35\0O\262\35\0\36\262\35\0;\262\35\0\306\262\35\0\225\262\35\0\265\262\35\0P\263\35\0m\263\35\03\263\35\0(\263\35\0\306\263\35\0\376\263\35\0\224\263\35\0\202\263\35\0\270\263\35\0U\260\35\0N\260\35\0{\260\35\0\20\260\35\0\12\260\35\0-\260\35\0\320\260\35\0\336\260\35\0\307\260\35\0\313\260\35\0H\236\14\0C\236\3\0@\236\2\0A\236\0\0P\236\31\0\\236\35\0R\236\37\0\177\236\1\0I\236\4\0p\236:\0|\2360\0}\236;\0w\2368\0K\236?\0r\236=\0G\236\13\0F\236\26\0D\236\24\0[\236\27\0_\236\20\0]\2366\0T\236\30\0U\2364\0y\236\32\0T\236\32\0T\236\32\0T\236\32@p\346j$e\254Tm!\372j@\0\320WU\20\316\32@p\346j$e\253Tm", ) , ) == 0x0
 00914   896   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "@K\0\0PK\0\0d[\0\0t[\0\0\344i\0\0\364i\0\0\4j\0\0\14j\0\0\24j\0\0\34j\0\0$j\0\0,j\0\04j\0\0\0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) \0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) == 0x0
 00915   896   NtClose  (108, ... ) == 0x0
 00916   896   NtClose  (104, ... ) == 0x0
 00917   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.tmp"}, 1242360, ... ) }, 1242360, ... ) == 0x0
 00918   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.tmp"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00919   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 104, ... 108, ) == 0x0
 00920   896   NtClose  (104, ... ) == 0x0
 00921   896   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 176128, ) == 0x0
 00922   896   NtClose  (108, ... ) == 0x0
 00923   896   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 00924   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 00925   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 00926   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.tmp"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 00927   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 104, ) == 0x0
 00928   896   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00929   896   NtClose  (108, ... ) == 0x0
 00930   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0xaf0000), 0x0, 471040, ) == STATUS_IMAGE_NOT_AT_BASE
 00931   896   NtMapViewOfSection  (104, -1, (0xaf0000), 0, 0, 0x0, 471040, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00932   896   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00933   896   NtClose  (104, ... ) == 0x0
 00934   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 8, ) == 0x0
 00935   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 8, ... (0xb62000), 4096, 4, ) == 0x0
 00936   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00937   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00938   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00939   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00940   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00941   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 00942   896   NtClose  (104, ... ) == 0x0
 00943   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00944   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00945   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00946   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00947   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00948   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00949   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00950   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00951   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00952   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00953   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00954   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00955   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00956   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00957   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00958   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00959   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00960   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00961   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00962   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00963   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00964   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00965   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 73728, ) == 0x0
 00966   896   NtClose  (104, ... ) == 0x0
 00967   896   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00968   896   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00969   896   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00970   896   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00971   896   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00972   896   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00973   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00974   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00975   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00976   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00977   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00978   896   NtClose  (104, ... ) == 0x0
 00979   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00980   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00981   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00982   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00983   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00984   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00985   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00986   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00987   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00988   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00989   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00990   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00991   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00992   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00993   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00994   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00995   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00996   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00997   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00998   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00999   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 01000   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 01001   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 01002   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 01003   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 01004   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 01005   896   NtClose  (104, ... ) == 0x0
 01006   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01007   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01008   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01009   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01010   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01011   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01012   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01013   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01014   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01015   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01016   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01017   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01018   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01019   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01020   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01021   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01022   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01023   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01024   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01025   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01026   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01027   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 01028   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 01029   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 01030   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 01031   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 01032   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 01033   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01034   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01035   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == 0x0
 01036   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 01037   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 104, ... 108, ) == 0x0
 01038   896   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01039   896   NtClose  (104, ... ) == 0x0
 01040   896   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0
 01041   896   NtClose  (108, ... ) == 0x0
 01042   896   NtProtectVirtualMemory  (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0
 01043   896   NtProtectVirtualMemory  (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0
 01044   896   NtFlushInstructionCache  (-1, 1907167232, 52, ... ) == 0x0
 01045   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 01046   896   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 01047   896   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 01048   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMCTL32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01049   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01050   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3604480, 65536, ) == 0x0
 01051   896   NtAllocateVirtualMemory  (-1, 3604480, 0, 4096, 4096, 4, ... 3604480, 4096, ) == 0x0
 01052   896   NtAllocateVirtualMemory  (-1, 3608576, 0, 8192, 4096, 4, ... 3608576, 8192, ) == 0x0
 01053   896   NtAllocateVirtualMemory  (-1, 3616768, 0, 4096, 4096, 4, ... 3616768, 4096, ) == 0x0
 01054   896   NtAllocateVirtualMemory  (-1, 3620864, 0, 4096, 4096, 4, ... 3620864, 4096, ) == 0x0
 01055   896   NtQueryDefaultUILanguage  (1240988, ...
 01056   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01057   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 01058   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01059   896   NtClose  (-2147482756, ... ) == 0x0
 01060   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 01061   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01062   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01063   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01064   896   NtClose  (-2147481452, ... ) == 0x0
 01065   896   NtClose  (-2147482756, ... ) == 0x0
 01055   896   NtQueryDefaultUILanguage  ... ) == 0x0
 01066   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL"}, 1, 96, ... 108, {status=0x0, info=1}, ) }, 1, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 01067   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 108, ... 104, ) == 0x0
 01068   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xb70000), 0x0, 618496, ) == 0x0
 01069   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01070   896   NtQueryDefaultLocale  (1, 1239084, ... ) == 0x0
 01071   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01072   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844}  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81841, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81841, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81841, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" )  ) == 0x0
 01073   896   NtClose  (108, ... ) == 0x0
 01074   896   NtClose  (104, ... ) == 0x0
 01075   896   NtUnmapViewOfSection  (-1, 0xb70000, ... ) == 0x0
 01076   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01077   896   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 104, ) == 0x0
 01078   896   NtQueryInformationProcess  (104, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01079   896   NtClose  (104, ... ) == 0x0
 01080   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01081   896   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 01082   896   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 01083   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01084   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 104, ) == 0x0
 01085   896   NtQueryInformationToken  (104, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01086   896   NtClose  (104, ... ) == 0x0
 01087   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 104, ) }, ... 104, ) == 0x0
 01088   896   NtOpenProcessToken  (-1, 0x8, ... 108, ) == 0x0
 01089   896   NtAccessCheck  (1335152, 108, 0x1, 1242180, 1242232, 56, 1242212, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01090   896   NtClose  (108, ... ) == 0x0
 01091   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "Control Panel\Desktop"}, ... 108, ) }, ... 108, ) == 0x0
 01092   896   NtQueryValueKey  (108,  (108, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01093   896   NtClose  (108, ... ) == 0x0
 01094   896   NtUserSystemParametersInfo  (41, 500, 1242360, 0, ... ) == 0x1
 01095   896   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 01096   896   NtClose  (104, ... ) == 0x0
 01097   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 01098   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01099   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c03b
 01100   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c03d
 01101   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01102   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c03f
 01103   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01104   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c041
 01105   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01106   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c043
 01107   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c045
 01108   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01109   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c047
 01110   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01111   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c049
 01112   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01113   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c04b
 01114   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01115   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c04d
 01116   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01117   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c04f
 01118   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c051
 01119   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01120   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c053
 01121   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 01122   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c055
 01123   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 01124   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c057
 01125   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01126   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c059
 01127   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10013
 01128   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c05b
 01129   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01130   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c05d
 01131   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01132   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c05f
 01133   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPR.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01134   896   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 104, ) == 0x0
 01135   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 108, ) == 0x0
 01136   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 112, ) }, ... 112, ) == 0x0
 01137   896   NtNotifyChangeKey  (112, 108, 0, 0, 2011455960, 4, 0, 0, 0, 1, ... ) == 0x103
 01138   896   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 01139   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 116, ) == 0x0
 01140   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 120, ) == 0x0
 01141   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLE32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01142   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 124, {status=0x0, info=0}, ) }, 7, 16, ... 124, {status=0x0, info=0}, ) == 0x0
 01143   896   NtDeviceIoControlFile  (124, 0, 0x0, 0x0, 0x390008,  (124, 0, 0x0, 0x0, 0x390008, "$\226\346r\207\262\4\2703FxJ\247\2536\362\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01144   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01145   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01146   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01147   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01148   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01149   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01150   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01151   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482756, 2, ) }, 0, 0x0, 0, ... -2147482756, 2, ) == 0x0
 01152   896   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "\22\213\7;F\7\4\307\364c6\357\331n\13\223\373p\231p\35Zr\220TYl\243\351y\203#I>7\2"\3\37022\200\222\350\30Vb\372g\236\2\252\364n\301\17\2Rpw\12O\15\342\254u\24\230\331L\0iU\244\347*\322\320\220\354", 80, ... ) , 0, 3,  (-2147482756, "Seed", 0, 3, "\22\213\7;F\7\4\307\364c6\357\331n\13\223\373p\231p\35Zr\220TYl\243\351y\203#I>7\2"\3\37022\200\222\350\30Vb\372g\236\2\252\364n\301\17\2Rpw\12O\15\342\254u\24\230\331L\0iU\244\347*\322\320\220\354", 80, ... ) \3\37022\200\222\350\30Vb\372g\236\2\252\364n\301\17\2Rpw\12O\15\342\254u\24\230\331L\0iU\244\347*\322\320\220\354", 80, ... ) == 0x0
 01153   896   NtClose  (-2147482756, ... ) == 0x0
 01143   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "4+r;\201Z\11\3137\205\323\32\264}\274,\342\21\303\362\30\267v@\241\327\3336l\202mg\23\276\0q\276\203\257E\241U{\310>\277\13\322\331S\211\275<\364_\260VE}\234w\32\34\270\204\334\5]\274$EA\371\243\377U\25H\2\374T\217\320\227d\273r\221\200x\276\2\26M\273\256W`}\217\336\14&jFd, ) , ) == 0x0
 01154   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01155   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01156   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 128, ) }, ... 128, ) == 0x0
 01157   896   NtQueryValueKey  (128,  (128, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 01158   896   NtClose  (128, ... ) == 0x0
 01159   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 128, ) }, ... 128, ) == 0x0
 01160   896   NtQueryValueKey  (128,  (128, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01161   896   NtClose  (128, ... ) == 0x0
 01162   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01163   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01164   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01165   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01166   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 128, ) }, ... 128, ) == 0x0
 01167   896   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01168   896   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01169   896   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01170   896   NtClose  (128, ... ) == 0x0
 01171   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 128, ) }, ... 128, ) == 0x0
 01172   896   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01173   896   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01174   896   NtClose  (128, ... ) == 0x0
 01175   896   NtOpenEvent  (0x1f0003, {24, 44, 0x0, 0, 0,  (0x1f0003, {24, 44, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01176   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01177   896   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 01178   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01179   896   NtOpenKey  (0x9, {24, 16, 0x40, 0, 0,  (0x9, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01180   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 01181   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01182   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01183   896   NtQueryPerformanceCounter  (... {-1448065707, 16}, {3579545, 0}, ) == 0x0
 01184   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\obe3.tmp"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01185   896   NtUserCallOneParam  (0, 41, ... ) == 0x4
 01186   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0
 01187   896   NtQueryVirtualMemory  (-1, 0x12f630, Basic, 28, ... {BaseAddress=0x12f000,AllocationBase=0x30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01188   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 11993088, 1048576, ) == 0x0
 01189   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01190   896   NtAllocateVirtualMemory  (-1, 11993088, 0, 16384, 4096, 4, ... 11993088, 16384, ) == 0x0
 01191   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 01192   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 01193   896   NtOpenKey  (0xf003f, {24, 100, 0x40, 0, 0,  (0xf003f, {24, 100, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01194   896   NtOpenKey  (0xf003f, {24, 100, 0x40, 0, 0,  (0xf003f, {24, 100, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01195   896   NtOpenProcessToken  (-1, 0x8, ... 128, ) == 0x0
 01196   896   NtQueryInformationToken  (128, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 01197   896   NtClose  (128, ... ) == 0x0
 01198   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.ENU"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01199   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.ENU"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01200   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.ENU.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01201   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.EN"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.EN"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01203   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\obe3.EN.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01204   896   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 128, ) == 0x0
 01205   896   NtUserGetDC  (0, ... ) == 0x1010052
 01206   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01207   896   NtUserGetDC  (0, ... ) == 0x1010052
 01208   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01209   896   NtGdiCreatePaletteInternal  (1241804, 16, ... ) == 0x64080596
 01210   896   NtGdiGetStockObject  (7, ... ) == 0x1b00017
 01211   896   NtGdiGetStockObject  (5, ... ) == 0x1900015
 01212   896   NtUserFindExistingCursorIcon  (1242168, 1242184, 1242232, ... ) == 0x10003
 01213   896   NtAddAtom  ( ("D\0e\0l\0p\0h\0i\00\00\00\00\00\04\0E\04\0", 28, 1242732, ... ) , 28, 1242732, ... ) == 0x0
 01214   896   NtAddAtom  ( ("C\0o\0n\0t\0r\0o\0l\0O\0f\0s\00\00\0A\0F\00\00\00\00\00\00\00\00\00\03\08\00\0", 52, 1242732, ... ) , 52, 1242732, ... ) == 0x0
 01215   896   NtUserSystemParametersInfo  (104, 0, 12000836, 0, ... ) == 0x1
 01216   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01217   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10023
 01218   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01219   896   NtUserGetDC  (0, ... ) == 0x1010052
 01220   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xc9050697
 01221   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01222   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0x185000f
 01223   896   NtGdiGetDCforBitmap  (-922417513, ... ) == 0x860107ab
 01224   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01225   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0xc9050697
 01226   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01227   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01228   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11875852, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01229   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01230   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0xc9050697
 01231   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01232   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc9050697
 01233   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xba0106e8
 01234   896   NtGdiExtGetObjectW  (-922417513, 24, 1241212, ... ) == 0x18
 01235   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x710504dc
 01236   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0x185000f
 01237   896   NtGdiSelectBitmap  (-1174337816, 1896154332, ... ) == 0x185000f
 01238   896   NtGdiBitBlt  (-1174337816, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01239   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc9050697
 01240   896   NtGdiSelectBitmap  (-1174337816, 25493519, ... ) == 0x710504dc
 01241   896   NtGdiDeleteObjectApp  (-922417513, ... ) == 0x1
 01242   896   NtGdiDeleteObjectApp  (-1174337816, ... ) == 0x1
 01243   896   NtUserCallOneParam  (0, 33, ... ) == 0x2007009d
 01244   896   NtUserSetCursorIconData  (537329821, 1241316, 1241332, 1241396, ... ) == 0x1
 01245   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10029
 01246   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10027
 01247   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10025
 01248   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01249   896   NtUserGetDC  (0, ... ) == 0x1010052
 01250   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x750505de
 01251   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01252   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x185000f
 01253   896   NtGdiGetDCforBitmap  (1963263454, ... ) == 0x860107ab
 01254   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01255   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x750505de
 01256   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01257   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01258   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11876160, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01259   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01260   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x750505de
 01261   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01262   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x750505de
 01263   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xcb010697
 01264   896   NtGdiExtGetObjectW  (1963263454, 24, 1241212, ... ) == 0x18
 01265   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x160506c8
 01266   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x185000f
 01267   896   NtGdiSelectBitmap  (-889125225, 369428168, ... ) == 0x185000f
 01268   896   NtGdiBitBlt  (-889125225, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01269   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x750505de
 01270   896   NtGdiSelectBitmap  (-889125225, 25493519, ... ) == 0x160506c8
 01271   896   NtGdiDeleteObjectApp  (1963263454, ... ) == 0x1
 01272   896   NtGdiDeleteObjectApp  (-889125225, ... ) == 0x1
 01273   896   NtUserCallOneParam  (0, 33, ... ) == 0x1580153
 01274   896   NtUserSetCursorIconData  (22544723, 1241316, 1241332, 1241396, ... ) == 0x1
 01275   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01276   896   NtUserGetDC  (0, ... ) == 0x1010052
 01277   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xbc0506e8
 01278   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01279   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0x185000f
 01280   896   NtGdiGetDCforBitmap  (-1140521240, ... ) == 0x860107ab
 01281   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01282   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0xbc0506e8
 01283   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01284   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01285   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11876468, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01286   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01287   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0xbc0506e8
 01288   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01289   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xbc0506e8
 01290   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0x770105de
 01291   896   NtGdiExtGetObjectW  (-1140521240, 24, 1241212, ... ) == 0x18
 01292   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x2a050554
 01293   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0x185000f
 01294   896   NtGdiSelectBitmap  (1996555742, 704972116, ... ) == 0x185000f
 01295   896   NtGdiBitBlt  (1996555742, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01296   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xbc0506e8
 01297   896   NtGdiSelectBitmap  (1996555742, 25493519, ... ) == 0x2a050554
 01298   896   NtGdiDeleteObjectApp  (-1140521240, ... ) == 0x1
 01299   896   NtGdiDeleteObjectApp  (1996555742, ... ) == 0x1
 01300   896   NtUserCallOneParam  (0, 33, ... ) == 0x250297
 01301   896   NtUserSetCursorIconData  (2425495, 1241316, 1241332, 1241396, ... ) == 0x1
 01302   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01303   896   NtUserGetDC  (0, ... ) == 0x1010052
 01304   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xcd050697
 01305   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01306   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0x185000f
 01307   896   NtGdiGetDCforBitmap  (-855308649, ... ) == 0x860107ab
 01308   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01309   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0xcd050697
 01310   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01311   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01312   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11876776, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01313   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01314   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0xcd050697
 01315   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01316   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xcd050697
 01317   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xbe0106e8
 01318   896   NtGdiExtGetObjectW  (-855308649, 24, 1241212, ... ) == 0x18
 01319   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x6905057d
 01320   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0x185000f
 01321   896   NtGdiSelectBitmap  (-1107228952, 1761936765, ... ) == 0x185000f
 01322   896   NtGdiBitBlt  (-1107228952, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01323   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xcd050697
 01324   896   NtGdiSelectBitmap  (-1107228952, 25493519, ... ) == 0x6905057d
 01325   896   NtGdiDeleteObjectApp  (-855308649, ... ) == 0x1
 01326   896   NtGdiDeleteObjectApp  (-1107228952, ... ) == 0x1
 01327   896   NtUserCallOneParam  (0, 33, ... ) == 0x2c0293
 01328   896   NtUserSetCursorIconData  (2884243, 1241316, 1241332, 1241396, ... ) == 0x1
 01329   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01330   896   NtUserGetDC  (0, ... ) == 0x1010052
 01331   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x790505de
 01332   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01333   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x185000f
 01334   896   NtGdiGetDCforBitmap  (2030372318, ... ) == 0x860107ab
 01335   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01336   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x790505de
 01337   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01338   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01339   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11877084, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01340   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01341   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x790505de
 01342   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01343   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x790505de
 01344   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xcf010697
 01345   896   NtGdiExtGetObjectW  (2030372318, 24, 1241212, ... ) == 0x18
 01346   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xcf0506b6
 01347   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x185000f
 01348   896   NtGdiSelectBitmap  (-822016361, -821754186, ... ) == 0x185000f
 01349   896   NtGdiBitBlt  (-822016361, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01350   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x790505de
 01351   896   NtGdiSelectBitmap  (-822016361, 25493519, ... ) == 0xcf0506b6
 01352   896   NtGdiDeleteObjectApp  (2030372318, ... ) == 0x1
 01353   896   NtGdiDeleteObjectApp  (-822016361, ... ) == 0x1
 01354   896   NtUserCallOneParam  (0, 33, ... ) == 0x19018f
 01355   896   NtUserSetCursorIconData  (1638799, 1241316, 1241332, 1241396, ... ) == 0x1
 01356   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01357   896   NtUserGetDC  (0, ... ) == 0x1010052
 01358   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xc00506e8
 01359   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01360   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0x185000f
 01361   896   NtGdiGetDCforBitmap  (-1073412376, ... ) == 0x860107ab
 01362   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01363   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0xc00506e8
 01364   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01365   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01366   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11877700, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01367   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01368   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0xc00506e8
 01369   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01370   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc00506e8
 01371   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0x7b0105de
 01372   896   NtGdiExtGetObjectW  (-1073412376, 24, 1241212, ... ) == 0x18
 01373   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x220505f7
 01374   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0x185000f
 01375   896   NtGdiSelectBitmap  (2063664606, 570754551, ... ) == 0x185000f
 01376   896   NtGdiBitBlt  (2063664606, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01377   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc00506e8
 01378   896   NtGdiSelectBitmap  (2063664606, 25493519, ... ) == 0x220505f7
 01379   896   NtGdiDeleteObjectApp  (-1073412376, ... ) == 0x1
 01380   896   NtGdiDeleteObjectApp  (2063664606, ... ) == 0x1
 01381   896   NtUserCallOneParam  (0, 33, ... ) == 0x4b01ff
 01382   896   NtUserSetCursorIconData  (4915711, 1241316, 1241332, 1241396, ... ) == 0x1
 01383   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01384   896   NtUserGetDC  (0, ... ) == 0x1010052
 01385   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xd1050697
 01386   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01387   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0x185000f
 01388   896   NtGdiGetDCforBitmap  (-788199785, ... ) == 0x860107ab
 01389   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01390   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0xd1050697
 01391   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01392   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01393   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11877392, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01394   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01395   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0xd1050697
 01396   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01397   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xd1050697
 01398   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xc20106e8
 01399   896   NtGdiExtGetObjectW  (-788199785, 24, 1241212, ... ) == 0x18
 01400   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xce0506aa
 01401   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0x185000f
 01402   896   NtGdiSelectBitmap  (-1040120088, -838531414, ... ) == 0x185000f
 01403   896   NtGdiBitBlt  (-1040120088, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01404   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xd1050697
 01405   896   NtGdiSelectBitmap  (-1040120088, 25493519, ... ) == 0xce0506aa
 01406   896   NtGdiDeleteObjectApp  (-788199785, ... ) == 0x1
 01407   896   NtGdiDeleteObjectApp  (-1040120088, ... ) == 0x1
 01408   896   NtUserCallOneParam  (0, 33, ... ) == 0x450281
 01409   896   NtUserSetCursorIconData  (4522625, 1241316, 1241332, 1241396, ... ) == 0x1
 01410   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10015
 01411   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10019
 01412   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001f
 01413   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001b
 01414   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10021
 01415   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001d
 01416   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10013
 01417   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10017
 01418   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01419   896   NtUserCallOneParam  (0, 40, ... ) == 0x4090409
 01420   896   NtUserGetDC  (0, ... ) == 0x1010052
 01421   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01422   896   NtUserEnumDisplayMonitors  (0, 0, 11600484, 12001416, ... ) == 0x1
 01423   896   NtUserSystemParametersInfo  (31, 60, 1241032, 0, ... ) == 0x1
 01424   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335224, ... ) == 0xc30a06e8
 01425   896   NtGdiExtGetObjectW  (-1022753048, 420, 1241736, ... ) == 0x164
 01426   896   NtUserSystemParametersInfo  (41, 0, 1241232, 0, ... ) == 0x1
 01427   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335216, ... ) == 0x7d0a05de
 01428   896   NtGdiExtGetObjectW  (2097808862, 420, 1241736, ... ) == 0x164
 01429   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335208, ... ) == 0xd20a0697
 01430   896   NtGdiExtGetObjectW  (-771094889, 420, 1241736, ... ) == 0x164
 01431   896   NtUserFindExistingCursorIcon  (1241812, 1241828, 1241876, ... ) == 0x0
 01432   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 3801088, 4096, ) == 0x0
 01433   896   NtUserGetKeyboardLayoutList  (64, 1242400, ... ) == 0x1
 01434   896   NtUserRegisterWindowMessage  ( ("Delphi Picture", ... ) , ... ) == 0xc13a
 01435   896   NtUserRegisterWindowMessage  ( ("Delphi Component", ... ) , ... ) == 0xc13b
 01436   896   NtOpenMutant  (0x1f0001, {24, 44, 0x0, 0, 0,  (0x1f0001, {24, 44, 0x0, 0, 0, "Residented"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01437   896   NtUserSetWindowsHookEx  (11468800, 1243784, 0, 4, 11476668, 2, ... ) == 0x5a01d7
 01438   896   NtQueryVirtualMemory  (-1, 0x31428210, Basic, 28, ... {BaseAddress=0x31428000,AllocationBase=0x31420000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01439   896   NtOpenFile  (0x10080, {24, 12, 0x40, 0, 0,  (0x10080, {24, 12, 0x40, 0, 0, "ftpupd.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01440   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "uterm19"}, 1, ... 132, ) }, 1, ... 132, ) == 0x0
 01441   896   NtOpenProcessToken  (-1, 0x20, ... 136, ) == 0x0
 01442   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01443   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01444   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 140, ) }, ... 140, ) == 0x0
 01445   896   NtQueryValueKey  (140,  (140, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01446   896   NtClose  (140, ... ) == 0x0
 01447   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01448   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 140, ) == 0x0
 01449   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 144, ) == 0x0
 01450   896   NtQuerySystemTime  (... {1422422914, 29929616}, ) == 0x0
 01451   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 148, ) == 0x0
 01452   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01453   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01454   896   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01455   896   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01456   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 152, ) == 0x0
 01457   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 156, ) == 0x0
 01458   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01459   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 160, ) }, ... 160, ) == 0x0
 01460   896   NtOpenKey  (0x20019, {24, 160, 0x40, 0, 0,  (0x20019, {24, 160, 0x40, 0, 0, "ActiveComputerName"}, ... 164, ) }, ... 164, ) == 0x0
 01461   896   NtQueryValueKey  (164,  (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 01462   896   NtClose  (164, ... ) == 0x0
 01463   896   NtClose  (160, ... ) == 0x0
 01464   896   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 160, ) == 0x0
 01465   896   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 164, ) == 0x0
 01466   896   NtDuplicateObject  (-1, 160, -1, 0x0, 0, 2, ... 168, ) == 0x0
 01467   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01468   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01469   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01470   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01471   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243228,  (0xc0100080, {24, 0, 0x40, 0, 1243228, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 176, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 176, {status=0x0, info=1}, ) == 0x0
 01472   896   NtSetInformationFile  (176, 1243284, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01473   896   NtSetInformationFile  (176, 1243272, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01474   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01475   896   NtWriteFile  (176, 153, 0, 0,  (176, 153, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01476   896   NtReadFile  (176, 153, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (176, 153, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01477   896   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01478   896   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) == 0x103
 01479   896   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01480   896   NtClose  (172, ... ) == 0x0
 01481   896   NtClose  (176, ... ) == 0x0
 01482   896   NtAdjustPrivilegesToken  (136, 0, 1245080, 16, 0, 0, ... ) == 0x0
 01483   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01484   896   NtQueryValueKey  (176,  (176, "Windows Security Manager", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01485   896   NtClose  (176, ... ) == 0x0
 01486   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01487   896   NtQueryValueKey  (176,  (176, "Disk Defragmenter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01488   896   NtClose  (176, ... ) == 0x0
 01489   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01490   896   NtQueryValueKey  (176,  (176, "System Restore Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01491   896   NtClose  (176, ... ) == 0x0
 01492   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01493   896   NtQueryValueKey  (176,  (176, "Bot Loader", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01494   896   NtClose  (176, ... ) == 0x0
 01495   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01496   896   NtQueryValueKey  (176,  (176, "SysTray", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01497   896   NtClose  (176, ... ) == 0x0
 01498   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01499   896   NtQueryValueKey  (176,  (176, "WinUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01500   896   NtClose  (176, ... ) == 0x0
 01501   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01502   896   NtQueryValueKey  (176,  (176, "Windows Update Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01503   896   NtClose  (176, ... ) == 0x0
 01504   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01505   896   NtQueryValueKey  (176,  (176, "avserve.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01506   896   NtClose  (176, ... ) == 0x0
 01507   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01508   896   NtQueryValueKey  (176,  (176, "avserve2.exeUpdate Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01509   896   NtClose  (176, ... ) == 0x0
 01510   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01511   896   NtQueryValueKey  (176,  (176, "MS Config v13", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01512   896   NtClose  (176, ... ) == 0x0
 01513   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01514   896   NtQueryValueKey  (176,  (176, "Windows Update", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01515   896   NtClose  (176, ... ) == 0x0
 01516   896   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01517   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01518   896   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01519   896   NtSetInformationFile  (-2147482448, -135748592, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01520   896   NtSetInformationFile  (-2147482448, -135749060, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01521   896   NtSetInformationFile  (-2147482448, -135748876, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01522   896   NtSetInformationFile  (-2147482448, -135748688, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01518   896   NtCreateKey  ... 176, 1, ) == 0x0
 01523   896   NtSetValueKey  (176,  (176, "ID", 0, 1, "d\0o\0s\0l\0b\0i\0f\0b\0z\0m\0z\0h\0e\0\0\0", 28, ... , 0, 1,  (176, "ID", 0, 1, "d\0o\0s\0l\0b\0i\0f\0b\0z\0m\0z\0h\0e\0\0\0", 28, ... , 28, ...
 01524   896   NtSetInformationFile  (-2147482448, -135748192, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01523   896   NtSetValueKey  ... ) == 0x0
 01525   896   NtClose  (176, ... ) == 0x0
 01526   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01527   896   NtQueryValueKey  (176,  (176, "Cryptographic Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01528   896   NtClose  (176, ... ) == 0x0
 01529   896   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01530   896   NtSetValueKey  (176,  (176, "Client", 0, 1, "1\0\0\0", 4, ... , 0, 1,  (176, "Client", 0, 1, "1\0\0\0", 4, ... , 4, ...
 01531   896   NtSetInformationFile  (-2147482448, -135748240, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01530   896   NtSetValueKey  ... ) == 0x0
 01532   896   NtClose  (176, ... ) == 0x0
 01533   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1243484,  (0x80100080, {24, 0, 0x40, 0, 1243484, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 176, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 176, {status=0x0, info=1}, ) == 0x0
 01534   896   NtQueryInformationFile  (176, 1243920, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01535   896   NtQueryInformationFile  (176, 1243836, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01536   896   NtQueryInformationFile  (176, 1243652, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01537   896   NtAllocateVirtualMemory  (-1, 1368064, 0, 8192, 4096, 4, ... 1368064, 8192, ) == 0x0
 01538   896   NtQueryInformationFile  (176, 1364160, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01539   896   NtQueryInformationFile  (176, 1242100, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01540   896   NtQueryInformationFile  (176, 1242376, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01541   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1242252,  (0x40110080, {24, 0, 0x40, 0, 1242252, "\??\C:\WINDOWS\system32\frghilbd.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01542   896   NtClose  (-2147482756, ... ) == 0x0
 01541   896   NtCreateFile  ... 172, {status=0x0, info=2}, ) == 0x0
 01543   896   NtQueryVolumeInformationFile  (172, 1242404, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01544   896   NtQueryInformationFile  (172, 1241988, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01545   896   NtQueryVolumeInformationFile  (176, 1242404, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01546   896   NtQueryVolumeInformationFile  (176, 1241748, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01547   896   NtSetInformationFile  (172, 1242304, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01548   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 176, ... 180, ) == 0x0
 01549   896   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3b0000), {0, 0}, 188416, ) == 0x0
 01550   896   NtClose  (180, ... ) == 0x0
 01551   896   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01552   896   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "\257t\355\330O^\31\240\371\370\251\356;\220B;\1Bn\37Y\2178.\370\343n\277v\376r\12\320\211\230\370H\356\352X\202\303}\242\254\200\206m\246_v2<-zBY<\24*+\343y\326C5\220\24\213f\346\242\273\333Z\344\250\315\335\320\231\364\275`T\301\1\341\320\26\355\257l\2319r\325e\202\250)i\221\360\224\12\336'\336\203t\3502i\334\4gL\247U\201\36\321\1]\226\364wSR\1\\234\12\20D4\302\212{\214\222\260W\336\307\16V\202a-\365\24\305S\226\272\246{\376\370X\355\303R_4\303J\227 \245j\366\22\307\\266\214\216\232\216\\217\36\22\305\373~\31V\237\22\2\265\14f\227D\232\232Ht\236\23y1\216\375\302\2066B\242\232\205>\5\207\256\37cD\331@\357\372\16&0\334r\330\331U\203\31`Su\30\0\214>\24\27\246i8\34\307Y\330\263\344v\261\240u\256\31a\373\217\32\332U\24\364X,6`\311\227\343\330\340\246\257X\5h>\10\235\1\5\223bt(\356.\233\15\1\362\335\302\356\2620\216:dE\353R\303\320\323\22&\5\261\260\377E\3378\213~k-\242<\220\301\210\23\206|\271\4\236\300\272D2U\12\236_\316LUj\334\261[\212\332[Q\31]\34U\275]n\373\253\10\6\24\232&\14|~lsE\5\5,U\235^\1\11\313\20\13I\230\220\204\20\233\367@K\252\274\23H}\25\362U\4\232*\337`\220WH2\326\3400\207i\20\312\227\332\14T\230\22z\237\356|\351y=:\32\207\262\336\257|\374\203_L\236\377`-\334\301\306t\277L3\263\274\300\323\344z\240\347\24\aKP\232IV_\11\244}7\362 G\212\312\220C\37\h\12x\234\356\355\373\234\224<\277\335\14K", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01553   896   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "v^\227\211\@p\200B\232\245s\37x>[\257\362C\11[\375\315\346t\220\270\264M\337K$y\277:j\11.\13\12\333\235\272\370\371\367\205s\4\377yks\253_SEO~\10W\261\352\377\355\246\12'\24\350 k_@ @k\215\221F\32\3372j\241=T\235\270\202fDQ\1p\331\354<\232\371\221\270\220\342i\25g\5\5-\306^e\227\10~F\27J\301\322E\360\270[\331\376\20b\357\214*\225j\22\373\270\277\254\22Y\36\336\211_\263m[\263\274\206:'\334\322\27\263\242\227\342\253\35\307\264\352f\271\15m\276\353w\23o\347[(m\33P\317\3  \232\36w]\374\11\264F\312/\354V-A\24\340\303w\24\311\265\375\264\177\270\17@;\25A^\13}'\310\361E\13JW2\362\37\3212\20\267\321hQ=W.*N\227\31Yt]\263\260\27\374\364\253\3038\325<\322o\250k\373\253\323\26\177K\35\343\375(\204\21\311+\202<\252\324\205Z\240{|\301;\25\305\260\367\215\221\351\252\277\202\214w\270q\241B\23\352\3\252\266f\35\25\336~8f\377\2232Q(E\35#\254\267\21\344;(\16\321\301\3221aP\350\253\355\270\255\220%|\25rID\334\256+\353\343a\333Y\226n\4&\2346\260\21\24G\345\353\313\376J\376E\267\253\274\224\301u\352\224]}R8\355n\17\343\341\332\277\230\20\344\344\24\336\252\306\255\306\30\243\253\245\333\252\205\6`\324\*\210G\335S\13\200s\253\351\37\24\31\252o]ub\242Bo\370\14\354\205\203\256\214h\5\356\37\252P\207#\373\325QuL\333\233`-\352\323c\333H\347\235\354\363\336BY\215\35\352}\335\271i\27K!j\327Z\376\206\361\352\220\204\344\343\211\340\354\273]\246PtX\337o\371", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01554   896   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "T\236\32\0T\236\32\0T\236\32\0\355\327]+T\236\32\0T\236\33\0T\236\32\0\24\232\32\0`\302\34\0?\237\32\0T\236\32\0T\236\32\0T\236\32\0\355\327]+T\236\32\0T\236\35\0\255\341\32\0\314\232\32\200\256\341\32\0\224\232\32\200\257\341\32\0\274\232\32\200\250\341\32\0D\233\32\200\251\341\32\0l\233\32\200\252\341\32\04\233\32\200\253\341\32\0\334\233\32\200T\236\32\0\355\327]+T\236\32\0T\236\33\0T\236\32\0\344\232\32\0\364\303\34\0@\236\32\0T\236\32\0T\236\32\0T\236\32\0\355\327]+T\236\32\0T\236\33\0T\236\32\0\214\232\32\0\340\303\34\0@\236\32\0T\236\32\0T\236\32\0T\236\32\0\355\327]+T\236\32\0T\236\33\0T\236\32\0T\233\32\0\234\303\34\0@\236\32\0T\236\32\0T\236\32\0T\236\32\0\355\327]+T\236\32\0T\236\33\0T\236\32\0|\233\32\0\210\303\34\0@\236\32\0T\236\32\0T\236\32\0T\236\32\0\355\327]+T\236\32\0T\236\33\0T\236\32\0\4\233\32\0\244\303\34\0@\236\32\0T\236\32\0T\236\32\0T\236\32\0\355\327]+T\236\32\0T\236\33\0T\236\32\0,\233\32\0P\300\34\0@\236\32\0T\236\32\0T\236\32\0T\236\32\0\355\327]+T\236\32\0T\236\33\0T\236\32\0\364\233\32\0L\300\34\0@\236\32\0T\236\32\0T\236\32\0R\236^\0\2\236Y\0\30\236[\0\30\236\21\0\0\236\\0\1\236T\0\27\236W\0\33\236^\0\1\236V\0\21\236\32\0T\236\32\0T\236\32\0T\236\32\0\270\270\35\0\364\270\35\0T\236\32\0T\236\32\0T\236\32\0\255\270\35\0\370\270\35\0T\236\32\0T\236\32\0T\236\32\0R\271\35\0\340\270\35\0", 3040, 0x0, 0, ... {status=0x0, info=3040}, ) , 3040, 0x0, 0, ... {status=0x0, info=3040}, ) == 0x0
 01555   896   NtUnmapViewOfSection  (-1, 0x3b0000, ... ) == 0x0
 01556   896   NtSetInformationFile  (172, 1243652, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01557   896   NtClose  (176, ... ) == 0x0
 01558   896   NtClose  (172, ... ) == 0x0
 01559   896   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01560   896   NtSetValueKey  (172,  (172, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0f\0r\0g\0h\0i\0l\0b\0d\0.\0e\0x\0e\0\0\0", 66, ... , 0, 1,  (172, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0f\0r\0g\0h\0i\0l\0b\0d\0.\0e\0x\0e\0\0\0", 66, ... , 66, ...
 01561   896   NtSetInformationFile  (-2147482448, -135747792, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01562   896   NtSetInformationFile  (-2147482448, -135747884, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01560   896   NtSetValueKey  ... ) == 0x0
 01563   896   NtClose  (172, ... ) == 0x0
 01564   896   NtClose  (132, ... ) == 0x0
 01565   896   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 01566   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\frghilbd.exe"}, 1240872, ... ) }, 1240872, ... ) == 0x0
 01567   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\frghilbd.exe"}, 1241608, ... ) }, 1241608, ... ) == 0x0
 01568   896   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\frghilbd.exe"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01569   896   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 132, ... 172, ) == 0x0
 01570   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01571   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 176, ) }, ... 176, ) == 0x0
 01572   896   NtQueryValueKey  (176,  (176, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01573   896   NtClose  (176, ... ) == 0x0
 01574   896   NtQueryVolumeInformationFile  (132, 1240884, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01575   896   NtOpenMutant  (0x120001, {24, 44, 0x0, 0, 0,  (0x120001, {24, 44, 0x0, 0, 0, "ShimCacheMutex"}, ... 176, ) }, ... 176, ) == 0x0
 01576   896   NtWaitForSingleObject  (176, 0, {-1000000, -1}, ... ) == 0x0
 01577   896   NtOpenSection  (0x2, {24, 44, 0x0, 0, 0,  (0x2, {24, 44, 0x0, 0, 0, "ShimSharedMemory"}, ... 180, ) }, ... 180, ) == 0x0
 01578   896   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3b0000), {0, 0}, 57344, ) == 0x0
 01579   896   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01580   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1238816, ... ) }, 1238816, ... ) == 0x0
 01581   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 184, {status=0x0, info=1}, ) }, 5, 96, ... 184, {status=0x0, info=1}, ) == 0x0
 01582   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 184, ... 188, ) == 0x0
 01583   896   NtClose  (184, ... ) == 0x0
 01584   896   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3c0000), 0x0, 126976, ) == 0x0
 01585   896   NtClose  (188, ... ) == 0x0
 01586   896   NtUnmapViewOfSection  (-1, 0x3c0000, ... ) == 0x0
 01587   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1239124, ... ) }, 1239124, ... ) == 0x0
 01588   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 188, {status=0x0, info=1}, ) }, 5, 96, ... 188, {status=0x0, info=1}, ) == 0x0
 01589   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 188, ... 184, ) == 0x0
 01590   896   NtQuerySection  (184, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01591   896   NtClose  (188, ... ) == 0x0
 01592   896   NtMapViewOfSection  (184, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 01593   896   NtClose  (184, ... ) == 0x0
 01594   896   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 01595   896   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 01596   896   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 01597   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01598   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) == 0x0
 01599   896   NtQueryInformationFile  (184, 1239140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01600   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 184, ... 188, ) == 0x0
 01601   896   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc70000), 0x0, 1191936, ) == 0x0
 01602   896   NtQueryInformationFile  (184, 1239240, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01603   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01604   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01605   896   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 01606   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01607   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 192, ) }, ... 192, ) == 0x0
 01608   896   NtQueryValueKey  (192,  (192, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (192, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01609   896   NtClose  (192, ... ) == 0x0
 01610   896   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01611   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01612   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1236836, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236836, 616, BothDirectory, 1, "frghilbd.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 01613   896   NtClose  (192, ... ) == 0x0
 01614   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01615   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01616   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\frghilbd.exe"}, 1237212, ... ) }, 1237212, ... ) == 0x0
 01617   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01618   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01619   896   NtClose  (192, ... ) == 0x0
 01620   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01621   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01622   896   NtClose  (192, ... ) == 0x0
 01623   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01624   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "frghilbd.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 01625   896   NtClose  (192, ... ) == 0x0
 01626   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01627   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01628   896   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01629   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01630   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01631   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 192, ) == 0x0
 01632   896   NtQueryInformationToken  (192, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01633   896   NtClose  (192, ... ) == 0x0
 01634   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01635   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\frghilbd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01636   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01637   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01638   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\frghilbd.exe"}, 1238464, ... ) }, 1238464, ... ) == 0x0
 01639   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01640   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01641   896   NtClose  (192, ... ) == 0x0
 01642   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01643   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01644   896   NtClose  (192, ... ) == 0x0
 01645   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01646   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "frghilbd.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 01647   896   NtClose  (192, ... ) == 0x0
 01648   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01649   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01650   896   NtWaitForSingleObject  (176, 0, {-1000000, -1}, ... ) == 0x0
 01651   896   NtQueryVolumeInformationFile  (132, 1239120, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01652   896   NtQueryInformationFile  (132, 1239100, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01653   896   NtQueryInformationFile  (132, 1239140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01654   896   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01655   896   NtUnmapViewOfSection  (-1, 0xc70000, ... ) == 0x0
 01656   896   NtClose  (188, ... ) == 0x0
 01657   896   NtClose  (184, ... ) == 0x0
 01658   896   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 01659   896   NtOpenProcessToken  (-1, 0xa, ... 184, ) == 0x0
 01660   896   NtQueryInformationToken  (184, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 01661   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01662   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01663   896   NtQueryValueKey  (188,  (188, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (188, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01664   896   NtQueryValueKey  (188,  (188, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (188, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01665   896   NtClose  (188, ... ) == 0x0
 01666   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01667   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01668   896   NtQueryValueKey  (188,  (188, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01669   896   NtClose  (188, ... ) == 0x0
 01670   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01671   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01672   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01673   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01674   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01675   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01676   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01677   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01678   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01679   896   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01680   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 188, ) }, ... 188, ) == 0x0
 01681   896   NtEnumerateKey  (188, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (188, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 01682   896   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 192, ) }, ... 192, ) == 0x0
 01683   896   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 01684   896   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01685   896   NtClose  (192, ... ) == 0x0
 01686   896   NtEnumerateKey  (188, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01687   896   NtClose  (188, ... ) == 0x0
 01688   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 188, ) }, ... 188, ) == 0x0
 01689   896   NtEnumerateKey  (188, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 01690   896   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 192, ) }, ... 192, ) == 0x0
 01691   896   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 01692   896   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01693   896   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01694   896   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01695   896   NtClose  (192, ... ) == 0x0
 01696   896   NtEnumerateKey  (188, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 01697   896   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 192, ) }, ... 192, ) == 0x0
 01698   896   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 01699   896   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01700   896   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01701   896   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01702   896   NtClose  (192, ... ) == 0x0
 01703   896   NtEnumerateKey  (188, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 01704   896   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 192, ) }, ... 192, ) == 0x0
 01705   896   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 01706   896   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01707   896   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01708   896   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01709   896   NtClose  (192, ... ) == 0x0
 01710   896   NtEnumerateKey  (188, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 01711   896   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 192, ) }, ... 192, ) == 0x0
 01712   896   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 01713   896   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01714   896   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01715   896   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01716   896   NtClose  (192, ... ) == 0x0
 01717   896   NtEnumerateKey  (188, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 01718   896   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 192, ) }, ... 192, ) == 0x0
 01719   896   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 01720   896   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01721   896   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01722   896   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01723   896   NtClose  (192, ... ) == 0x0
 01724   896   NtEnumerateKey  (188, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01725   896   NtClose  (188, ... ) == 0x0
 01726   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01727   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01728   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01729   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01730   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01731   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01732   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01733   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01734   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01735   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01736   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01737   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01738   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01739   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01740   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01741   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01742   896   NtClose  (188, ... ) == 0x0
 01743   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01744   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01745   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01746   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01747   896   NtClose  (188, ... ) == 0x0
 01748   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01749   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01750   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01751   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01752   896   NtClose  (188, ... ) == 0x0
 01753   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01754   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01755   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01756   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01757   896   NtClose  (188, ... ) == 0x0
 01758   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01759   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01760   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01761   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01762   896   NtClose  (188, ... ) == 0x0
 01763   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01764   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01765   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01766   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01767   896   NtClose  (188, ... ) == 0x0
 01768   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01769   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01770   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01771   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01772   896   NtClose  (188, ... ) == 0x0
 01773   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01774   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01775   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01776   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01777   896   NtClose  (188, ... ) == 0x0
 01778   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01779   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01780   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01781   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01782   896   NtClose  (188, ... ) == 0x0
 01783   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01784   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01785   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01786   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01787   896   NtClose  (188, ... ) == 0x0
 01788   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01789   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01790   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01791   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01792   896   NtClose  (188, ... ) == 0x0
 01793   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01794   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01795   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01796   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01797   896   NtClose  (188, ... ) == 0x0
 01798   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01799   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01800   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01801   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01802   896   NtClose  (188, ... ) == 0x0
 01803   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01804   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01805   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01806   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01807   896   NtClose  (188, ... ) == 0x0
 01808   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01809   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01810   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01811   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01812   896   NtClose  (188, ... ) == 0x0
 01813   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01814   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01815   896   NtQueryValueKey  (188,  (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 01816   896   NtClose  (188, ... ) == 0x0
 01817   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01818   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01819   896   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01820   896   NtClose  (188, ... ) == 0x0
 01821   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01822   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 01823   896   NtOpenProcessToken  (-1, 0xa, ... 188, ) == 0x0
 01824   896   NtDuplicateToken  (188, 0xc, {24, 0, 0x0, 0, 1240744, 0x0}, 0, 2, ... 192, ) == 0x0
 01825   896   NtClose  (188, ... ) == 0x0
 01826   896   NtAccessCheck  (1372608, 192, 0x1, 1240820, 1240872, 56, 1240852, ... (0x1), ) == 0x0
 01827   896   NtClose  (192, ... ) == 0x0
 01828   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 192, ) }, ... 192, ) == 0x0
 01829   896   NtQueryValueKey  (192,  (192, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (192, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01830   896   NtClose  (192, ... ) == 0x0
 01831   896   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 192, ) }, ... 192, ) == 0x0
 01832   896   NtQuerySymbolicLinkObject  (192, ...  (192, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 01833   896   NtClose  (192, ... ) == 0x0
 01834   896   NtQueryVolumeInformationFile  (132, 1238576, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01835   896   NtQueryInformationFile  (132, 1238692, 528, Name, ... {status=0x0, info=64}, ) == 0x0
 01836   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01837   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01838   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\frghilbd.exe"}, 1237864, ... ) }, 1237864, ... ) == 0x0
 01839   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01840   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01841   896   NtClose  (192, ... ) == 0x0
 01842   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01843   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01844   896   NtClose  (192, ... ) == 0x0
 01845   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01846   896   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "frghilbd.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 01847   896   NtClose  (192, ... ) == 0x0
 01848   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01849   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01850   896   NtQueryInformationFile  (132, 1240732, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01851   896   NtCreateSection  (0xf0005, 0x0, {187360, 0}, 2, 134217728, 132, ... 192, ) == 0x0
 01852   896   NtMapViewOfSection  (192, -1, (0x0), 0, 0, {0, 0}, 187360, 1, 0, 2, ... (0x3c0000), {0, 0}, 188416, ) == 0x0
 01853   896   NtClose  (192, ... ) == 0x0
 01854   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01855   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 192, ) == 0x0
 01856   896   NtQueryInformationToken  (192, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01857   896   NtClose  (192, ... ) == 0x0
 01858   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 192, ) }, ... 192, ) == 0x0
 01859   896   NtOpenKey  (0x20019, {24, 192, 0x40, 0, 0,  (0x20019, {24, 192, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 188, ) }, ... 188, ) == 0x0
 01860   896   NtClose  (192, ... ) == 0x0
 01861   896   NtQueryValueKey  (188,  (188, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01862   896   NtQueryValueKey  (188,  (188, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (188, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 01863   896   NtClose  (188, ... ) == 0x0
 01864   896   NtUnmapViewOfSection  (-1, 0x3c0000, ... ) == 0x0
 01865   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 3932160, 4096, ) == 0x0
 01866   896   NtAllocateVirtualMemory  (-1, 3932160, 0, 4096, 4096, 4, ... 3932160, 4096, ) == 0x0
 01867   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01868   896   NtQueryValueKey  (188,  (188, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01869   896   NtClose  (188, ... ) == 0x0
 01870   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01871   896   NtQueryInformationToken  (184, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 01872   896   NtQueryInformationToken  (184, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 01873   896   NtClose  (184, ... ) == 0x0
 01874   896   NtQuerySection  (172, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01875   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frghilbd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01876   896   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 01877   896   NtCreateProcessEx  (1242656, 2035711, 0, -1, 0, 172, 0, 0, 0, ... ) == 0x0
 01878   896   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffde000,AffinityMask=0x1,BasePriority=8,Pid=1120,ParentPid=1252,}, 0x0, ) == 0x0
 01879   896   NtReadVirtualMemory  (184, 0x7ffde008, 4, ...  (184, 0x7ffde008, 4, ... "\0\0B1", 0x0, ) , 0x0, ) == 0x0
 01880   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\frghilbd.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01881   896   NtAllocateVirtualMemory  (-1, 1376256, 0, 8192, 4096, 4, ... 1376256, 8192, ) == 0x0
 01882   896   NtReadVirtualMemory  (184, 0x31420000, 4096, ...  (184, 0x31420000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 01883   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01884   896   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffde000,AffinityMask=0x1,BasePriority=8,Pid=1120,ParentPid=1252,}, 0x0, ) == 0x0
 01885   896   NtAllocateVirtualMemory  (-1, 0, 0, 2432, 4096, 4, ... 3997696, 4096, ) == 0x0
 01886   896   NtAllocateVirtualMemory  (184, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 01887   896   NtWriteVirtualMemory  (184, 0x10000,  (184, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 01888   896   NtAllocateVirtualMemory  (184, 0, 0, 2432, 4096, 4, ... 131072, 4096, ) == 0x0
 01889   896   NtWriteVirtualMemory  (184, 0x20000,  (184, 0x20000, "\0\20\0\0\200\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0\26\0\10\2\220\2\0\0\0\0\0\0\364\3\366\3\230\4\0\0@\0B\0\220\10\0\0@\0B\0\324\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0@\0B\0\30\11\0\0\36\0 \0\\11\0\0\0\0\2\0|\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2432, ... 0x0, ) , 2432, ... 0x0, ) == 0x0
 01890   896   NtWriteVirtualMemory  (184, 0x7ffde010,  (184, 0x7ffde010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01891   896   NtWriteVirtualMemory  (184, 0x7ffde1e8,  (184, 0x7ffde1e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01892   896   NtFreeVirtualMemory  (-1, (0x3d0000), 0, 32768, ... (0x3d0000), 4096, ) == 0x0
 01893   896   NtAllocateVirtualMemory  (184, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 01894   896   NtAllocateVirtualMemory  (184, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 01895   896   NtProtectVirtualMemory  (184, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 01896   896   NtCreateThread  (0x1f03ff, 0x0, 184, 1242664, 1242328, 1, ... 188, {1120, 860}, ) == 0x0
 01897   896   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532}  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532} "\0\0\0\0\0\0\1\0\377\377\377\377\0\0\0\0\273\0\0\0\274\0\0\0`\4\0\0\\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\24\0\326z\202|" ... {168, 196, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\270\0\0\0\274\0\0\0`\4\0\0\\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\24\0\326z\202|" )  ... {168, 196, reply, 0, 1252, 896, 81842, 0}  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532} "\0\0\0\0\0\0\1\0\377\377\377\377\0\0\0\0\273\0\0\0\274\0\0\0`\4\0\0\\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\24\0\326z\202|" ... {168, 196, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\270\0\0\0\274\0\0\0`\4\0\0\\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\24\0\326z\202|" )  ) == 0x0
 01898   896   NtResumeThread  (188, ... 1, ) == 0x0
 01899   896   NtClose  (132, ... ) == 0x0
 01900   896   NtClose  (172, ... ) == 0x0
 01901   896   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffde000,AffinityMask=0x1,BasePriority=8,Pid=1120,ParentPid=1252,}, 0x0, ) == 0x0
 01902   896   NtUserWaitForInputIdle  (1120, 30000, 0, ...
 01903   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 172, ) == 0x0
 01904   896   NtClose  (172, ... ) == 0x0
 01902   896   NtUserWaitForInputIdle  ... ) == 0x0
 01905   896   NtClose  (184, ... ) == 0x0
 01906   896   NtClose  (188, ... ) == 0x0
 01907   896   NtDelayExecution  (0, {-5000000, -1}, ... ) == 0x0
 01908   896   NtTerminateProcess  (0, 0, ...
 00855  2016   NtWaitForMultipleObjects  ... ) == 0xc0
 01908   896   NtTerminateProcess  ... ) == 0x0
 01909   896   NtQueryVirtualMemory  (-1, 0xb26d20, Basic, 28, ... {BaseAddress=0xb26000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x3c000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01910   896   NtQueryVirtualMemory  (-1, 0xb2762c, Basic, 28, ... {BaseAddress=0xb27000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x3b000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01911   896   NtQueryVirtualMemory  (-1, 0xafcef4, Basic, 28, ... {BaseAddress=0xafc000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01912   896   NtGdiDeleteObjectApp  (2097808862, ... ) == 0x1
 01913   896   NtGdiDeleteObjectApp  (-771094889, ... ) == 0x1
 01914   896   NtGdiDeleteObjectApp  (-1022753048, ... ) == 0x1
 01915   896   NtUserDestroyCursor  (4522625, 1, ... ) == 0x1
 01916   896   NtUserDestroyCursor  (4915711, 1, ... ) == 0x1
 01917   896   NtUserDestroyCursor  (1638799, 1, ... ) == 0x1
 01918   896   NtUserDestroyCursor  (2884243, 1, ... ) == 0x1
 01919   896   NtUserDestroyCursor  (2425495, 1, ... ) == 0x1
 01920   896   NtUserDestroyCursor  (22544723, 1, ... ) == 0x1
 01921   896   NtUserDestroyCursor  (537329821, 1, ... ) == 0x1
 01922   896   NtUserFindExistingCursorIcon  (1243440, 1243456, 1243504, ... ) == 0x10011
 01923   896   NtDeleteAtom  (49194, ... ) == 0x0
 01924   896   NtDeleteAtom  (49193, ... ) == 0x0
 01925   896   NtGdiDeleteObjectApp  (1678247318, ... ) == 0x1
 01926   896   NtClose  (128, ... ) == 0x0
 01927   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x9,}, 4, ... ) == 0x0
 01928   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 01929   896   NtUserGetAtomName  (49211, 1243528, ... ) == 0xf
 01930   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01931   896   NtUserGetAtomName  (49213, 1243528, ... ) == 0xd
 01932   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01933   896   NtUserGetAtomName  (49215, 1243528, ... ) == 0x10
 01934   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01935   896   NtUserGetAtomName  (49217, 1243528, ... ) == 0x12
 01936   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01937   896   NtUserGetAtomName  (49219, 1243528, ... ) == 0xd
 01938   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01939   896   NtUserGetAtomName  (49221, 1243528, ... ) == 0xb
 01940   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01941   896   NtUserGetAtomName  (49223, 1243528, ... ) == 0xf
 01942   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01943   896   NtUserGetAtomName  (49225, 1243528, ... ) == 0xd
 01944   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01945   896   NtUserGetAtomName  (49227, 1243528, ... ) == 0x11
 01946   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01947   896   NtUserGetAtomName  (49229, 1243528, ... ) == 0xf
 01948   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01949   896   NtUserGetAtomName  (49231, 1243528, ... ) == 0x11
 01950   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01951   896   NtUserGetAtomName  (49233, 1243528, ... ) == 0xf
 01952   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01953   896   NtUserGetAtomName  (49235, 1243528, ... ) == 0xc
 01954   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01955   896   NtUserGetAtomName  (49237, 1243520, ... ) == 0xd
 01956   896   NtUserUnregisterClass  (1243580, 1560870912, 1243568, ... ) == 0x1
 01957   896   NtUserGetAtomName  (49239, 1243520, ... ) == 0x11
 01958   896   NtUserUnregisterClass  (1243580, 1560870912, 1243568, ... ) == 0x1
 01959   896   NtUserGetAtomName  (49241, 1243528, ... ) == 0xc
 01960   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01961   896   NtUserGetAtomName  (49243, 1243528, ... ) == 0xe
 01962   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01963   896   NtUserGetAtomName  (49245, 1243528, ... ) == 0x8
 01964   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01965   896   NtUserGetAtomName  (49247, 1243528, ... ) == 0xd
 01966   896   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01967   896   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 01968   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0
 01969   896   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 65536, ) == 0x0
 01970   896   NtUserGetAtomName  (49211, 1243560, ... ) == 0xf
 01971   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01972   896   NtUserGetAtomName  (49213, 1243560, ... ) == 0xd
 01973   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01974   896   NtUserGetAtomName  (49215, 1243560, ... ) == 0x10
 01975   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01976   896   NtUserGetAtomName  (49217, 1243560, ... ) == 0x12
 01977   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01978   896   NtUserGetAtomName  (49219, 1243560, ... ) == 0xd
 01979   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01980   896   NtUserGetAtomName  (49221, 1243560, ... ) == 0xb
 01981   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01982   896   NtUserGetAtomName  (49223, 1243560, ... ) == 0xf
 01983   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01984   896   NtUserGetAtomName  (49225, 1243560, ... ) == 0xd
 01985   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01986   896   NtUserGetAtomName  (49227, 1243560, ... ) == 0x11
 01987   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01988   896   NtUserGetAtomName  (49229, 1243560, ... ) == 0xf
 01989   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01990   896   NtUserGetAtomName  (49231, 1243560, ... ) == 0x11
 01991   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01992   896   NtUserGetAtomName  (49233, 1243560, ... ) == 0xf
 01993   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01994   896   NtUserGetAtomName  (49235, 1243560, ... ) == 0xc
 01995   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01996   896   NtUserGetAtomName  (49237, 1243552, ... ) == 0xd
 01997   896   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 01998   896   NtUserGetAtomName  (49239, 1243552, ... ) == 0x11
 01999   896   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 02000   896   NtUserGetAtomName  (49241, 1243560, ... ) == 0xc
 02001   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02002   896   NtUserGetAtomName  (49243, 1243560, ... ) == 0xe
 02003   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02004   896   NtUserGetAtomName  (49245, 1243560, ... ) == 0x8
 02005   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02006   896   NtUserGetAtomName  (49247, 1243560, ... ) == 0xd
 02007   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02008   896   NtUserGetAtomName  (49175, 1243560, ... ) == 0x6
 02009   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02010   896   NtUserGetAtomName  (49177, 1243560, ... ) == 0x6
 02011   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02012   896   NtUserGetAtomName  (49176, 1243560, ... ) == 0x4
 02013   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02014   896   NtUserGetAtomName  (49178, 1243560, ... ) == 0x7
 02015   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02016   896   NtUserGetAtomName  (49180, 1243560, ... ) == 0x8
 02017   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02018   896   NtUserGetAtomName  (49182, 1243560, ... ) == 0x9
 02019   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02020   896   NtUserGetAtomName  (49179, 1243552, ... ) == 0x9
 02021   896   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 02022   896   NtUserGetAtomName  (49256, 1243560, ... ) == 0x7
 02023   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02024   896   NtUserGetAtomName  (49258, 1243560, ... ) == 0xd
 02025   896   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 02026   896   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 02027   896   NtDeviceIoControlFile  (56, 60, 0x0, 0x12facc, 0x22415c,  (56, 60, 0x0, 0x12facc, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (56, 60, 0x0, 0x12facc, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , ) == 0x0
 02028   896   NtDeviceIoControlFile  (56, 60, 0x0, 0x12fa94, 0x228168,  (56, 60, 0x0, 0x12fa94, 0x228168, "@\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 02029   896   NtDeviceIoControlFile  (56, 60, 0x0, 0x12facc, 0x22415c,  (56, 60, 0x0, 0x12facc, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (56, 60, 0x0, 0x12facc, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , ) == 0x0
 02030   896   NtDeviceIoControlFile  (56, 60, 0x0, 0x12fa94, 0x228168,  (56, 60, 0x0, 0x12fa94, 0x228168, "\\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 02031   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 02032   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 02033   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0
 02034   896   NtClose  (48, ... ) == 0x0
 02035   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 48, ) }, ... 48, ) == 0x0
 02036   896   NtQueryValueKey  (48,  (48, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02037   896   NtClose  (48, ... ) == 0x0
 02038   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 02039   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 02040   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02041   896   NtClose  (124, ... ) == 0x0
 02042   896   NtClose  (56, ... ) == 0x0
 02043   896   NtFreeVirtualMemory  (-1, (0x3c0000), 4096, 32768, ... (0x3c0000), 4096, ) == 0x0
 02044   896   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0}  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 1252, 896, 81879, 0}  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02045   896   NtTerminateProcess  (-1, 0, ...