Summary:


NtCallbackReturn(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtUserDestroyCursor(>) 
 7 
NtQueryInformationProcess(>) 
 21 

NtConnectPort(>) 
 1 
NtReadVirtualMemory(>) 
 2 
NtUserSetCursorIconData(>) 
 7 
NtUserRegisterWindowMessage(>) 
 21 

NtCreateMutant(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 2 
NtGdiCreateBitmap(>) 
 8 
NtCreateEvent(>) 
 22 

NtCreateProcessEx(>) 
 1 
NtResumeThread(>) 
 2 
NtSetEvent(>) 
 8 
NtWriteFile(>) 
 24 

NtEnumerateValueKey(>) 
 1 
NtSetEventBoostPriority(>) 
 2 
NtCreateKey(>) 
 9 
NtReadFile(>) 
 26 

NtGdiCreatePaletteInternal(>) 
 1 
NtTestAlert(>) 
 2 
NtCreateSemaphore(>) 
 9 
NtQueryDirectoryFile(>) 
 27 

NtGdiInit(>) 
 1 
NtUserQueryWindow(>) 
 2 
NtOpenMutant(>) 
 9 
NtOpenProcessTokenEx(>) 
 28 

NtGdiQueryFontAssocInfo(>) 
 1 
NtAddAtom(>) 
 3 
NtOpenProcessToken(>) 
 9 
NtOpenThreadTokenEx(>) 
 28 

NtOpenKeyedEvent(>) 
 1 
NtClearEvent(>) 
 3 
NtQueryVolumeInformationFile(>) 
 9 
NtFreeVirtualMemory(>) 
 31 

NtQueryEvent(>) 
 1 
NtDuplicateObject(>) 
 3 
NtSetInformationProcess(>) 
 9 
NtCreateFile(>) 
 32 

NtQueryInformationJobObject(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtGdiCreateCompatibleDC(>) 
 10 
NtQueryInformationToken(>) 
 35 

NtQueryInformationThread(>) 
 1 
NtNotifyChangeKey(>) 
 3 
NtGdiExtGetObjectW(>) 
 10 
NtOpenSection(>) 
 36 

NtQueryInstallUILanguage(>) 
 1 
NtReleaseSemaphore(>) 
 3 
NtQueryDefaultUILanguage(>) 
 10 
NtQuerySystemInformation(>) 
 43 

NtQueryObject(>) 
 1 
NtSetInformationObject(>) 
 3 
NtReleaseMutant(>) 
 10 
NtUserGetAtomName(>) 
 47 

NtSecureConnectPort(>) 
 1 
NtTerminateProcess(>) 
 3 
NtSetInformationThread(>) 
 10 
NtUserUnregisterClass(>) 
 47 

NtUserCallNoParam(>) 
 1 
NtWaitForMultipleObjects(>) 
 3 
NtUserGetDC(>) 
 11 
NtMapViewOfSection(>) 
 55 

NtUserEnumDisplayMonitors(>) 
 1 
NtContinue(>) 
 4 
NtEnumerateKey(>) 
 12 
NtOpenFile(>) 
 55 

NtUserGetKeyboardLayoutList(>) 
 1 
NtQueryPerformanceCounter(>) 
 4 
NtRequestWaitReplyPort(>) 
 13 
NtGdiSelectBitmap(>) 
 57 

NtUserGetThreadDesktop(>) 
 1 
NtSetValueKey(>) 
 4 
NtUserSelectPalette(>) 
 14 
NtQueryVirtualMemory(>) 
 61 

NtUserSetWindowsHookEx(>) 
 1 
NtWriteVirtualMemory(>) 
 4 
NtUserSystemParametersInfo(>) 
 14 
NtUserRegisterClassExWOW(>) 
 61 

NtCreateThread(>) 
 2 
NtAccessCheck(>) 
 5 
NtQuerySection(>) 
 15 
NtUserFindExistingCursorIcon(>) 
 74 

NtDelayExecution(>) 
 2 
NtOpenThreadToken(>) 
 6 
NtUnmapViewOfSection(>) 
 16 
NtQueryAttributesFile(>) 
 75 

NtDeleteAtom(>) 
 2 
NtGdiBitBlt(>) 
 7 
NtQueryDebugFilterState(>) 
 17 
NtCreateSection(>) 
 78 

NtDuplicateToken(>) 
 2 
NtGdiCreateDIBitmapInternal(>) 
 7 
NtQueryDefaultLocale(>) 
 17 
NtFlushInstructionCache(>) 
 120 

NtFsControlFile(>) 
 2 
NtGdiGetDCObject(>) 
 7 
NtSetInformationFile(>) 
 17 
NtAllocateVirtualMemory(>) 
 130 

NtGdiCreateSolidBrush(>) 
 2 
NtGdiGetDCforBitmap(>) 
 7 
NtDeviceIoControlFile(>) 
 18 
NtProtectVirtualMemory(>) 
 246 

NtOpenDirectoryObject(>) 
 2 
NtGdiGetStockObject(>) 
 7 
NtGdiDeleteObjectApp(>) 
 18 
NtOpenKey(>) 
 295 

NtOpenEvent(>) 
 2 
NtGdiRestoreDC(>) 
 7 
NtQueryInformationFile(>) 
 19 
NtQueryValueKey(>) 
 373 

NtOpenProcess(>) 
 2 
NtGdiSaveDC(>) 
 7 
NtUserCallOneParam(>) 
 20 
NtClose(>) 
 443 

NtOpenSymbolicLinkObject(>) 
 2 
NtGdiSetDIBitsToDeviceInternal(>) 
 7 
NtWaitForSingleObject(>) 
 20 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482756, {status=0x0, info=1}, ) }, 0, 32, ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482756, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482756, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482756, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482756, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482756, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482756, 0, 0x0, 0x0, 0x90120,  (-2147482756, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00059   896   NtClose  (-2147482104, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482592, ) == 0x0
 00061   896   NtClose  (-2147482592, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482592, ... -2147481624, ) == 0x0
 00063   896   NtClose  (-2147481624, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481624, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147482104, ... ) == 0x0
 00105   896   NtClose  (-2147482592, ... ) == 0x0
 00106   896   NtClose  (-2147481624, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481624, ) == 0x0
 00145   896   NtClose  (-2147481624, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481624, ... -2147482592, ) == 0x0
 00147   896   NtClose  (-2147482592, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482592, ... -2147482104, ) == 0x0
 00149   896   NtClose  (-2147482104, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482104, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481624, ... ) == 0x0
 00178   896   NtClose  (-2147482592, ... ) == 0x0
 00179   896   NtClose  (-2147482104, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482756, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x47c000), 8192, 4, ... (0x47c000), 8192, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x47c000), 8192, 128, ... (0x47c000), 8192, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4702208, 8192, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00251   896   NtReadFile  (16, 0, 0, 0, 4, {278784, 0}, 0, ... {status=0x0, info=4},  (16, 0, 0, 0, 4, {278784, 0}, 0, ... {status=0x0, info=4}, "+\272K\0", ) , ) == 0x0
 00252   896   NtClose  (16, ... ) == 0x0
 00253   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00254   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00255   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00258   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00259   896   NtClose  (16, ... ) == 0x0
 00260   896   NtTestAlert  (... ) == 0x0
 00261   896   NtContinue  (1244464, 1, ...
 00262   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x47e000,}, 4, ... ) == 0x0
 00263   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00264   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   896   NtClose  (16, ... ) == 0x0
 00266   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00267   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00268   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00269   896   NtClose  (16, ... ) == 0x0
 00270   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00271   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00272   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00273   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00274   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00275   896   NtClose  (16, ... ) == 0x0
 00276   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00277   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00278   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00283   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00284   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00285   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00286   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00287   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00288   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00289   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00290   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00291   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00292   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00293   896   NtQueryValueKey  (16,  (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00294   896   NtClose  (16, ... ) == 0x0
 00295   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 16, ) }, ... 16, ) == 0x0
 00296   896   NtQueryValueKey  (16,  (16, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00297   896   NtClose  (16, ... ) == 0x0
 00298   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 16, ) }, ... 16, ) == 0x0
 00299   896   NtSetInformationObject  (16, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00300   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00301   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00302   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00303   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00304   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 28, ) == 0x0
 00305   896   NtQueryInformationToken  (28, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00306   896   NtClose  (28, ... ) == 0x0
 00307   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 28, ) }, ... 28, ) == 0x0
 00308   896   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00309   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 32, ) }, ... 32, ) == 0x0
 00310   896   NtQueryValueKey  (32,  (32, "PINF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00311   896   NtClose  (32, ... ) == 0x0
 00312   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00313   896   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00314   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1234112,  (0x80100080, {24, 0, 0x40, 0, 1234112, "\??\u:\work\packed.exe"}, 0x0, 1, 1, 1, 96, 0, 0, ... 32, {status=0x0, info=1}, ) }, 0x0, 1, 1, 1, 96, 0, 0, ... 32, {status=0x0, info=1}, ) == 0x0
 00315   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00316   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp"}, 1233816, ... ) }, 1233816, ... ) == 0x0
 00317   896   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\250C\24\0\321\207\0\0\2\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81834, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\321\207\0\0\3\0\0\0" )  ... {20, 48, reply, 0, 1252, 896, 81834, 0}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\250C\24\0\321\207\0\0\2\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81834, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\321\207\0\0\3\0\0\0" )  ) == 0x0
 00318   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233824,  (0x80100080, {24, 0, 0x40, 0, 1233824, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.tmp"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 00319   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00320   896   NtClose  (-2147482756, ... ) == 0x0
 00321   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00322   896   NtClose  (-2147482756, ... ) == 0x0
 00323   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00324   896   NtClose  (-2147482756, ... ) == 0x0
 00318   896   NtCreateFile  ... 36, {status=0x0, info=2}, ) == 0x0
 00325   896   NtClose  (36, ... ) == 0x0
 00326   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234112,  (0xc0100080, {24, 0, 0x40, 0, 1234112, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.tmp"}, 0x0, 128, 1, 5, 96, 0, 0, ... }, 0x0, 128, 1, 5, 96, 0, 0, ...
 00327   896   NtClose  (-2147482756, ... ) == 0x0
 00328   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00329   896   NtClose  (-2147482756, ... ) == 0x0
 00330   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00331   896   NtClose  (-2147482756, ... ) == 0x0
 00332   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00333   896   NtClose  (-2147482756, ... ) == 0x0
 00326   896   NtCreateFile  ... 36, {status=0x0, info=3}, ) == 0x0
 00334   896   NtSetInformationFile  (32, 1234204, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00335   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "f\340\33\0)\272K\0/\272D\0\324EK\0\223\272K\0+\272K\0k\272Q\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\270K\0\221\252K\164\16B\315\12\2JL\346\233\333\220\177\322"s\13\3129oL\310*m\13\327>s_\232)e\13\310>n\13\317%dN\310kWB\324x2&\260o7+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0", ) s\13\3129oL\310*m\13\327>s_\232)e\13\310>n\13\317%dN\310kWB\324x2&\260o7+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0+\272K\0", ) == 0x0
 00336   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "MZP\0\2\0\0\0\4\0\17\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\32\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 10240, 0x0, 0, ... , 10240, 0x0, 0, ...
 00337   896   NtContinue  (-142418476, 0, ...
 00336   896   NtWriteFile  ... {status=0x0, info=10240}, ) == 0x0
 00338   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "'E[\377?E\347\3r\373\14U\237q]Y\346\273\26\364(\362$<\14\263P^g\367\36oY\303{\11\35\246w\260F\247@\230\273\245\244l\324\351\221\361\276\373{(A\376!\302\257\200PbW\30\344?J\26\365\16o\11\343\310\353\334\300P\362\346\17\252*8\376/G*\247U\3077l\355*\370\12\241\71\213\275?\204\276u\33\22213N\232\30R\323\201\336A[>\240^\31\256wj\307\226\12\356\6\234gnS\277i\312~\2722\3509\10\300\7\270G0%7\322\217""\246\245\222\313\342\32\27\23\342\7\2203,'\25\223v\215\332O\223S\2239B4C\357^[I\317\274#O~\22\245<.oRc\347\262\261\202\323\216$6\12a\33d\333\342u68>*\31l[\314l^\344\203\310xv\266\320;\249\360!^\237\240k\261V`\371\320I"*KJ\21\250\353\207\234.T\310\33\347|Kg\2l\2330\202\221\327S\5\240\13Wn\264\242\1\36\216\237\220\261`\207I>\277f\314\17\250k_\376\34\207@\22^\307\343\203\26g\271k\261\213\264%\356+\24\3578\34\24\330\254\26\3W\2'\301C\32ME\233\7\206\316\203\33s\203S\342&0k\222\223\21\305\360\23fw\14\333\34\343\232\25\24\324E\301\326\233\30\35\37\273\252V\313j\202\32l\235\2364\212\362V\306M\307I\33\33h\14\355\274i\231\243y\303\15\2\263\26^m\344s\261\300\11\223a>\2)\242/\233\247\22\302Bs\264\35\204\217\\330\\314\375I%k\350\16\3p\17#\3764\274o\360l\334\10\273 \372\37y\235\216J\262>\320\373\17\237lQB\352\252\3767\7Awij\226\334\345M\300s\213f\373\16\334\367\265\305\266\311\3A\252j\376\234 \342\233\227Y", )  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "'E[\377?E\347\3r\373\14U\237q]Y\346\273\26\364(\362$<\14\263P^g\367\36oY\303{\11\35\246w\260F\247@\230\273\245\244l\324\351\221\361\276\373{(A\376!\302\257\200PbW\30\344?J\26\365\16o\11\343\310\353\334\300P\362\346\17\252*8\376/G*\247U\3077l\355*\370\12\241\71\213\275?\204\276u\33\22213N\232\30R\323\201\336A[>\240^\31\256wj\307\226\12\356\6\234gnS\277i\312~\2722\3509\10\300\7\270G0%7\322\217""\246\245\222\313\342\32\27\23\342\7\2203,'\25\223v\215\332O\223S\2239B4C\357^[I\317\274#O~\22\245<.oRc\347\262\261\202\323\216$6\12a\33d\333\342u68>*\31l[\314l^\344\203\310xv\266\320;\249\360!^\237\240k\261V`\371\320I"*KJ\21\250\353\207\234.T\310\33\347|Kg\2l\2330\202\221\327S\5\240\13Wn\264\242\1\36\216\237\220\261`\207I>\277f\314\17\250k_\376\34\207@\22^\307\343\203\26g\271k\261\213\264%\356+\24\3578\34\24\330\254\26\3W\2'\301C\32ME\233\7\206\316\203\33s\203S\342&0k\222\223\21\305\360\23fw\14\333\34\343\232\25\24\324E\301\326\233\30\35\37\273\252V\313j\202\32l\235\2364\212\362V\306M\307I\33\33h\14\355\274i\231\243y\303\15\2\263\26^m\344s\261\300\11\223a>\2)\242/\233\247\22\302Bs\264\35\204\217\\330\\314\375I%k\350\16\3p\17#\3764\274o\360l\334\10\273 \372\37y\235\216J\262>\320\373\17\237lQB\352\252\3767\7Awij\226\334\345M\300s\213f\373\16\334\367\265\305\266\311\3A\252j\376\234 \342\233\227Y", ) *KJ\21\250\353\207\234.T\310\33\347|Kg\2l\2330\202\221\327S\5\240\13Wn\264\242\1\36\216\237\220\261`\207I>\277f\314\17\250k_\376\34\207@\22^\307\343\203\26g\271k\261\213\264%\356+\24\3578\34\24\330\254\26\3W\2'\301C\32ME\233\7\206\316\203\33s\203S\342&0k\222\223\21\305\360\23fw\14\333\34\343\232\25\24\324E\301\326\233\30\35\37\273\252V\313j\202\32l\235\2364\212\362V\306M\307I\33\33h\14\355\274i\231\243y\303\15\2\263\26^m\344s\261\300\11\223a>\2)\242/\233\247\22\302Bs\264\35\204\217\\330\\314\375I%k\350\16\3p\17#\3764\274o\360l\334\10\273 \372\37y\235\216J\262>\320\373\17\237lQB\352\252\3767\7Awij\226\334\345M\300s\213f\373\16\334\367\265\305\266\311\3A\252j\376\234 \342\233\227Y", ) == 0x0
 00339   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\14\377\20\377\24\377\254\3YAGU\264\313\26Y\315\1]\364\3Ho<'\11\33^LMUory0\116\34<\260m\35\13\230\220\37\357l\377S\332\361\225A0(jDj\302\204:\33b|\242\257?a\254\276\16D\263\250\310\300f\213P\331\D\252\1\202\265/l\220\354U\354\215'\355\1BA\241,\213\300\275\24>\365u0(z3e SR\370;\225Ap\204\353^2\24\312U\0y\350\22\262\213\7\223\375{%\34h\304"\11\34\356\222\340XQ\278XL\220\30\226l\25\270\314\306\332d)\30\223\22\370\177C\304\344\20I\344\6hOU\250\356<\5\325\31c\314\10\372\202\3704o6!\333Pd\360X>6\23\204a\31G\341\207lu^\310\310S\314\375\320\20\256r\360\12\344\324\240@\13\35`\322j\2"\1\361\1\21\203Q\314\234\5\356\203\33\314\306\0g)\326\3200\251+\234S.\32@WE\16\351\154\324\220\232\332\314I\25\5-\314$\22 _\325\246\314@9\344\214\343\250\254,\271@\13\300\264\16T`\24\304\202W\24\363\26]\3|\270l\301h\240\6E\260\275\315\316\250\2418\203xXm0@(\330\21\356JXf\\266\220\34\310 ^\24\377\377\212\326\260\242V\37\220\20\35\313A8Ql\266$\177\212\331\354\215M\354\363P\33C\266\246\274B#\350y\350\267I\263=\344&\344X\13\213\11\270\333u\2\2\30d\233\214\250\211BX\16V\204\244\346\223\\347G\2%@RE\3[\265h\376\37\6$\360GfC\273\13@Ty\2664\1\262\25j\260\17\264\326\32B\301\20\2657,\373350\22\262\213\7\223\375{%\34h\304 (36, 0, 0, 0, "\14\377\20\377\24\377\254\3YAGU\264\313\26Y\315\1]\364\3Ho<'\11\33^LMUory0\116\34<\260m\35\13\230\220\37\357l\377S\332\361\225A0(jDj\302\204:\33b|\242\257?a\254\276\16D\263\250\310\300f\213P\331\D\252\1\202\265/l\220\354U\354\215'\355\1BA\241,\213\300\275\24>\365u0(z3e SR\370;\225Ap\204\353^2\24\312U\0y\350\22\262\213\7\223\375{%\34h\304"\11\34\356\222\340XQ\278XL\220\30\226l\25\270\314\306\332d)\30\223\22\370\177C\304\344\20I\344\6hOU\250\356<\5\325\31c\314\10\372\202\3704o6!\333Pd\360X>6\23\204a\31G\341\207lu^\310\310S\314\375\320\20\256r\360\12\344\324\240@\13\35`\322j\2"\1\361\1\21\203Q\314\234\5\356\203\33\314\306\0g)\326\3200\251+\234S.\32@WE\16\351\154\324\220\232\332\314I\25\5-\314$\22 _\325\246\314@9\344\214\343\250\254,\271@\13\300\264\16T`\24\304\202W\24\363\26]\3|\270l\301h\240\6E\260\275\315\316\250\2418\203xXm0@(\330\21\356JXf\\266\220\34\310 ^\24\377\377\212\326\260\242V\37\220\20\35\313A8Ql\266$\177\212\331\354\215M\354\363P\33C\266\246\274B#\350y\350\267I\263=\344&\344X\13\213\11\270\333u\2\2\30d\233\214\250\211BX\16V\204\244\346\223\\347G\2%@RE\3[\265h\376\37\6$\360GfC\273\13@Ty\2664\1\262\25j\260\17\264\326\32B\301\20\2657,\3731\361\1\21\203Q\314\234\5\356\203\33\314\306\0g)\326\3200\251+\234S.\32@WE\16\351\154\324\220\232\332\314I\25\5-\314$\22 _\325\246\314@9\344\214\343\250\254,\271@\13\300\264\16T`\24\304\202W\24\363\26]\3|\270l\301h\240\6E\260\275\315\316\250\2418\203xXm0@(\330\21\356JXf\\266\220\34\310 ^\24\377\377\212\326\260\242V\37\220\20\35\313A8Ql\266$\177\212\331\354\215M\354\363P\33C\266\246\274B#\350y\350\267I\263=\344&\344X\13\213\11\270\333u\2\2\30d\233\214\250\211BX\16V\204\244\346\223\\347G\2%@RE\3[\265h\376\37\6$\360GfC\273\13@Ty\2664\1\262\25j\260\17\264\326\32B\301\20\2657,\373227\345fz8\213MAE\334\334\17\216\266\342\271\12\252AD\327 \311!\334Y", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00340   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "`\331\37P\7='#I\256}dK\10W\262\247\320jlCp9\310\31\310Gt[\37h\31\7q1|\36\362n\20\270\302\10\202d\231S\177\256$\326\244\217\266\211\25%\1\2709\201\376I\361\237\352r\34\251M\213+\240\360\372\305\252\4\244\31q\213\24\11O\200\24\275\220\2\360\24\310\321d\273\374\17\331\360[z\313\5[\301,Dyr \315F\17\224sH\\242\341\376<\354E\232\216\245\347\260_\203\203J\301\241\273\313\373)\310A~,\276\353\332\305b9\2-\311T\23X\252OA\232\373_e\256\237\205\262\236l\4_H\205G\5\324\35\20\350\334I\224\327", ) , ) == 0x0
 00341   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "KcTP,\207l#b\246d`\262\34\262\214j!lh\312r\3102r\14tp\245#\31,\313z|5H%\20\223xC\202O#\30\177\205\236\235\244\244\14\302\25\16\273\3639\252D\2\361\264P9\34\202\367\300+\213\2069\232\203Ha@o*\201\246\377\357\276(\212G\10:\320t9\366F\2733\230U\223\252]\334W\4\371\331\212\272n\4F4\363F\37\306m\205(p\2700\24\5\14N\30z\10.JV0v\254\346\33\366\330\27\13\200K@X\303\13\34\227<\254\272\263\264\303k\270q\224X\217\344%\270x\224\1\367\14p\301\277\344Fals\207Sw\313 \37True\1.\31\322\212D$x\253P\26D\20\27%.\364[w;1\311\212HCD\10_\342\377\27\272\0\10\215u\17\213|\10\71\300\212\16;J\374u\275\365\13\335\216\\12\362\34\16\366\303\337\237Iu\361\21\177\333Z\371\27@$\16\19\370~\335*=+h\304;\2008'\301Wj\330\373\3022\6d\376\270\367\267\333_\257\211\321\11a\13\212G\212*\201\341\377\337\1777x)w\333\212Xc\224\212^\12l|\36\377\302\255\251\13\26\30\217\36\159X\32\200\347\3379\313\1\372\366\6\374\267\0O\21\30\33u\354\261\366\366v\33 \227\353\310?\200\345\337:\32\353\342\35|[\340\366\212l\32\221l\30B\305\222\347Ku\360\321\177\341\4\217\243:\213?\263\4\200?\7\333\2\333\256\203\321O\1\267\17\362J\20z\340\277\20\301\7\3762r\13w\15\17\277\311\3\\211[\265<\307\377\321\216\216]\373_\2509\1\301\212\1\200\373\2r\12~\7\4\240\332\356\330r\2\6s\37\23s\20\4A\261A\24e\205%\316\262\265\326O_c?\14\5\377\247[\350\367\363\337\327", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00342   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\2430\306\225\25\22\263\367\347_\303\263Z\220\21302\346\330&\253}I\212\244\314\300\316\257\200,\10\243\276\22,\212\30\11?\254\30\344\352\17K?cy\236I4\365 \272U#\350~\210\247\377\7t>\203_\214\241\266\234m:K\311\6z\260\266\200\32\26V\13\\256\330\212~A{\266\335<\Qn\314~\201\16\334\212i\317\213\214xi\346=\214\7\270X\204\251\240\354\232\257\261\263\26\253\301~\266[#\341\26\2\207\36\226\253,?\20\250\370#Yk\211l{\246\277_!\270\\210\302\15\364I\377M\33\2274M\35!K\366hk\364>\260s\364\373pI\5@\262[\326\6c\217\337/\220$\0\20\352w2#\313s/\7\315w\207\247\246y8\27\202wby\16o8\214\302\373\2359]pwp\264\337\36\367C\317\341*\257\17\233#\300j\340)\320M,\356\331\3527\221}\35\272\335x[\360z7#A\212\240\235\310\317\200\260\4\35\346\331X\333QW\30\213\230\6\273`\271~Dk\335\14\365\277\26\322L\16\376\\354f`O\365\223\353\1\253\267\243\350y\351\26\365\307@`\277\32\302\326\34\243\1O\272\376\251\20\233[\26\25#\246=)m\230\12\364h0Y\20@*K\16\337\340$\21\323\273\5`AJ\347U\5\30\331\0\253\276O(\265*\354\1<\272\277\202N\376@'(\257\357\11\214R\323l\214\340j\363AOM\360\36\23\243\234\307iJ\32+M\13\370\267\351<~\36\326\35a\303\305[\377_Q\270\371B\36\351{\265Up\337ue\311>~\17f\334}I \232\367\374\11~\307|b\325Qe\16h\16\356\210'z\214w]\227\226s&lC\260", ) , ) == 0x0
 00343   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\210\212\215\225>\250\370\367\314\345\210\263q*\3000\31\\223&\200\307\2\212\217v\213\316\204:g\10\210\4Y,\241\242B?\207\242\257\352$\361tcR$\24\336\232\361U\10R5\210\214ELt\259\24\214\212\14\327m\21\361\202\6Q\12\375\2001\254\35\13w\24\223\212U\3730\266\366\206\27QEv5\201%f\301i\3441\307xB\v\214,\2\23\204\202\32\247\232\204\13\370\26\200{5\266p\231\252\26)=U\226\200\226t\20\203BhY@3'{\215\5\24!\223\346\303\302&N\2\377f\241\3344f\247jK\335\322 \364\25\128\364\320\312\2\5k\10\20\326-\331\304\337\4*o\0;P<2\10q8/,w<\207\214\3428<8A\364C\212\22\20k\220\0\16\364Zo\21\370\1N`j\360\254U.\242\222\0\200\4\4(\236\220\247\1\27\0\364\202eD\13'\3\25\244\11\247\350\230l\247Z!\363j\365\6\3605\251\350\234\354\323\1\32\0\367@\370\234Sw~5lVa\350\177\20\37\34\345\32\270\322\370U\351P\17\36p\364\317.\311\25\304Df\367\307\2 \261M\267\11U}7b\376\353.\16C\264\245\210\14\300\307wv-\335s\15\326\10\260", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) A\364C\212\22\20k\220\0\16\364Zo\21\370\1N`j\360\254U.\242\222\0\200\4\4(\236\220\247\1\27\0\364\202eD\13'\3\25\244\11\247\350\230l\247Z!\363j\365\6\3605\251\350\234\354\323\1\32\0\367@\370\234Sw~5lVa\350\177\20\37\34\345\32\270\322\370U\351P\17\36p\364\317.\311\25\304Df\367\307\2 \261M\267\11U}7b\376\353.\16C\264\245\210\14\300\307wv-\335s\15\326\10\260", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00344   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\243\2151w\163\23&\l\306p3\270|v\35}A\2117s\304\331cMY\13\13\262\35\2339\3570\263\352\327F\346PzvK\3606!\34\367fc\7\221\24\361\25\243\270O\307v\272\365o\375\244v\250[\200-\37'\254R\214\346NV\374a\350\166\201\20KUt1\341\247\371*\202__y\311@\230\245\34C\16\301\372\350\232\326\3218\300\231%\5\233\347]{\353\327FPY\247X^\231\347\247\353\26\13\361\370\254a;\356;\316BF#\34l\25\367y\247\303\200\303\271lO\17\254\252\275\236\261\300k\3G|*\203\317\231"\4=\2649\331\7F'\363\237q|\304\32\300"\351p\237^\363*\17\312u\357;n:>>\177\314\177J+\222\333\265\177y\213\250\12L\241\4\21\310^2\201\333\276p&\322\352jK\357'\360\244\21\202H{\212\275\236Y\365\233d\233\267\327\214\30\324\331o\257a\376\33\253N\241\31F\210\223a v~z\5\232SUd\313\376\352r Z,\352\257%;U\2568[\377\257d\340\270\225\27\154E#f|\273\205K3_j\10\321\13\302o\216v@(\12Z\333\246\34Ir>\300\271\14\317Qk]\2746J\343i1!h\355\37\2\14r]\271\22\313\331I\322\273^9PEZG\362.\277\220\11Z\371\17\254'\223\12\347\201?2\325:\22\12\262Z|S\363\301zw\215\253\367*\260\326\302\261\337\305G\226x\306\35\242\350\264S\13c\310\34\32\311K\201\240\27\3419\201=\274\20\262\332s]\314\2Y\12\11\302\372\350p\22>\353`\355\311S\2j)s\360\3\0+\330*\361\10s(\205s\263&S\300\350\252J\254n\233\11C\301\24\304\24\317;+\201\234", ) \4=\2649\331\7F'\363\237q|\304\32\300 (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\243\2151w\163\23&\l\306p3\270|v\35}A\2117s\304\331cMY\13\13\262\35\2339\3570\263\352\327F\346PzvK\3606!\34\367fc\7\221\24\361\25\243\270O\307v\272\365o\375\244v\250[\200-\37'\254R\214\346NV\374a\350\166\201\20KUt1\341\247\371*\202__y\311@\230\245\34C\16\301\372\350\232\326\3218\300\231%\5\233\347]{\353\327FPY\247X^\231\347\247\353\26\13\361\370\254a;\356;\316BF#\34l\25\367y\247\303\200\303\271lO\17\254\252\275\236\261\300k\3G|*\203\317\231"\4=\2649\331\7F'\363\237q|\304\32\300"\351p\237^\363*\17\312u\357;n:>>\177\314\177J+\222\333\265\177y\213\250\12L\241\4\21\310^2\201\333\276p&\322\352jK\357'\360\244\21\202H{\212\275\236Y\365\233d\233\267\327\214\30\324\331o\257a\376\33\253N\241\31F\210\223a v~z\5\232SUd\313\376\352r Z,\352\257%;U\2568[\377\257d\340\270\225\27\154E#f|\273\205K3_j\10\321\13\302o\216v@(\12Z\333\246\34Ir>\300\271\14\317Qk]\2746J\343i1!h\355\37\2\14r]\271\22\313\331I\322\273^9PEZG\362.\277\220\11Z\371\17\254'\223\12\347\201?2\325:\22\12\262Z|S\363\301zw\215\253\367*\260\326\302\261\337\305G\226x\306\35\242\350\264S\13c\310\34\32\311K\201\240\27\3419\201=\274\20\262\332s]\314\2Y\12\11\302\372\350p\22>\353`\355\311S\2j)s\360\3\0+\330*\361\10s(\205s\263&S\300\350\252J\254n\233\11C\301\24\304\24\317;+\201\234", ) , ) == 0x0
 00345   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\2107zw%\211X&w\326\215p\30\27v6\307\12\211\34\311\217\331H\367\22\13 \10V\233\22U{\263\301m\15\346{\300=K\333\214j\34\334\334(\7\272\256\272\25\210\2\4\307]\0\276o\326\36=\250p:f\37\14\26\31\214\315\364\35\374JRE6\252\252\0U_\213\252\247\322\220\311_t\303\202@\263\37WC%{\261\350\261l\2328\353#n\5\260]\26{\300m\15Pr\35\23^\262]\354\353=\261\272\370\207\333p\356\20t\11F\10\246'\25\334\303\354\303\253y\362ld\265\347\252\226$\372\300@\271\14|\19\204\231\11\276v\264\22cLF\14I\324qW~Q\300\11S;\237uIa\17\341\317\244;E\200u>Tv4J\0(\220\265T\303\300\250!\366\352\4:r\252\252a\365p\15h\241j`Ul\360\217\253\311HP0\366\236rO\320d\260\15\234\2143n\222o\204\333\265\33\200\364\352\31m2\330a\13\3145z. \30UOq\265\352Y\232\21,\27\335qh\210j\23\305\250I\4\25\274`I\0\25P\344%\20\357\3458pE\344d\313\2\336\27&\216\16#M\306\360\205`\211\24j#k@\302D4=@\3\260\21\333\215\246\2r\25z\362\14\344\353 ]\227\214\1\343B\213jh\306\245I\14Y\347\362\22\340c\2\322\220\344rPn\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\314;t2\376\200Y\12\231\3407S\330{1w\246\21\274*\233l\211\261\364\177\14\226S|V\242\303\16\30\13HrW\32\342\361\312\240<[r\201\26\6[\262\361\311\26\314)\343A\11\351@\243p9\204\240`\306s\30\2A\2238\360(\272`\330\1KCs\3?8\263\15\351\213\350\201\360\347n\260\263\10\301?~_\317\20\221\312\234", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00346   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\267\330\300\373\273\255E\322\320a\361\332ME]-/\201\240J@ \203\331rU`U_\342|\22(\362\202\225&\236n\21_mwM\204.\313N\2615.\377\257\3463\21\317\235\305\252\375\307\325\267\256\253?%\35\375\242>\31\330/\300\255\246\273\25(\334C\204\206\221\246u\222\357J\245u~o\1\37\367<\253\256#\230\31(\203\36q@\224\6\323\271\11\250\3247\222\7VM"{\223b\322O\265\273yP\3=[\272L|\252\325\212\215\12\274\5\231\232Q\3a\347\276\356\251\4\312x?\2025\23~\234\360vi\26\352'\\336\37\317y\274\3754\355\336[S\240\247\262J\23QR\310n\221Q\3041\214}\330 \264\231\24$\260t\220\201\245\223;x\236\343\256)\355F\345\355-\213\372{k\10\30\245\3463#\326\337\251v\3733i\306h\211\242\1\360\262\11\205\250xae}\325t\200\13EX\211/|\13,*\320\231\265+\271n@\270\210\23261\226-\210/kC\370e\2160~T:\37=;J\254\237\3352F\35\6\377?\371'\240\236q\211G\246\246\37j5\4DQM\205\371\307I\300z\217\335F\0\276X\353~}\227e\0\247U\14_\367f\27;\221p\2,8\211\263U\252W\344\264\177\321\273\343\221\201\15\35\265\26\20_\247\26\0\32\254\377\205\362\2&a\343\232\313\342\3253\253\366\227\26\10\36\261\272pi_\243\302sJ\241\273\14{\247O\311\31:\7\302\20\212\313\3507\232\0\33\231\352}#\11D\210/\215!$D\261\308<3\338%\32$\240\15\252\316\311V\277Y"\332l\371\202\365O\306\252\207\367\3353fz\36*\3\210\35\241:X\30\17a\27\311I\246g_\206D\342\200\19\215\374\335aQ-\201\274^P8\26\217\263", ) {\223b\322O\265\273yP\3=[\272L|\252\325\212\215\12\274\5\231\232Q\3a\347\276\356\251\4\312x?\2025\23~\234\360vi\26\352'\\336\37\317y\274\3754\355\336[S\240\247\262J\23QR\310n\221Q\3041\214}\330 \264\231\24$\260t\220\201\245\223;x\236\343\256)\355F\345\355-\213\372{k\10\30\245\3463#\326\337\251v\3733i\306h\211\242\1\360\262\11\205\250xae}\325t\200\13EX\211/|\13,*\320\231\265+\271n@\270\210\23261\226-\210/kC\370e\2160~T:\37=;J\254\237\3352F\35\6\377?\371'\240\236q\211G\246\246\37j5\4DQM\205\371\307I\300z\217\335F\0\276X\353~}\227e\0\247U\14_\367f\27;\221p\2,8\211\263U\252W\344\264\177\321\273\343\221\201\15\35\265\26\20_\247\26\0\32\254\377\205\362\2&a\343\232\313\342\3253\253\366\227\26\10\36\261\272pi_\243\302sJ\241\273\14{\247O\311\31:\7\302\20\212\313\3507\232\0\33\231\352}#\11D\210/\215!$D\261\308<3\338%\32$\240\15\252\316\311V\277Y (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\267\330\300\373\273\255E\322\320a\361\332ME]-/\201\240J@ \203\331rU`U_\342|\22(\362\202\225&\236n\21_mwM\204.\313N\2615.\377\257\3463\21\317\235\305\252\375\307\325\267\256\253?%\35\375\242>\31\330/\300\255\246\273\25(\334C\204\206\221\246u\222\357J\245u~o\1\37\367<\253\256#\230\31(\203\36q@\224\6\323\271\11\250\3247\222\7VM"{\223b\322O\265\273yP\3=[\272L|\252\325\212\215\12\274\5\231\232Q\3a\347\276\356\251\4\312x?\2025\23~\234\360vi\26\352'\\336\37\317y\274\3754\355\336[S\240\247\262J\23QR\310n\221Q\3041\214}\330 \264\231\24$\260t\220\201\245\223;x\236\343\256)\355F\345\355-\213\372{k\10\30\245\3463#\326\337\251v\3733i\306h\211\242\1\360\262\11\205\250xae}\325t\200\13EX\211/|\13,*\320\231\265+\271n@\270\210\23261\226-\210/kC\370e\2160~T:\37=;J\254\237\3352F\35\6\377?\371'\240\236q\211G\246\246\37j5\4DQM\205\371\307I\300z\217\335F\0\276X\353~}\227e\0\247U\14_\367f\27;\221p\2,8\211\263U\252W\344\264\177\321\273\343\221\201\15\35\265\26\20_\247\26\0\32\254\377\205\362\2&a\343\232\313\342\3253\253\366\227\26\10\36\261\272pi_\243\302sJ\241\273\14{\247O\311\31:\7\302\20\212\313\3507\232\0\33\231\352}#\11D\210/\215!$D\261\308<3\338%\32$\240\15\252\316\311V\277Y"\332l\371\202\365O\306\252\207\367\3353fz\36*\3\210\35\241:X\30\17a\27\311I\246g_\206D\342\200\19\215\374\335aQ-\201\274^P8\26\217\263", ) , ) == 0x0
 00347   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\234b\213\373\220\27\16\322\373\333\272\332f\377\26-\4;\353Jk\232\310\331Y\357+UtX7\22\3H\311\225\15$%\21t\3272bd\300\206\34\360\25\3f\10\204\255+\355u\271U\1\245^\304$\14Mw\253\205\231\323\31\39Uqk.M\323\222\263\343\324\34(LVf\2300\223Ih\4\265\220\303\33\3\26\341\361LW\20\236\212\246\260\367\5\262 \32\3J]\365\356\202\276\201x\248~\23U&\273vB\254\241'wdT\317R\6\2664\306d\20S\213\35\371J8\353\31\310E+\32\304\3266\330\13\16\322\24\17\12?\220\252\37\330;S$\250\256\2W\15\345\306\227\300\372P\321C\30\216\x#\375e\342v\320\211"\306C3\351\1\333\10B\205\203\302*eVo?\200 \377\23\211\4\306@,\1j\322\265\0\3%@\2232\3216\32,f\210\4\321\10\370N4{~\177\200T=\20\360\347\237\366\210\15\35-Et\371\14\32\325q\242\375\355\2464\320~\4o\353\6\205\322}\2\300Q5\226F+\4\23\353U\307\334e+\35\36\14tM-\27\20+;\2\7\202\302\263~\20\34\344\237\305\232\273\310+\312\156\17]\20t\35]\01\26\264\205\331\270ma\310 \200\342\376\211\340\366\274\254C\36\232\0;it\31\211sa\33\360\14P\35\4\3112\200L\302;0\200\350\34 \2700#\241}\10\263\17\210\47j$o\13S8\27\211P8\16\240o\240&\20\205\311}\5\22"\361\326\262\20\31O\4\306\201=\274\335\30\3341\36\1\271\303\35\212\200\23\30$\333\\311b\34,_\255\376\251\200*\203\306\374\366\333\32-\252\6\25P\23\254\304\263", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \306C3\351\1\333\10B\205\203\302*eVo?\200 \377\23\211\4\306@,\1j\322\265\0\3%@\2232\3216\32,f\210\4\321\10\370N4{~\177\200T=\20\360\347\237\366\210\15\35-Et\371\14\32\325q\242\375\355\2464\320~\4o\353\6\205\322}\2\300Q5\226F+\4\23\353U\307\334e+\35\36\14tM-\27\20+;\2\7\202\302\263~\20\34\344\237\305\232\273\310+\312\156\17]\20t\35]\01\26\264\205\331\270ma\310 \200\342\376\211\340\366\274\254C\36\232\0;it\31\211sa\33\360\14P\35\4\3112\200L\302;0\200\350\34 \2700#\241}\10\263\17\210\47j$o\13S8\27\211P8\16\240o\240&\20\205\311}\5\22 (36, 0, 0, 0, "\234b\213\373\220\27\16\322\373\333\272\332f\377\26-\4;\353Jk\232\310\331Y\357+UtX7\22\3H\311\225\15$%\21t\3272bd\300\206\34\360\25\3f\10\204\255+\355u\271U\1\245^\304$\14Mw\253\205\231\323\31\39Uqk.M\323\222\263\343\324\34(LVf\2300\223Ih\4\265\220\303\33\3\26\341\361LW\20\236\212\246\260\367\5\262 \32\3J]\365\356\202\276\201x\248~\23U&\273vB\254\241'wdT\317R\6\2664\306d\20S\213\35\371J8\353\31\310E+\32\304\3266\330\13\16\322\24\17\12?\220\252\37\330;S$\250\256\2W\15\345\306\227\300\372P\321C\30\216\x#\375e\342v\320\211"\306C3\351\1\333\10B\205\203\302*eVo?\200 \377\23\211\4\306@,\1j\322\265\0\3%@\2232\3216\32,f\210\4\321\10\370N4{~\177\200T=\20\360\347\237\366\210\15\35-Et\371\14\32\325q\242\375\355\2464\320~\4o\353\6\205\322}\2\300Q5\226F+\4\23\353U\307\334e+\35\36\14tM-\27\20+;\2\7\202\302\263~\20\34\344\237\305\232\273\310+\312\156\17]\20t\35]\01\26\264\205\331\270ma\310 \200\342\376\211\340\366\274\254C\36\232\0;it\31\211sa\33\360\14P\35\4\3112\200L\302;0\200\350\34 \2700#\241}\10\263\17\210\47j$o\13S8\27\211P8\16\240o\240&\20\205\311}\5\22"\361\326\262\20\31O\4\306\201=\274\335\30\3341\36\1\271\303\35\212\200\23\30$\333\\311b\34,_\255\376\251\200*\203\306\374\366\333\32-\252\6\25P\23\254\304\263", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00348   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\213\4\232mS\363\13J^d\24r\320\367\353\342\237\352;\14\320*\250A\244Z\323~\201\362\341\236\7\32o\243\\270f@s\374\17H\220\243\336{l\243\260\230-t\34!cj\352\212\310\323i:\302.\236\255\323\365\276\350\7\205\246\330\11\3567\212*\276\36\266\375\343V\26:\327>\321\270g3U\2024\303\351\227\220F\372=\363K#\23176\370\216\372&\230\2\314?\303\222>\32\260\243\272\254\36\10\274?\26\326\336\251\335\36x\12DX\244HF\226\271\241\236(\307'H\265\235?tE\347'qn\374\326~y\264T\205\367\22\244]c\212@\262*\337\344(\362\256\334c\350\254\273\36\301\261\207\270\35\346\233|\337\214\2029\240\6p\237\2730RDfG{S\321\24s\223\354\250\17\2215\6#\253\351_\22h\273!\220L\206\361\223\4w\230~8O\333Ah\262+\14_\241f\377\2048$\272\11\250\312C/0\33G\5yV\4\302Q:\17\223Bw\344\273\363\263\370h\276Kr\16=\263\370\353Y\6\310\323B9\271.?\257e@\225\237w'0o\263\310E\267\304j{;<\277a\300|k~kEw^m$\22\21k\321\331\242E\35W\215\320\212x\375\3738'Qr\344\0*A\263)\213\7\6\216^@\2\32\226W\25\224\36\311\260\351\26?v\273\367N\203\243\327\333\302\207\243\306U\251\256\3\323\14\23\253\213\303\212 \2\32\273\331'\271\211I1xyG Q\325KO\232x\351\242I*kN}Jr\330O\2223\0\247\332\315Q\273zl\30H\2129--\310\34(\306NB\352UI2Y\33\253H\243\220\177\310\225>\311\1\317%H\314\313\352\311\344b\270yy.9>\5\33\201\312\304\204\20S\10\3\224\371\21#\277iWY\233l\231", ) , ) == 0x0
 00349   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\240\276\321mxI@Ju\336_r\373M\240\342\264Pp\14\373\220\343A\217\340\230~\252H\252\236,\240$\243w\2-@XFDH\273\31\225{G\31\373\230\6\316W!H\320\241\212\343i":\351\224\325\255\370O\365\350,?\355\330"T|\212\1\4U\266\326Y\35\26\21mu\321\223\335xU\251\216\210\351\274*\15\372\26I\0#\262\215}\370\245@m\230)vt\303\271\204Q\260\210\0\347\36#\6t\26\375d\342\3355\302ADs\36\3F\275\3\352\236\3}lH\236'ttn]lqEF\235~R\16\37\205\334\250\357]H0\13\262\1e\257(\331\24\227c\303\26\360\36\352\13\314\2706\\320|\3646\3119\213\274;\237\220\212\31DM\3750S\372\2568\223\307\22D\22\32\217M#\200S\24\22C\1j\220g<\272\223/\315\323~\23\365\220AC\10`\14t\33-\377\257\202o\272"\22\201C\4\212PG.\303\35\4\351\353q\17\270\370<\344\220I\370\370C\4\0r%\207\370\370\300\343M\310\370\370r\271\5\205\344ek/\324w\14\212$\263\343\377\374\304A\301p<\224\333\213|@\304 E\\344&$9\253 \321\362\30\16\35|7\233\212SG\2608\14\3539\344+\220\12\263\21L\6\245\344\13\21,\34\25\277\244\202\260\302\254tv\220M\5\203\210m\220\302\254\31\215U\202\24H\323'\251\340\213\3500k\21\1\222'\2223\21S\303\14 zo\0O\261\302\242\242b\220 NV\3609\330d(x\0\214`\206Q\220\300'\30c0r-\6rH4\3|\5B\301\357\22r\241\340H\210*4\310\276\204\202\1\344\237\3\314\340P\202\344I\22y\5\203u\50;\201\304\257\252\30\10(.\262\21\10\5"Wr!'\231", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) :\351\224\325\255\370O\365\350,?\355\330 (36, 0, 0, 0, "\240\276\321mxI@Ju\336_r\373M\240\342\264Pp\14\373\220\343A\217\340\230~\252H\252\236,\240$\243w\2-@XFDH\273\31\225{G\31\373\230\6\316W!H\320\241\212\343i":\351\224\325\255\370O\365\350,?\355\330"T|\212\1\4U\266\326Y\35\26\21mu\321\223\335xU\251\216\210\351\274*\15\372\26I\0#\262\215}\370\245@m\230)vt\303\271\204Q\260\210\0\347\36#\6t\26\375d\342\3355\302ADs\36\3F\275\3\352\236\3}lH\236'ttn]lqEF\235~R\16\37\205\334\250\357]H0\13\262\1e\257(\331\24\227c\303\26\360\36\352\13\314\2706\\320|\3646\3119\213\274;\237\220\212\31DM\3750S\372\2568\223\307\22D\22\32\217M#\200S\24\22C\1j\220g<\272\223/\315\323~\23\365\220AC\10`\14t\33-\377\257\202o\272"\22\201C\4\212PG.\303\35\4\351\353q\17\270\370<\344\220I\370\370C\4\0r%\207\370\370\300\343M\310\370\370r\271\5\205\344ek/\324w\14\212$\263\343\377\374\304A\301p<\224\333\213|@\304 E\\344&$9\253 \321\362\30\16\35|7\233\212SG\2608\14\3539\344+\220\12\263\21L\6\245\344\13\21,\34\25\277\244\202\260\302\254tv\220M\5\203\210m\220\302\254\31\215U\202\24H\323'\251\340\213\3500k\21\1\222'\2223\21S\303\14 zo\0O\261\302\242\242b\220 NV\3609\330d(x\0\214`\206Q\220\300'\30c0r-\6rH4\3|\5B\301\357\22r\241\340H\210*4\310\276\204\202\1\344\237\3\314\340P\202\344I\22y\5\203u\50;\201\304\257\252\30\10(.\262\21\10\5"Wr!'\231", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \22\201C\4\212PG.\303\35\4\351\353q\17\270\370<\344\220I\370\370C\4\0r%\207\370\370\300\343M\310\370\370r\271\5\205\344ek/\324w\14\212$\263\343\377\374\304A\301p<\224\333\213|@\304 E\\344&$9\253 \321\362\30\16\35|7\233\212SG\2608\14\3539\344+\220\12\263\21L\6\245\344\13\21,\34\25\277\244\202\260\302\254tv\220M\5\203\210m\220\302\254\31\215U\202\24H\323'\251\340\213\3500k\21\1\222'\2223\21S\303\14 zo\0O\261\302\242\242b\220 NV\3609\330d(x\0\214`\206Q\220\300'\30c0r-\6rH4\3|\5B\301\357\22r\241\340H\210*4\310\276\204\202\1\344\237\3\314\340P\202\344I\22y\5\203u\50;\201\304\257\252\30\10(.\262\21\10\5 (36, 0, 0, 0, "\240\276\321mxI@Ju\336_r\373M\240\342\264Pp\14\373\220\343A\217\340\230~\252H\252\236,\240$\243w\2-@XFDH\273\31\225{G\31\373\230\6\316W!H\320\241\212\343i":\351\224\325\255\370O\365\350,?\355\330"T|\212\1\4U\266\326Y\35\26\21mu\321\223\335xU\251\216\210\351\274*\15\372\26I\0#\262\215}\370\245@m\230)vt\303\271\204Q\260\210\0\347\36#\6t\26\375d\342\3355\302ADs\36\3F\275\3\352\236\3}lH\236'ttn]lqEF\235~R\16\37\205\334\250\357]H0\13\262\1e\257(\331\24\227c\303\26\360\36\352\13\314\2706\\320|\3646\3119\213\274;\237\220\212\31DM\3750S\372\2568\223\307\22D\22\32\217M#\200S\24\22C\1j\220g<\272\223/\315\323~\23\365\220AC\10`\14t\33-\377\257\202o\272"\22\201C\4\212PG.\303\35\4\351\353q\17\270\370<\344\220I\370\370C\4\0r%\207\370\370\300\343M\310\370\370r\271\5\205\344ek/\324w\14\212$\263\343\377\374\304A\301p<\224\333\213|@\304 E\\344&$9\253 \321\362\30\16\35|7\233\212SG\2608\14\3539\344+\220\12\263\21L\6\245\344\13\21,\34\25\277\244\202\260\302\254tv\220M\5\203\210m\220\302\254\31\215U\202\24H\323'\251\340\213\3500k\21\1\222'\2223\21S\303\14 zo\0O\261\302\242\242b\220 NV\3609\330d(x\0\214`\206Q\220\300'\30c0r-\6rH4\3|\5B\301\357\22r\241\340H\210*4\310\276\204\202\1\344\237\3\314\340P\202\344I\22y\5\203u\50;\201\304\257\252\30\10(.\262\21\10\5"Wr!'\231", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00350   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\12f\213[\334!K7\243\27\243\158\211^\313\271fc\233v\306D\15\2276\313D|1\235a\243\351\273\0\2136\30\15\14\253N\200Sc\240C!0\374\20\12q\2\272\323\354:\240\201\326\173i\234\347\14W\371\233\205\233\355T\215x\273\362\1h*\353\342/\2307\35\353\264+\31\251\344g\332>X\246\0S\262a\5\212\263\272:5\264\234|\237\31D\224=\374\233\271\6\337v\202\334\375\37\215=3V \35\232\32\5\270\240Cu\211=\331\247\3243\302\234;p\314\302\213]I\212K\272\353"l\16,\307\6\343O\364\311\11\347\241\353\273N\221\353\356\265!A\2511|\23\2013\4iK&C\7EH\24\20\354C|\340\357g\211A\275\372\232\210 \376\252.\240~\201\253 \363\364T\233A\362.A\263-,O\33-3\271\334\350f\253:\211\363\343\233\4\246\367\263=oJ\317\346\242\36C\313\201Pp\1\102\377\10={\210\224Qf\2(\213y\311\17#>\203\15\302\217Q\266?V\223F\272\307\242\24P\252\363\0\14\276\236\17\324\25\313\217+v\6H^\267\36\210V\205\17Y\23Qv\276y~C\0Z\33w\353\15\22AZ\356\226\332\365"Z\226\207\256\276\333*!\320IVP\21\343\20\36\353\265\200\253b&ul}\21d\231\226\20\300\265\277G\14;q\371,\340\252_\243\242k,\340\10g \17\236c(\15:\223\262\7\226\234\361H\201^\305\240.K\253x\265\351Y\177\252\364\210\275\372vK\240\270\276\250\303kH\245]\272F\201Q\320{j\10\\303\3109\212\10c\257\7"(\272\324\34\252s\307[(\207^\344\201\320\364\272T\242?F\6\257\350(\261\361\37P_\371u\304]\11\266\247\367^\275{\362?\373\\30l\24f\30\10<", ) l\16,\307\6\343O\364\311\11\347\241\353\273N\221\353\356\265!A\2511|\23\2013\4iK&C\7EH\24\20\354C|\340\357g\211A\275\372\232\210 \376\252.\240~\201\253 \363\364T\233A\362.A\263-,O\33-3\271\334\350f\253:\211\363\343\233\4\246\367\263=oJ\317\346\242\36C\313\201Pp\1\102\377\10={\210\224Qf\2(\213y\311\17#>\203\15\302\217Q\266?V\223F\272\307\242\24P\252\363\0\14\276\236\17\324\25\313\217+v\6H^\267\36\210V\205\17Y\23Qv\276y~C\0Z\33w\353\15\22AZ\356\226\332\365 (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\12f\213[\334!K7\243\27\243\158\211^\313\271fc\233v\306D\15\2276\313D|1\235a\243\351\273\0\2136\30\15\14\253N\200Sc\240C!0\374\20\12q\2\272\323\354:\240\201\326\173i\234\347\14W\371\233\205\233\355T\215x\273\362\1h*\353\342/\2307\35\353\264+\31\251\344g\332>X\246\0S\262a\5\212\263\272:5\264\234|\237\31D\224=\374\233\271\6\337v\202\334\375\37\215=3V \35\232\32\5\270\240Cu\211=\331\247\3243\302\234;p\314\302\213]I\212K\272\353"l\16,\307\6\343O\364\311\11\347\241\353\273N\221\353\356\265!A\2511|\23\2013\4iK&C\7EH\24\20\354C|\340\357g\211A\275\372\232\210 \376\252.\240~\201\253 \363\364T\233A\362.A\263-,O\33-3\271\334\350f\253:\211\363\343\233\4\246\367\263=oJ\317\346\242\36C\313\201Pp\1\102\377\10={\210\224Qf\2(\213y\311\17#>\203\15\302\217Q\266?V\223F\272\307\242\24P\252\363\0\14\276\236\17\324\25\313\217+v\6H^\267\36\210V\205\17Y\23Qv\276y~C\0Z\33w\353\15\22AZ\356\226\332\365"Z\226\207\256\276\333*!\320IVP\21\343\20\36\353\265\200\253b&ul}\21d\231\226\20\300\265\277G\14;q\371,\340\252_\243\242k,\340\10g \17\236c(\15:\223\262\7\226\234\361H\201^\305\240.K\253x\265\351Y\177\252\364\210\275\372vK\240\270\276\250\303kH\245]\272F\201Q\320{j\10\\303\3109\212\10c\257\7"(\272\324\34\252s\307[(\207^\344\201\320\364\272T\242?F\6\257\350(\261\361\37P_\371u\304]\11\266\247\367^\275{\362?\373\\30l\24f\30\10<", ) (\272\324\34\252s\307[(\207^\344\201\320\364\272T\242?F\6\257\350(\261\361\37P_\371u\304]\11\266\247\367^\275{\362?\373\\30l\24f\30\10<", ) == 0x0
 00351   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "!\334\300[\367\233\07\210\255\350\15\233\25\313\222\334(\233]|\17\15\274\214\200DW\213\326a\210S\360\0\240\214S\15'\21\5\200x\331\353C\12\212\267\20!\313I\272\370Vq\240\252lD3B&\254\14|C\320\205\260W\37\215S\1\271\1C\220\240\342\4"|\35\300\16`\31\202^,\332\25\342\355\0x\10*\5\241\11\361:\36\16\327|\264\243\17\224\26F\320\271-e=\202\367GT\215\26\211\35 6 Q\5\223\32\10u\242\207\222\247\377\211\211\234\20\312\207\302\240\347\2\212`\0\240"G\264g\307-Y\4\364\342\263\254\241\300\1\5\221\300T\376!j\23z|8;x\4B\361mC,\377\3\24;V\10|\313U,\211j\7\261\232\243\232\265\252\5\325\201\200\232\270\364\177!\12\362\5\373\370-\7\365P-\30\3\227\350M\21q\211\330Y\320\4\215M\370=D\360\204\346\211\244\10\313\252\352;\1#\210\264\10\26\301\303\224z\334I(\240\303\202\17\10\204\310\15\3515\32\266\24\354\330F\221}\351\24{\20\270\0'\4\325\17\377\257\200\217\0\314MHu\15U\210}?DY8\353=\276R\304\10\0q\241<\353&\250\12Z\305,\221\365\11\340\335\207\205\4\220*\12j\2V{\253\250\205Q\376\200\200\330muG\307Zd\262,[\300\236\5\14\14\20\313\262,\313\20\24\24\30\30 ,\313\262, $$((&\200\330\262,,\327\361c;\25\305\213\224\0\253S\17\242YT\20\277\210\226@=K\213\2\365\250\350\321\3\245v\0\15\201zj0j*\212\27\303\343\203\301\10H\25L"\3\0\237\34\201\311\214[\3=\25\344\252j\277\272\177\30tF-\25\243(\232KTPtC>\304v\263]6\214M\25\275PHt\373w\242'\24M\242C<", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) |\35\300\16`\31\202^,\332\25\342\355\0x\10*\5\241\11\361:\36\16\327|\264\243\17\224\26F\320\271-e=\202\367GT\215\26\211\35 6 Q\5\223\32\10u\242\207\222\247\377\211\211\234\20\312\207\302\240\347\2\212`\0\240 (36, 0, 0, 0, "!\334\300[\367\233\07\210\255\350\15\233\25\313\222\334(\233]|\17\15\274\214\200DW\213\326a\210S\360\0\240\214S\15'\21\5\200x\331\353C\12\212\267\20!\313I\272\370Vq\240\252lD3B&\254\14|C\320\205\260W\37\215S\1\271\1C\220\240\342\4"|\35\300\16`\31\202^,\332\25\342\355\0x\10*\5\241\11\361:\36\16\327|\264\243\17\224\26F\320\271-e=\202\367GT\215\26\211\35 6 Q\5\223\32\10u\242\207\222\247\377\211\211\234\20\312\207\302\240\347\2\212`\0\240"G\264g\307-Y\4\364\342\263\254\241\300\1\5\221\300T\376!j\23z|8;x\4B\361mC,\377\3\24;V\10|\313U,\211j\7\261\232\243\232\265\252\5\325\201\200\232\270\364\177!\12\362\5\373\370-\7\365P-\30\3\227\350M\21q\211\330Y\320\4\215M\370=D\360\204\346\211\244\10\313\252\352;\1#\210\264\10\26\301\303\224z\334I(\240\303\202\17\10\204\310\15\3515\32\266\24\354\330F\221}\351\24{\20\270\0'\4\325\17\377\257\200\217\0\314MHu\15U\210}?DY8\353=\276R\304\10\0q\241<\353&\250\12Z\305,\221\365\11\340\335\207\205\4\220*\12j\2V{\253\250\205Q\376\200\200\330muG\307Zd\262,[\300\236\5\14\14\20\313\262,\313\20\24\24\30\30 ,\313\262, $$((&\200\330\262,,\327\361c;\25\305\213\224\0\253S\17\242YT\20\277\210\226@=K\213\2\365\250\350\321\3\245v\0\15\201zj0j*\212\27\303\343\203\301\10H\25L"\3\0\237\34\201\311\214[\3=\25\344\252j\277\272\177\30tF-\25\243(\232KTPtC>\304v\263]6\214M\25\275PHt\373w\242'\24M\242C<", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \3\0\237\34\201\311\214[\3=\25\344\252j\277\272\177\30tF-\25\243(\232KTPtC>\304v\263]6\214M\25\275PHt\373w\242'\24M\242C<", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00352   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\13\241\242P`\246\37\301\224sE\212\364ZqPz\253k\240\267\311\234\216j\212\241\20\244\231Jp\261\3563\322\30\210}X\267\222@|7Y70+<[\213nJ\313f(K\313\0\7\307\226\214.\25\246\271U\177V\25\272\210L\344*\350\361\336\201fs\344\273\371\375Y#\270H\4!\234L9.\211\213\276\272\6\357\303\365\13\373h\10\343.\306\217\266\225\222\252+\37\301\360tS\254\11\264=\336F\277\300\221+\30k\206\227*\23\372'\362\17\3}\203\224W\14\257\310\230\2733\6^#\207\357\354\340)\303\\364\344\370!\242}\14`oU\31\350\277\344\257\26;ak\1,w_\0\350\304%z:\235\375\27\223\213\303Kj\272\10~\d\207\2\343u\337\37\337\270\253Y\7\224@\2\371\370\37E\252<_\27~\12\247\10+\267>$=\242k\15/J\277xoZ\361z\352\241\356\0u\10K9\6\362\!\252J\357\3448l\3\16\313\332`\364\1\267\0\22\354\24a$\12\237\{2\273\306\305\271\245\36\332\312\365~\260\254\256p.lY\313\1\35\342<\24\364:\354h\242\335\236\206\354y==\271e\252V\324i\1\333\244\350_Ms\271\261\232\0\312\303\375\201\362\240\7\231\271C\13#\236@\235\177<\322\305]C\351\12\215\355\334d\355*\12\255}D\204\217_\313\15\236\271\253\267\352\213_\23\361\266\345\205\252\12l\3536\21;\356\360\21\\317\276\7@\26\313\205\20\30B\252#r\0\225\304\270A\254\232*\351\5\332\207\263\333\204\242>\335\255\34\314\236\367\266'\305\271Wn\353&\264\177-\200\220Z\22T\341\275\262\276\375q\237/\356G@k\361\323G%\270\15\210\13W-\370\243\14\15\306\205L!\347\365VY(\361\275gK\375\262\356\210a\316\252\330", ) , ) == 0x0
 00353   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, " \33\351PK\34T\301\277\311\16\212\337\340:PQ\21 \240\234s\327\216A0\352\20\217#\1p\232Tx\322326X\234(\13|\34\343|0\0\206\20\213E\360\200f\3\361\200\0,}\335\214\5\257\355\271~\305\35\25\2212\7\344\1R\272\336\252\3348\344\220C\266Y\10\2\3\4\12&\79\53\300\276\221\274\244\303\336\261\260h#Ye\306\244\14\336\222\201\221T\301\333\316\30\254"\16v\336m\5\213\221\0\242 \206\274\220X\372\14HD\3V9\337W'\25\203\230\220\211M^\10=\244\354\313\223\210\\337^\263!\211\307G`D\357R\350\224^\344\26\20\333 \1\7\315\24\0\303~nz\21'\266\27\2701\210KA\0C~w\336\314\2\310\317\224\37\364\2\340Y,.\13\2\322BTE\201\206\24\27U\260\354\10\0\15u$\26\30 \15\4\360\364xD\340\272z\301\33\245\0^\262\09-H\27!\201\360\244\344\23\326H\16\340`+\364*\15K\22\307\256*$!%\27{\31\1\215\305\222\37U\332\341O5\260\207\24;.G\343\200\16Xw\24\337\200\247h\211g\325\206\307\303v=\222\337\341V\377\323J\333\217R\24MX\3\372\232+p\210\375\252H\353\7\262\3\10\13\10$\13\23\36\305w\32\31\177\26C\302\260\306\355\367\336\246*!\276D\2575\24\313&$\362\25\30\15\241\213t\251\272\266\316?\341\12GQ}\21\20T\273\21wu\365\7k\254\200\205;\242\11\252\10\310K\225\357\2\12\254\261\220\242\5\361=\370\333\257\30u\335\206\246\207\236\334\14l\305\222\355%\353\15\164-\253*\21\22\177[\366\262\225G:\237\4T\14@@K\230G\16\2F\210 \355f\370\210\266F\306\256\366j\347\336\354\22(\332\7,K\326\10\245\210Jt\341\330", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \16v\336m\5\213\221\0\242 \206\274\220X\372\14HD\3V9\337W'\25\203\230\220\211M^\10=\244\354\313\223\210\\337^\263!\211\307G`D\357R\350\224^\344\26\20\333 \1\7\315\24\0\303~nz\21'\266\27\2701\210KA\0C~w\336\314\2\310\317\224\37\364\2\340Y,.\13\2\322BTE\201\206\24\27U\260\354\10\0\15u$\26\30 \15\4\360\364xD\340\272z\301\33\245\0^\262\09-H\27!\201\360\244\344\23\326H\16\340`+\364*\15K\22\307\256*$!%\27{\31\1\215\305\222\37U\332\341O5\260\207\24;.G\343\200\16Xw\24\337\200\247h\211g\325\206\307\303v=\222\337\341V\377\323J\333\217R\24MX\3\372\232+p\210\375\252H\353\7\262\3\10\13\10$\13\23\36\305w\32\31\177\26C\302\260\306\355\367\336\246*!\276D\2575\24\313&$\362\25\30\15\241\213t\251\272\266\316?\341\12GQ}\21\20T\273\21wu\365\7k\254\200\205;\242\11\252\10\310K\225\357\2\12\254\261\220\242\5\361=\370\333\257\30u\335\206\246\207\236\334\14l\305\222\355%\353\15\164-\253*\21\22\177[\366\262\225G:\237\4T\14@@K\230G\16\2F\210 \355f\370\210\266F\306\256\366j\347\336\354\22(\332\7,K\326\10\245\210Jt\341\330", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00354   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "&\230O\224\254\262\37\340\367)\263\353-\200LU\367\324vm([\274:)\317Qk\373\334xi\231(3R\254m+\267\216\274s\2447\255\274R6\235{Aw\215<\6\17\230\21V\30\251X\302s\17\203\316pb\363TD\356\245\210h\252\275\205\344\272\327\370\11z#\37100\24\333\1\232\302\137\374\36k}\255>\253a\15D5Zt\234\30\232m\210\353\343\224\10.\3428\14\23\17\240\235\242\14Z\211u\336\35\302l\326\17\37%\272}\203\217Q\11F\5v\30623\266}\1C,\317\354\2537\316\220\364\366TJ\353\361k-7\354\263"`fPtF\32kbr,\206\316.\256_\303\337 \360\11\311\344\14'\317\200\245\270\266S\2?\201>\12#\0\235\261\2507\24\24\314\254\302g\327\375\373\33\356|\234G\201\336\240\27\341\312~{t\251S\363\335\331 O\253\217\204\307\20mDn\365]\20\205\37\344\25\240\243]\21\255\30\237F\321\326\371\3431\12\14%\241A|i\270\217v\375f\1\308\262\353P\234\353\327,\340\14 !?\266S\30'\311\324-\235\242f\273c\352C\15\253\262ZK3\341\274Z{\357\370\304`\22:\253\1\311\206\234 \211\177\1V\235\216\306\304\2\374.B`b9\306\"\260\2443|\337}K\22 (\273q\20\250^6\343\335\11\2^\203KA\7\11>*\0>x\340\375z!\14\245[\12=kn\372<\323:a\216O\225v\230k\232y\17\244BE\333\24\377\366\300\357\2719\30\20|R\336;\212\220e\3\202F\320{\336lk\37\336P\214\237)\223';?\271\314\250PD\37\35\211\314=;\307Z\273?M[<\307\273A\222R\3624o\231-\370$-=1\307T\340\347\235\207\341=\177dY\313\360", ) `fPtF\32kbr,\206\316.\256_\303\337 \360\11\311\344\14'\317\200\245\270\266S\2?\201>\12#\0\235\261\2507\24\24\314\254\302g\327\375\373\33\356|\234G\201\336\240\27\341\312~{t\251S\363\335\331 O\253\217\204\307\20mDn\365]\20\205\37\344\25\240\243]\21\255\30\237F\321\326\371\3431\12\14%\241A|i\270\217v\375f\1\308\262\353P\234\353\327,\340\14 !?\266S\30'\311\324-\235\242f\273c\352C\15\253\262ZK3\341\274Z{\357\370\304`\22:\253\1\311\206\234 \211\177\1V\235\216\306\304\2\374.B`b9\306\ (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "&\230O\224\254\262\37\340\367)\263\353-\200LU\367\324vm([\274:)\317Qk\373\334xi\231(3R\254m+\267\216\274s\2447\255\274R6\235{Aw\215<\6\17\230\21V\30\251X\302s\17\203\316pb\363TD\356\245\210h\252\275\205\344\272\327\370\11z#\37100\24\333\1\232\302\137\374\36k}\255>\253a\15D5Zt\234\30\232m\210\353\343\224\10.\3428\14\23\17\240\235\242\14Z\211u\336\35\302l\326\17\37%\272}\203\217Q\11F\5v\30623\266}\1C,\317\354\2537\316\220\364\366TJ\353\361k-7\354\263"`fPtF\32kbr,\206\316.\256_\303\337 \360\11\311\344\14'\317\200\245\270\266S\2?\201>\12#\0\235\261\2507\24\24\314\254\302g\327\375\373\33\356|\234G\201\336\240\27\341\312~{t\251S\363\335\331 O\253\217\204\307\20mDn\365]\20\205\37\344\25\240\243]\21\255\30\237F\321\326\371\3431\12\14%\241A|i\270\217v\375f\1\308\262\353P\234\353\327,\340\14 !?\266S\30'\311\324-\235\242f\273c\352C\15\253\262ZK3\341\274Z{\357\370\304`\22:\253\1\311\206\234 \211\177\1V\235\216\306\304\2\374.B`b9\306\"\260\2443|\337}K\22 (\273q\20\250^6\343\335\11\2^\203KA\7\11>*\0>x\340\375z!\14\245[\12=kn\372<\323:a\216O\225v\230k\232y\17\244BE\333\24\377\366\300\357\2719\30\20|R\336;\212\220e\3\202F\320{\336lk\37\336P\214\237)\223';?\271\314\250PD\37\35\211\314=;\307Z\273?M[<\307\273A\222R\3624o\231-\370$-=1\307T\340\347\235\207\341=\177dY\313\360", ) , ) == 0x0
 00355   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\15"\4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$"ZV3\23\23\302X\265\310\316[\330\270ToT\356\210C\20\366\205\317\0\234\370"\300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370"K\334\33tm\240 bY\226\315\316\5\24\24\30\30ek\360"s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27"\233\36x|\364\307\0\22\13\222\360q;\22\256\310gB\2u9\0A,\263u*+\2043\340\326\300j\14\216\341A=@\324\261<\370\200*\216d/=\230@ 2\17\217\370\16\333?E\275\300\304\3r\30;\306\31\336\200\333e(8\15\320Pd'k4d\33\214\264\223\330'\20\205\362\314\203\352\17\3763\207=\20}\21\273\24\367\20<\354\1\12\222yH\177o\262\227\263$\6\207z\307\177Z\254\235\254[v\177O\343\200\360", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$ (36, 0, 0, 0, "\15"\4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$"ZV3\23\23\302X\265\310\316[\330\270ToT\356\210C\20\366\205\317\0\234\370"\300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370"K\334\33tm\240 bY\226\315\316\5\24\24\30\30ek\360"s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27"\233\36x|\364\307\0\22\13\222\360q;\22\256\310gB\2u9\0A,\263u*+\2043\340\326\300j\14\216\341A=@\324\261<\370\200*\216d/=\230@ 2\17\217\370\16\333?E\275\300\304\3r\30;\306\31\336\200\333e(8\15\320Pd'k4d\33\214\264\223\330'\20\205\362\314\203\352\17\3763\207=\20}\21\273\24\367\20<\354\1\12\222yH\177o\262\227\263$\6\207z\307\177Z\254\235\254[v\177O\343\200\360", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370 (36, 0, 0, 0, "\15"\4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$"ZV3\23\23\302X\265\310\316[\330\270ToT\356\210C\20\366\205\317\0\234\370"\300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370"K\334\33tm\240 bY\226\315\316\5\24\24\30\30ek\360"s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27"\233\36x|\364\307\0\22\13\222\360q;\22\256\310gB\2u9\0A,\263u*+\2043\340\326\300j\14\216\341A=@\324\261<\370\200*\216d/=\230@ 2\17\217\370\16\333?E\275\300\304\3r\30;\306\31\336\200\333e(8\15\320Pd'k4d\33\214\264\223\330'\20\205\362\314\203\352\17\3763\207=\20}\21\273\24\367\20<\354\1\12\222yH\177o\262\227\263$\6\207z\307\177Z\254\235\254[v\177O\343\200\360", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27 (36, 0, 0, 0, "\15"\4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$"ZV3\23\23\302X\265\310\316[\330\270ToT\356\210C\20\366\205\317\0\234\370"\300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370"K\334\33tm\240 bY\226\315\316\5\24\24\30\30ek\360"s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27"\233\36x|\364\307\0\22\13\222\360q;\22\256\310gB\2u9\0A,\263u*+\2043\340\326\300j\14\216\341A=@\324\261<\370\200*\216d/=\230@ 2\17\217\370\16\333?E\275\300\304\3r\30;\306\31\336\200\333e(8\15\320Pd'k4d\33\214\264\223\330'\20\205\362\314\203\352\17\3763\207=\20}\21\273\24\367\20<\354\1\12\222yH\177o\262\227\263$\6\207z\307\177Z\254\235\254[v\177O\343\200\360", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00356   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\222\321i\240*\304WV\265\3637\313\241\7\304\246\6=-\342^\2\35]1#G\20\315\270\21f"\261s\37\231\327\354\12\363\305\273\16)8\252\306K\225\263-\374\276\236$\201\311-\252\242;\374\37\15\371\362\255\3\302\236\306=\331\3>j\372\320\231\233\234r\302\365\200|\10\237\234\12Hej\250\31\241"\273=\320\341\16\1\354z\357\276\262\302\17\334\253\336\371\302\252A\314\257Z\255\34~"}[\10\300i\231\304s\252\217T\35V8G\34\303\321\323\254\227I~.1Ipp\224\332\311\307,\23\214\161\337\13\327N\303\1\242T`\336_ib\232Y>K\226\320J\327U;+gbYW$\36\230\341\4\272\247\300E_\201\222m\347\361\324\11\254\256\367`\331!\177g~K\371\263&\7(\233\20\21-4N3\267\367\12x\37T7\274\253\343h$\322(W\265L\14\370\251[\354$\15\202\22\30b\365\11z\177\317\342\345onm\213\330c`pN\341\210\272\352\302\5#m\214\205V\262-\201\341\264\217!)\4\215p\227(YE\232\352\14]\336\235\262Ex\6\242`GQ|\35\372$&\207\374\2027\211S\3036-\22\3\371$\23z\203`\272\256N\27\261\24o\10\200\276\272\5\211\202\371\370\304\376\25\220\3606IQ\36G4\320P\21N\201\242\266i\257"\356$\0\226\311C+\334\202\;\345\32\33\310\233x\272\31'K[*\241\375g\1X\266\312~,\352\277\303M+Bt'\334\264\311\3\324e\337/Q[\211{\261J\6(\352\15\225\213$D@x\11[\244\273\371\327\374;\30\313\223\300'_l+o\302\356'\255\32V\25\371\\207\21\252\330K"\367'%nO\342\310;\340\200\6;\201\366\311\267\374\361\220e\363\261;\334\307F\275\233\311\367", ) \261s\37\231\327\354\12\363\305\273\16)8\252\306K\225\263-\374\276\236$\201\311-\252\242;\374\37\15\371\362\255\3\302\236\306=\331\3>j\372\320\231\233\234r\302\365\200|\10\237\234\12Hej\250\31\241 (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\222\321i\240*\304WV\265\3637\313\241\7\304\246\6=-\342^\2\35]1#G\20\315\270\21f"\261s\37\231\327\354\12\363\305\273\16)8\252\306K\225\263-\374\276\236$\201\311-\252\242;\374\37\15\371\362\255\3\302\236\306=\331\3>j\372\320\231\233\234r\302\365\200|\10\237\234\12Hej\250\31\241"\273=\320\341\16\1\354z\357\276\262\302\17\334\253\336\371\302\252A\314\257Z\255\34~"}[\10\300i\231\304s\252\217T\35V8G\34\303\321\323\254\227I~.1Ipp\224\332\311\307,\23\214\161\337\13\327N\303\1\242T`\336_ib\232Y>K\226\320J\327U;+gbYW$\36\230\341\4\272\247\300E_\201\222m\347\361\324\11\254\256\367`\331!\177g~K\371\263&\7(\233\20\21-4N3\267\367\12x\37T7\274\253\343h$\322(W\265L\14\370\251[\354$\15\202\22\30b\365\11z\177\317\342\345onm\213\330c`pN\341\210\272\352\302\5#m\214\205V\262-\201\341\264\217!)\4\215p\227(YE\232\352\14]\336\235\262Ex\6\242`GQ|\35\372$&\207\374\2027\211S\3036-\22\3\371$\23z\203`\272\256N\27\261\24o\10\200\276\272\5\211\202\371\370\304\376\25\220\3606IQ\36G4\320P\21N\201\242\266i\257"\356$\0\226\311C+\334\202\;\345\32\33\310\233x\272\31'K[*\241\375g\1X\266\312~,\352\277\303M+Bt'\334\264\311\3\324e\337/Q[\211{\261J\6(\352\15\225\213$D@x\11[\244\273\371\327\374;\30\313\223\300'_l+o\302\356'\255\32V\25\371\\207\21\252\330K"\367'%nO\342\310;\340\200\6;\201\366\311\267\374\361\220e\363\261;\334\307F\275\233\311\367", ) }[\10\300i\231\304s\252\217T\35V8G\34\303\321\323\254\227I~.1Ipp\224\332\311\307,\23\214\161\337\13\327N\303\1\242T`\336_ib\232Y>K\226\320J\327U;+gbYW$\36\230\341\4\272\247\300E_\201\222m\347\361\324\11\254\256\367`\331!\177g~K\371\263&\7(\233\20\21-4N3\267\367\12x\37T7\274\253\343h$\322(W\265L\14\370\251[\354$\15\202\22\30b\365\11z\177\317\342\345onm\213\330c`pN\341\210\272\352\302\5#m\214\205V\262-\201\341\264\217!)\4\215p\227(YE\232\352\14]\336\235\262Ex\6\242`GQ|\35\372$&\207\374\2027\211S\3036-\22\3\371$\23z\203`\272\256N\27\261\24o\10\200\276\272\5\211\202\371\370\304\376\25\220\3606IQ\36G4\320P\21N\201\242\266i\257 (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\222\321i\240*\304WV\265\3637\313\241\7\304\246\6=-\342^\2\35]1#G\20\315\270\21f"\261s\37\231\327\354\12\363\305\273\16)8\252\306K\225\263-\374\276\236$\201\311-\252\242;\374\37\15\371\362\255\3\302\236\306=\331\3>j\372\320\231\233\234r\302\365\200|\10\237\234\12Hej\250\31\241"\273=\320\341\16\1\354z\357\276\262\302\17\334\253\336\371\302\252A\314\257Z\255\34~"}[\10\300i\231\304s\252\217T\35V8G\34\303\321\323\254\227I~.1Ipp\224\332\311\307,\23\214\161\337\13\327N\303\1\242T`\336_ib\232Y>K\226\320J\327U;+gbYW$\36\230\341\4\272\247\300E_\201\222m\347\361\324\11\254\256\367`\331!\177g~K\371\263&\7(\233\20\21-4N3\267\367\12x\37T7\274\253\343h$\322(W\265L\14\370\251[\354$\15\202\22\30b\365\11z\177\317\342\345onm\213\330c`pN\341\210\272\352\302\5#m\214\205V\262-\201\341\264\217!)\4\215p\227(YE\232\352\14]\336\235\262Ex\6\242`GQ|\35\372$&\207\374\2027\211S\3036-\22\3\371$\23z\203`\272\256N\27\261\24o\10\200\276\272\5\211\202\371\370\304\376\25\220\3606IQ\36G4\320P\21N\201\242\266i\257"\356$\0\226\311C+\334\202\;\345\32\33\310\233x\272\31'K[*\241\375g\1X\266\312~,\352\277\303M+Bt'\334\264\311\3\324e\337/Q[\211{\261J\6(\352\15\225\213$D@x\11[\244\273\371\327\374;\30\313\223\300'_l+o\302\356'\255\32V\25\371\\207\21\252\330K"\367'%nO\342\310;\340\200\6;\201\366\311\267\374\361\220e\363\261;\334\307F\275\233\311\367", ) \367'%nO\342\310;\340\200\6;\201\366\311\267\374\361\220e\363\261;\334\307F\275\233\311\367", ) == 0x0
 00357   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\271k"\240\1~\34V\236I|\313\212\275\217\246-\207f\342u\270V]\32\231\14\20\346\2Zf\11\138\37\262m\247\12\330\177\360\16\2\202\341\306`/\370-\327\4\325$\252sf\252\211\201\267\37&C\271\255(x\325\306\26cH>A@\233\231\260&9\302\336:7\10\264&AHN\320\343\31\212\230\360=\373[E\1\307\300\244\276\231xD\334\200d\262\302\201\373\207\257q\27W~\11\307\20\10\353\323\322\304X\20\304T6\354sG7y\232\323\207-\2~\5\213\2p[.\221\311\354\226X\214%\213\224\13\374\364\210\1\211\356+\336t\323)\232r\204\0\226\373\360\234U\20\221,br\355o\3\35"\252\4\221\35\213Et;\331m\314K\237\11\207\24\274`\362\2334gU\361\262\263\15\275c\233;\253f4e\211\374\367!\302TT\34\6\340\343C\236\231(|\17\7\14\323\23\20\354\17\267\311\223\330\276\11Q\305\204\342\316\325%m\240b(`[\364\252\210\221P\211\5\10\327\307\205}\10f\201\312\16\304!\2\276\306p\274\222\22E\261PG]\365'\371ES\274\351`l\3537\35\321\236m\207\3278|\211xy}-9\271\262$8\300\310`\221\24\5\27\232\256$\10\253\4\361\5\2428\262\370\357D^\220\333\214\2Q5\375\177\320{\253\5\201\211\14"\257\11To\0\275s\10+\3678\27;\316\240P\310\260\302\361\31\14\361\20*\212G,\1s\14\201~\7P\364\303f\221\11t\14f\377\311(n.\337\4\353\20\211P\13\1\6\3PF\225\240\236\17@S\263\20\244\220C\234\374\20\242\200\223\353\235\24l\0\325\211\356\14\27QV>C\27\207:\20\223K\11Ml%E\365\251\310\20Z\313\6\20;\275\311\234F\272\220NI\372;\367}\15\275\260sU7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \240\1~\34V\236I|\313\212\275\217\246-\207f\342u\270V]\32\231\14\20\346\2Zf\11\138\37\262m\247\12\330\177\360\16\2\202\341\306`/\370-\327\4\325$\252sf\252\211\201\267\37&C\271\255(x\325\306\26cH>A@\233\231\260&9\302\336:7\10\264&AHN\320\343\31\212\230\360=\373[E\1\307\300\244\276\231xD\334\200d\262\302\201\373\207\257q\27W~\11\307\20\10\353\323\322\304X\20\304T6\354sG7y\232\323\207-\2~\5\213\2p[.\221\311\354\226X\214%\213\224\13\374\364\210\1\211\356+\336t\323)\232r\204\0\226\373\360\234U\20\221,br\355o\3\35 (36, 0, 0, 0, "\271k"\240\1~\34V\236I|\313\212\275\217\246-\207f\342u\270V]\32\231\14\20\346\2Zf\11\138\37\262m\247\12\330\177\360\16\2\202\341\306`/\370-\327\4\325$\252sf\252\211\201\267\37&C\271\255(x\325\306\26cH>A@\233\231\260&9\302\336:7\10\264&AHN\320\343\31\212\230\360=\373[E\1\307\300\244\276\231xD\334\200d\262\302\201\373\207\257q\27W~\11\307\20\10\353\323\322\304X\20\304T6\354sG7y\232\323\207-\2~\5\213\2p[.\221\311\354\226X\214%\213\224\13\374\364\210\1\211\356+\336t\323)\232r\204\0\226\373\360\234U\20\221,br\355o\3\35"\252\4\221\35\213Et;\331m\314K\237\11\207\24\274`\362\2334gU\361\262\263\15\275c\233;\253f4e\211\374\367!\302TT\34\6\340\343C\236\231(|\17\7\14\323\23\20\354\17\267\311\223\330\276\11Q\305\204\342\316\325%m\240b(`[\364\252\210\221P\211\5\10\327\307\205}\10f\201\312\16\304!\2\276\306p\274\222\22E\261PG]\365'\371ES\274\351`l\3537\35\321\236m\207\3278|\211xy}-9\271\262$8\300\310`\221\24\5\27\232\256$\10\253\4\361\5\2428\262\370\357D^\220\333\214\2Q5\375\177\320{\253\5\201\211\14"\257\11To\0\275s\10+\3678\27;\316\240P\310\260\302\361\31\14\361\20*\212G,\1s\14\201~\7P\364\303f\221\11t\14f\377\311(n.\337\4\353\20\211P\13\1\6\3PF\225\240\236\17@S\263\20\244\220C\234\374\20\242\200\223\353\235\24l\0\325\211\356\14\27QV>C\27\207:\20\223K\11Ml%E\365\251\310\20Z\313\6\20;\275\311\234F\272\220NI\372;\367}\15\275\260sU7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \257\11To\0\275s\10+\3678\27;\316\240P\310\260\302\361\31\14\361\20*\212G,\1s\14\201~\7P\364\303f\221\11t\14f\377\311(n.\337\4\353\20\211P\13\1\6\3PF\225\240\236\17@S\263\20\244\220C\234\374\20\242\200\223\353\235\24l\0\325\211\356\14\27QV>C\27\207:\20\223K\11Ml%E\365\251\310\20Z\313\6\20;\275\311\234F\272\220NI\372;\367}\15\275\260sU7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00358   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "J\31\352S\13\365\351\324wE\240\315\235\27\266\245\20|_:\3370m\200\327\2215\4p\321\\374\6\317\2272\317\3\343Am\212\32\371\361\13\343N\347\344\30\212]\13\265\26\3466\20\37\366E\20\353\243\31T\37\2118\210\3060\306\267\365\202\214\261\6\351\367\223u\335\231\264\15\255\37\224Z\232y\257~9Q\12(h\244\343\242\337b@K:Z51V\320\326\254,\16@k\300\244\326o:\24\312\12<\233\226~$\10F\242A\361\203\362\247\224\215(\236\363\365TchQd\363\260*S0Cg\325K\246\222l\335)\276\214\6\262\211a\310\357\375\245\16NI\271\301B\224=-\317if\334\374M\236:\247\227\3149\356N~&\271\13\212m.ei\355\371\247g\360-N6\214\224\371?Bz[M.{\216pzz\263\20VS\360\3769\7\224\370\362[\201:\247c\267\333\6\34\377\330D\353&\341\362!\226\202\260\351\271A_\263[\375p\26\221\273\305B\224u\31570\3\320\5\266C\17!\301D>_\227\300\303\276\313\344$\334N0\33[@\276\326\354*\353\31z\341\213\317\2716\10RHd\3247\6\311;V\266p\4\323\2508'TT\374\377\253\306p\3\36\310n\306o\274KOS\267\265\79\203<\355P\241\245\366\300\245-\307\216\213Kau\5\331$\377\14\273\62\232\353\361\333\354\272\267d\356\327\301\301\320\302\3\243\351I\303.\264k\300jsi\5\353\341r\310 p_a\321\270\374\373R\275=\367\3639\221\12\306\257K[M\261pz\324!\263\360/\306T\277%\373f!\214;\221\263\235ZFs\331\363\366l\267\13N\15\371\315\273\364\364\327\273#\1\273N\331\0xdp\375\73\332\37?\277\240\332!\303u0\3d\360O\301\275\365&\317U\332", ) , ) == 0x0
 00359   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "a\243\241S O\242\324\\377\353\315\266\255\375\245;\306\24:\364\212&\200\374+~\4[k\27\374-u\3342\344\271\250AF0Q\371\332\261\250N\314^S\212v\261\376\26\315\214[\37\335\377[\353\210\243\37\37\242\202\303\306\33|\374\365\2516\372\6\302M\330u\366#\377\15\206\245\337Z\261\303\344~\22\353A(C\36\250\242\364\330\13K\21\340~1}j\235\254\7\264\13k\353\36\235o\21\256\201\12\27!\335~\17\262\15\242jK\310\362\214.\306(\265I\276TH\322\32d\330\12aS\33\371,\325`\34\331l\366\223\365\214-\10\302a\343U\266\245%\364\2\271\352\370\337=\6u"f\367F\6\236\21\35\334\314\22T\5~\15\3@\212F\224.i\306C\354g\333\227\56\247.\262?i\300\20M\5\301\305pQ\300\370\20}\351\273\376\22\275\337\370\331\341\312:\214\331\374\333-\246\264\330oQm\341\331\233\335\202\233S\362At\11\20\375[\254\332\273\356\370\337u\346\215{\3\373\277\375C$\233\212D\25\345\334\300\350\4\200\344\17f\500\341\13\276\375Va\3532\300\252\213\344\3}\10y\362/\324\34\274\202;}\14;\4\370\22s'\177\356\267\377\200|;\35r%\306D\6\0Ox\15\376\7\229w\355{\33\356\366\353\37f\307\2451\0a^\277\222$\324\266\360\6\31 \240\361\360V\361\267OT\234\301\352j\211\3\210S\2\303\5\16 \300A\311"\5\300[9\310\13\312\24a\372\2\267\373y\7v\367\330\203\332\12\355\25\0[f\13;z\377\233\370\360\4|\37\277\16A-!\247\201\332\263\266\340\15s\362I\275l\234\261\5\15\322w\360\364\337m\360#*\1\5\331+\302/p\326\275x\3324\205\364\240\361\233\210u\33\271/\360d{\366\365\15u\36\332", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) f\367F\6\236\21\35\334\314\22T\5~\15\3@\212F\224.i\306C\354g\333\227\56\247.\262?i\300\20M\5\301\305pQ\300\370\20}\351\273\376\22\275\337\370\331\341\312:\214\331\374\333-\246\264\330oQm\341\331\233\335\202\233S\362At\11\20\375[\254\332\273\356\370\337u\346\215{\3\373\277\375C$\233\212D\25\345\334\300\350\4\200\344\17f\500\341\13\276\375Va\3532\300\252\213\344\3}\10y\362/\324\34\274\202;}\14;\4\370\22s'\177\356\267\377\200|;\35r%\306D\6\0Ox\15\376\7\229w\355{\33\356\366\353\37f\307\2451\0a^\277\222$\324\266\360\6\31 \240\361\360V\361\267OT\234\301\352j\211\3\210S\2\303\5\16 \300A\311 (36, 0, 0, 0, "a\243\241S O\242\324\\377\353\315\266\255\375\245;\306\24:\364\212&\200\374+~\4[k\27\374-u\3342\344\271\250AF0Q\371\332\261\250N\314^S\212v\261\376\26\315\214[\37\335\377[\353\210\243\37\37\242\202\303\306\33|\374\365\2516\372\6\302M\330u\366#\377\15\206\245\337Z\261\303\344~\22\353A(C\36\250\242\364\330\13K\21\340~1}j\235\254\7\264\13k\353\36\235o\21\256\201\12\27!\335~\17\262\15\242jK\310\362\214.\306(\265I\276TH\322\32d\330\12aS\33\371,\325`\34\331l\366\223\365\214-\10\302a\343U\266\245%\364\2\271\352\370\337=\6u"f\367F\6\236\21\35\334\314\22T\5~\15\3@\212F\224.i\306C\354g\333\227\56\247.\262?i\300\20M\5\301\305pQ\300\370\20}\351\273\376\22\275\337\370\331\341\312:\214\331\374\333-\246\264\330oQm\341\331\233\335\202\233S\362At\11\20\375[\254\332\273\356\370\337u\346\215{\3\373\277\375C$\233\212D\25\345\334\300\350\4\200\344\17f\500\341\13\276\375Va\3532\300\252\213\344\3}\10y\362/\324\34\274\202;}\14;\4\370\22s'\177\356\267\377\200|;\35r%\306D\6\0Ox\15\376\7\229w\355{\33\356\366\353\37f\307\2451\0a^\277\222$\324\266\360\6\31 \240\361\360V\361\267OT\234\301\352j\211\3\210S\2\303\5\16 \300A\311"\5\300[9\310\13\312\24a\372\2\267\373y\7v\367\330\203\332\12\355\25\0[f\13;z\377\233\370\360\4|\37\277\16A-!\247\201\332\263\266\340\15s\362I\275l\234\261\5\15\322w\360\364\337m\360#*\1\5\331+\302/p\326\275x\3324\205\364\240\361\233\210u\33\271/\360d{\366\365\15u\36\332", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00360   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\373\241\316\320\3201y\1/\215\261\233Y\326\5\3a\376\36{\20\205 \315\\344Z@\233\3\346X\220\2735\5\2J}\3302\2\17d\300,A\213Y\354k\242/\37y\27F9\303\355\20u\266)\266\234_D\6\2729A\221\222\241\242z?\205\213\231mJ\2559\22\2374\257B\346T[QGnx\241p\373^?\370\200K7\237\221\10\207\30\255u\347\302\30-\270q}\221\223\312\306\37;\255<&\310K4\33\245\376z\33\20\311VgB\302;sy\344\242\37S\256\177\2337\276od"\12\30w]a\212d(0\350\354\11\230\3\21/W\253\206\30\347\243\356(\177\302\365\240\247\33]CB\5\353zH8\217\305\315xp\234\12\313\3]\201Rw\20\201(\206\211P*n\242\277_\14]T\303\15\335\226?VY?A\307.\264\250A\312\377[\17\364\257l~\206\20\23u\214\3531[ \364r\245\224\243E\0\253\265cD;\262\243\341e^C\15\205?OE\233\341\20t\3600\265\320\240P\312\345+DH\14\252x\222\334\360\256F\201\311\264\2159o\275\260\242\201\222\332\305n1~t?\273(\316\27t5\355}\241\0\274\3205=\12\366\2010y\223Z\375\10\2221N\377]\244\34\20\306\12\270}\0A\34S\353<\356\353"\363\33|\245\214E\271\2272\204\260\32\223`\265\330\33\312\206\13\15\332\346\37'\240\3d\264\2406ar\275+-\373\3178E\301\260I7\2368\3\240\276p\357X6\266\202\30\236\7\2667:\13A)\377b\351\233:\2137\206\245\226m\217\7Q\250\252}\266\201\314D\17\227u\3102\273\300\211p\16", ) \12\30w]a\212d(0\350\354\11\230\3\21/W\253\206\30\347\243\356(\177\302\365\240\247\33]CB\5\353zH8\217\305\315xp\234\12\313\3]\201Rw\20\201(\206\211P*n\242\277_\14]T\303\15\335\226?VY?A\307.\264\250A\312\377[\17\364\257l~\206\20\23u\214\3531[ \364r\245\224\243E\0\253\265cD;\262\243\341e^C\15\205?OE\233\341\20t\3600\265\320\240P\312\345+DH\14\252x\222\334\360\256F\201\311\264\2159o\275\260\242\201\222\332\305n1~t?\273(\316\27t5\355}\241\0\274\3205=\12\366\2010y\223Z\375\10\2221N\377]\244\34\20\306\12\270}\0A\34S\353<\356\353 (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\373\241\316\320\3201y\1/\215\261\233Y\326\5\3a\376\36{\20\205 \315\\344Z@\233\3\346X\220\2735\5\2J}\3302\2\17d\300,A\213Y\354k\242/\37y\27F9\303\355\20u\266)\266\234_D\6\2729A\221\222\241\242z?\205\213\231mJ\2559\22\2374\257B\346T[QGnx\241p\373^?\370\200K7\237\221\10\207\30\255u\347\302\30-\270q}\221\223\312\306\37;\255<&\310K4\33\245\376z\33\20\311VgB\302;sy\344\242\37S\256\177\2337\276od"\12\30w]a\212d(0\350\354\11\230\3\21/W\253\206\30\347\243\356(\177\302\365\240\247\33]CB\5\353zH8\217\305\315xp\234\12\313\3]\201Rw\20\201(\206\211P*n\242\277_\14]T\303\15\335\226?VY?A\307.\264\250A\312\377[\17\364\257l~\206\20\23u\214\3531[ \364r\245\224\243E\0\253\265cD;\262\243\341e^C\15\205?OE\233\341\20t\3600\265\320\240P\312\345+DH\14\252x\222\334\360\256F\201\311\264\2159o\275\260\242\201\222\332\305n1~t?\273(\316\27t5\355}\241\0\274\3205=\12\366\2010y\223Z\375\10\2221N\377]\244\34\20\306\12\270}\0A\34S\353<\356\353"\363\33|\245\214E\271\2272\204\260\32\223`\265\330\33\312\206\13\15\332\346\37'\240\3d\264\2406ar\275+-\373\3178E\301\260I7\2368\3\240\276p\357X6\266\202\30\236\7\2667:\13A)\377b\351\233:\2137\206\245\226m\217\7Q\250\252}\266\201\314D\17\227u\3102\273\300\211p\16", ) , ) == 0x0
 00361   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\320\33\205\320\373\2132\1\47\372\233rlN\3JDU{;?k\315w^\21@\260\271\255X\273\1~\5)\3606\330\31\270Dd\353\226\12\213rV \242\4\2452\27m\203\210\355;\317\375)\235&\24D-\0rA\272(\352\242Q\205\316\213\262\327\1\255\22\250\3244\204\370\255Tp\353\14nS\33;\373u\205\263\200`\215\324\221#=S\255^]\211\30\6\2:}\272)\201\3064\201\346<\15r\040\37\265z0\252\202VL\370\211;X\303\257\242\27\323\270G\230c\27}\304v\23$\2009\3\371\35\321\1\334\214\367\373_Uv\17 8\366`j\4\331\1\373\306Oh\13URu\37x\244\233\34\4$d\11\260Swv\333\301d\3\212\243\354""H\21\4\355\340\2063]\350\356\3\305\211\365\213\35P]h\370N\353Q\362s\217\356w3p\267\260\200\3v;\31w;;c\206\242\352an\211\5\24\14v\356\210\15\366,tVr\205\12\307\5\16\343A\341E\20\17\337\25'~\255\252Xu\247Qz[\13N9\245\277\31\16\0\200\17(D\20\10\350\341N\344\10\15\256\205\4E\260[[t\333\212\376\320\213\352\201\345\0\376\3\14\201\302\331\334\333\24\15\201\342\16\3069D\7\373\242\252(\221\305E\2135t\24\1c\316<\316~\355V\33K\274\373\217v\12\335;{y\270\340\266\10\271\213\5\377v\36W\20\355\260\363}+\373WS\300\206\245\353\11IP|\2166\16\271\274\210\317\2601)+\265\363\241\201\206 \267\221\3464\235\353\3O\16\3536J\310\366+\6A\2048n{\373I\34$s\3\213\4;\357s\214\375\2023$L\266\34\200@A\2E)\351\260\200\3007\255\37\335m\244\275\32\250\201\307\375\201\347\376D\227^ry\273\3533;\16", 10240, 0x0, 0, ... {status=0x0, info=10240}, )  (36, 0, 0, 0, "\320\33\205\320\373\2132\1\47\372\233rlN\3JDU{;?k\315w^\21@\260\271\255X\273\1~\5)\3606\330\31\270Dd\353\226\12\213rV \242\4\2452\27m\203\210\355;\317\375)\235&\24D-\0rA\272(\352\242Q\205\316\213\262\327\1\255\22\250\3244\204\370\255Tp\353\14nS\33;\373u\205\263\200`\215\324\221#=S\255^]\211\30\6\2:}\272)\201\3064\201\346<\15r\040\37\265z0\252\202VL\370\211;X\303\257\242\27\323\270G\230c\27}\304v\23$\2009\3\371\35\321\1\334\214\367\373_Uv\17 8\366`j\4\331\1\373\306Oh\13URu\37x\244\233\34\4$d\11\260Swv\333\301d\3\212\243\354""H\21\4\355\340\2063]\350\356\3\305\211\365\213\35P]h\370N\353Q\362s\217\356w3p\267\260\200\3v;\31w;;c\206\242\352an\211\5\24\14v\356\210\15\366,tVr\205\12\307\5\16\343A\341E\20\17\337\25'~\255\252Xu\247Qz[\13N9\245\277\31\16\0\200\17(D\20\10\350\341N\344\10\15\256\205\4E\260[[t\333\212\376\320\213\352\201\345\0\376\3\14\201\302\331\334\333\24\15\201\342\16\3069D\7\373\242\252(\221\305E\2135t\24\1c\316<\316~\355V\33K\274\373\217v\12\335;{y\270\340\266\10\271\213\5\377v\36W\20\355\260\363}+\373WS\300\206\245\353\11IP|\2166\16\271\274\210\317\2601)+\265\363\241\201\206 \267\221\3464\235\353\3O\16\3536J\310\366+\6A\2048n{\373I\34$s\3\213\4;\357s\214\375\2023$L\266\34\200@A\2E)\351\260\200\3007\255\37\335m\244\275\32\250\201\307\375\201\347\376D\227^ry\273\3533;\16", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00362   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "$>\276\225\211\366\330\3446.\206\216\374)`\4\240.\242}\263\366\33\14\220>7\21_\262\334\330H\252\333_\342\345\204d\27]\210\271:"\3550T\34\3D\5\341\22\314\20\352\313`\217\254\256Uc\272\254b$\21\10-$\362O\4\254\336L*\3558\1\37;\354\202\340\266nX\247U8b\314\236\260D\37_\257N|\200\207"d+\246\364\374\1\303\14\4\240FJ_y\355\30T\32\210#\360o\367>tt\355c\272EPsr590\27 \372\306\261\4\36\30\261\335.n\270M\13\242S4Q`%\274\266\202\210w\316y\311\257\246\327tw \347\0\31\316P\23ftW\230\354\331\334P"\260\253\201p\337W\247\27\357\13\15\212\17\303v\362\2030\\261#\314Wj\201QF&\7\12\323\332.K,\15\21\10\352\23\35\1\220\305\222n;n\1\4*\211\300\312\363V\206\240\274%h!\275\257\213\177\20D9!_\227\266\31s\273\367\326\14\224|\36`L\375\266\27F\372\374$\3744\335\374\213\325I\244\355\301\360;\352\3017\363\253\273\340\334x\267Mv\334\322\215g\14\36\374\360\255\267\6l\270\300\7\352PH\22,\261\200\262FWOJ\364\277C\10'\235[,\340\10g\245\242W\25\224\226\200\262\13\236G(\7740a\321\244R\352\317\203\350jF%m!Rp\202r\275D\13\243\275\265\312\366\326\275\326\231\332\17\27\324\257\300\205M,\366\333@\265\234\363M\21R\357\317E\354\0\265\210\213\374\331\24\306w\32416\14/\241B?\0C\314\367\3[8\0W\351\16\250(\317f\213'\240&s\234\357\203\1+;\251\200_Qrh\206\255\263#\372\316\256\204\302\222\317\366\34A\361\273o[\3B\300\247a\366kF\371,p\33\276\5\326\266\265\15", ) \3550T\34\3D\5\341\22\314\20\352\313`\217\254\256Uc\272\254b$\21\10-$\362O\4\254\336L*\3558\1\37;\354\202\340\266nX\247U8b\314\236\260D\37_\257N|\200\207 (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "$>\276\225\211\366\330\3446.\206\216\374)`\4\240.\242}\263\366\33\14\220>7\21_\262\334\330H\252\333_\342\345\204d\27]\210\271:"\3550T\34\3D\5\341\22\314\20\352\313`\217\254\256Uc\272\254b$\21\10-$\362O\4\254\336L*\3558\1\37;\354\202\340\266nX\247U8b\314\236\260D\37_\257N|\200\207"d+\246\364\374\1\303\14\4\240FJ_y\355\30T\32\210#\360o\367>tt\355c\272EPsr590\27 \372\306\261\4\36\30\261\335.n\270M\13\242S4Q`%\274\266\202\210w\316y\311\257\246\327tw \347\0\31\316P\23ftW\230\354\331\334P"\260\253\201p\337W\247\27\357\13\15\212\17\303v\362\2030\\261#\314Wj\201QF&\7\12\323\332.K,\15\21\10\352\23\35\1\220\305\222n;n\1\4*\211\300\312\363V\206\240\274%h!\275\257\213\177\20D9!_\227\266\31s\273\367\326\14\224|\36`L\375\266\27F\372\374$\3744\335\374\213\325I\244\355\301\360;\352\3017\363\253\273\340\334x\267Mv\334\322\215g\14\36\374\360\255\267\6l\270\300\7\352PH\22,\261\200\262FWOJ\364\277C\10'\235[,\340\10g\245\242W\25\224\226\200\262\13\236G(\7740a\321\244R\352\317\203\350jF%m!Rp\202r\275D\13\243\275\265\312\366\326\275\326\231\332\17\27\324\257\300\205M,\366\333@\265\234\363M\21R\357\317E\354\0\265\210\213\374\331\24\306w\32416\14/\241B?\0C\314\367\3[8\0W\351\16\250(\317f\213'\240&s\234\357\203\1+;\251\200_Qrh\206\255\263#\372\316\256\204\302\222\317\366\34A\361\273o[\3B\300\247a\366kF\371,p\33\276\5\326\266\265\15", ) \260\253\201p\337W\247\27\357\13\15\212\17\303v\362\2030\\261#\314Wj\201QF&\7\12\323\332.K,\15\21\10\352\23\35\1\220\305\222n;n\1\4*\211\300\312\363V\206\240\274%h!\275\257\213\177\20D9!_\227\266\31s\273\367\326\14\224|\36`L\375\266\27F\372\374$\3744\335\374\213\325I\244\355\301\360;\352\3017\363\253\273\340\334x\267Mv\334\322\215g\14\36\374\360\255\267\6l\270\300\7\352PH\22,\261\200\262FWOJ\364\277C\10'\235[,\340\10g\245\242W\25\224\226\200\262\13\236G(\7740a\321\244R\352\317\203\350jF%m!Rp\202r\275D\13\243\275\265\312\366\326\275\326\231\332\17\27\324\257\300\205M,\366\333@\265\234\363M\21R\357\317E\354\0\265\210\213\374\331\24\306w\32416\14/\241B?\0C\314\367\3[8\0W\351\16\250(\317f\213'\240&s\234\357\203\1+;\251\200_Qrh\206\255\263#\372\316\256\204\302\222\317\366\34A\361\273o[\3B\300\247a\366kF\371,p\33\276\5\326\266\265\15", ) == 0x0
 00363   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\17\204\365\225\242L\223\344\35\224\315\216\327\223+\4\213\224\351}\230LP\14\273\204|\21t\10\227\330c\20\220_\311_\317d<\347\303\271\21\230\2460\177\246HD.[Y\314;P\200`\244\26\345UH\0\347b\17\253C-\17H\4\4\207d\7*\306\202J\37\20V\311\340\235\324\23\247~\202)\314\265\12\17\37t\25\5|\253=id\0\34\277\374*yG\4\213\374\1_RWST12h\360DMut_W(\272n\3528r\36\203{\27\13@\215\261/\244S\261\366\224%\270f\261\351S\37\353+%\227\14\311\210\t2\311\204\34\234t\\232\254\02t\33\23M\316\34\230\307c\227P\11\12\340\201[e\34\247, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00364   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "2`&\342-\2539\356\4\4G\330\\27\261;\320\315Z\35\300A=\357\324\271L\20\372\326\351\225+:\223\377!\201\6\370T*Hu\240\307\367d7\16\23\315\33\22\276xD\23,A.\262\374-\345v\31\260\274\12\243\332%*\220~W\371L, \316c\31|\257\36\300 \266\17\215t\276P\25\246\24\5\272?p\36\30'fTp?\210p7WP$\257k\372\315\344\217\36\373h\342I[\254\217AHb-\373\377\346\325\14\05\2349\264\355C\373\367\377.\21.\320\333\277\261Y\216\240\324.\332:\300Cu\364\17\202\210\226\304o23\22\200\253\244\373(\233\32Ix<\242X\203W)~\26\3N\204\177\302\316\15q\241\270#\0\252\7\213\260\374\253\350-\3601SQ|T\30\364z%\35\307\366\202t\263Q\315P\221|\271o\377&\304\236\214\332\217X+\177.\303=\251\326\2620s\237\303b\205\6m\204\237\252\353\24\262\271J\220G\251_\370z\324Q\251\213\236\354o\326\307\177+\253tX\275\327\4\352\343&%\365-\3431S\363\216\3604\304\12\300\24\267c\0\336\34\210\265ZP;\5\235m\267z\32\350\35Fm\3467\352\30a\253sb\376>NO\17\211C[\26:\32g\301\325v\263\300\271\220I\273<\371S\6\243)\271\206\20:\24\243v\352\32\351/f\3438;\212\35\301\240p\361\1x'z\236\315\343\23T\357\356npN\272\371\3229\352e\240N\255`Qo\332e\360\366\222\2\4\278C\17\350?,0X\16@\260x\257<\211A2\33\376\3607W\224n\272\241\5\222\275\71\13\32\355\377\7\210N\35\253\324\26j7\374\305=\251\344\272\333h\271\27\347SW\226\23\242"\14E.!W\240p\254\213h(\264%\212\17\271=V$\316R\20", ) \14E.!W\240p\254\213h(\264%\212\17\271=V$\316R\20", ) == 0x0
 00365   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\31\332m\342\6\21r\356/\276\14\330w\255\372;\373w\21\35\353\373v\357\377\3\7\20\321l\242\225\0\200\330\377\12;M\370\177\220\3u\213}\274d\34\264X\3150\250\365xo\251gA\5\10\267-\316\314R\260\227\260\350\332\16\220\333~|C\7,\13t(\31W\25U\300\13\14D\215_\4\33\25\215\256N\272\24\312U\30\14\334\37p\242;7|\352o\257@@\206\344\244\244\260h\311\363\20\254\244\373\3b\6A\264\346\376\266K5\267\203\377\355hA\274\377\5\253e\320\360\5\372Y\245\32\237.\361\200\213C^ND\202\243,\217o\31\211Y\200\200\36\260(\260\240\2x\27\30\23\203|\2235\26(\364\317\177\351tFq\212\2h\0\201\275\300\260\327\21\243-\333\213\30QW\356S\364Q\237V\307\3358?\263zw\33\221W\3$\377\15~\325\214\3615\23+T\224\210=\202l\3710X%\210b\256\274&\204\264\20\240\24\231\3\1\220l\23\24\370Qn\32\251\240$\247o\375}4+\200\316\23\275\374\276\241\343\15\237\276-\310\213\30\363\245J\177\304!z_\267H\272\225\34\243\17\21P\20\277\326m\234\300Q\3506\374&\346\34PSa\200\311)\376\25\364\4\17\242\371\20\26\21\240,\301\376\314\370\300\222*\2\273\27C\30\6\210\223\362\206;\200_\243]PQ\351\4\334\2508\200V\301\213\312\272\1S\2351\236\346YXT\304T%pe\0\262\322\22P.\240e\27+QD`.\360\335(I\4<\202\10\17\303\205g0s\264\13\260S\25w\211j\210P\376\333\215\34\224E\0\352\5\271\7L1 \240\246\377,2\5\35\200n]j\34F\216=\202^\361\333C\3\\347x\355\335\23\211\230GE\5\233\34\240[\26\300h\3\16n\212$\3vV\17t\31\20", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00366   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "{j_8\10\335\333\1\222\3463\360Oc\253\222w.HQ/<\331\333\250\350o#y\222\3\252E\222"@G\271\227\7YxA3x\302N\363jH\271R\317\362J\3E\346KF\347\236K\210\216Q3j36C\270\273\266\17\17\2779\343S\272\200/u\273\27k\353\5\354;\237K\6\13^~\177\30\14\34\332\304\254n\221\30X \274\257\244\22\362_\1C\3022\31\204>LX\301U\21\241\206\10\274\2p\272\270\227)qM`(\365\364\302\217\271\35_x\371\223m\362\273\37\27 \252[#OV\335\14\23\343Y\4h\253\3\314u\356\373\323x\35692\313\356\237\343w\303\a\14^\36\4w\332$U#\223p\204o\211G_\340\362%/P\357?_v\6\270^gv:a\227\357\357ou\255\304=\272k\374\17\37\345\36\310#\301\332t\274\301\257o\363\354_#;\0\352\244\327\202H\250n\1\203\326\226\332\23\23\317\320\34\7Y\332o7n\352\344\1\351\26k\37\17\245K\22\333\272+|\232e\313|+\341o\2B\304\33r\7\32\251\371(\357/p\177\272\343\252\251\245\220\256<\167\20U\335\336\14\205\275S\26\277\253lE{\361\35\21\24\275\207~"\356O\263;\252WP.Td?v\266Zo\11\247\271\327\254P\316N2\330_x\304\261\2260 \251\10\2304\260*I\6)a\327\3'\272K\10` J\3517\271\13 \351\234je8\301[7\234\326\211\336\367\232+\3507O-\311\225\1O&$\226\334u\264'z\4", ) @G\271\227\7YxA3x\302N\363jH\271R\317\362J\3E\346KF\347\236K\210\216Q3j36C\270\273\266\17\17\2779\343S\272\200/u\273\27k\353\5\354;\237K\6\13^~\177\30\14\34\332\304\254n\221\30X \274\257\244\22\362_\1C\3022\31\204>LX\301U\21\241\206\10\274\2p\272\270\227)qM`(\365\364\302\217\271\35_x\371\223m\362\273\37\27 \252[#OV\335\14\23\343Y\4h\253\3\314u\356\373\323x\35692\313\356\237\343w\303\a\14^\36\4w\332$U#\223p\204o\211G_\340\362%/P\357?_v\6\270^gv:a\227\357\357ou\255\304=\272k\374\17\37\345\36\310#\301\332t\274\301\257o\363\354_#;\0\352\244\327\202H\250n\1\203\326\226\332\23\23\317\320\34\7Y\332o7n\352\344\1\351\26k\37\17\245K\22\333\272+|\232e\313|+\341o\2B\304\33r\7\32\251\371(\357/p\177\272\343\252\251\245\220\256<\167\20U\335\336\14\205\275S\26\277\253lE{\361\35\21\24\275\207~314\205\27\244 (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "{j_8\10\335\333\1\222\3463\360Oc\253\222w.HQ/<\331\333\250\350o#y\222\3\252E\222"@G\271\227\7YxA3x\302N\363jH\271R\317\362J\3E\346KF\347\236K\210\216Q3j36C\270\273\266\17\17\2779\343S\272\200/u\273\27k\353\5\354;\237K\6\13^~\177\30\14\34\332\304\254n\221\30X \274\257\244\22\362_\1C\3022\31\204>LX\301U\21\241\206\10\274\2p\272\270\227)qM`(\365\364\302\217\271\35_x\371\223m\362\273\37\27 \252[#OV\335\14\23\343Y\4h\253\3\314u\356\373\323x\35692\313\356\237\343w\303\a\14^\36\4w\332$U#\223p\204o\211G_\340\362%/P\357?_v\6\270^gv:a\227\357\357ou\255\304=\272k\374\17\37\345\36\310#\301\332t\274\301\257o\363\354_#;\0\352\244\327\202H\250n\1\203\326\226\332\23\23\317\320\34\7Y\332o7n\352\344\1\351\26k\37\17\245K\22\333\272+|\232e\313|+\341o\2B\304\33r\7\32\251\371(\357/p\177\272\343\252\251\245\220\256<\167\20U\335\336\14\205\275S\26\277\253lE{\361\35\21\24\275\207~"\356O\263;\252WP.Td?v\266Zo\11\247\271\327\254P\316N2\330_x\304\261\2260 \251\10\2304\260*I\6)a\327\3'\272K\10` J\3517\271\13 \351\234je8\301[7\234\326\211\336\367\232+\3507O-\311\225\1O&$\226\334u\264'z\4", ) , ) == 0x0
 00367   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "P\320\248#g\220\1\271\x\360d\331\340\222\\224\3Q\4\206\222\333\203R$#R(H\252n(i@l\3\334\7r\302\123Sx\5\363A\362\362R\344H\1\3n\\0F\314$\0\210\245\353xj\30\214\10\270\220\14D\17\224\203\250S\221:du\220\255 \353.Vp\237`\274@^U\305S\147`\217\254E+SX\13\6\344\2449H\24\1hxy\31\257\204\7X\352\357Z\241\255\262\367\2[\0\363\227\2\313\6`\3O\277\302\244\3V_SC\330m\331\1T\27\13\20\20#d\354\226\148Y\22\4C\21H\314^T\260\323STr2\340T\324\343\y\27a'\344U\4\`oU\10);\204D3\14_\313Hn/{Ut_]\274\363^L\314qa\274U\244o^\27\217=\221\321\267\174_U\310\10{\221t\227{\344o\330V\24#\20\272\241\244\3748\3\250E\273\310\326\275`X\23\344jW\7r`$7EP\257\1\302\254 \37$\37\0\22\360\0`|\261\337\200|\0[$\2i~Pr,\240\342\371\3UdpT\0\250\252\202\37\333\256\27\264|\20~g\225\14\256\7\30\26\224\21'EPKV\21?\7\314~\27\360\12=\347?\\244\11T\4\263\20\20\34P\5\356/?]\14\21o\27\313NXn\13TRU\14\220\330\304e\327\240 \333\270\0\211e\3\353\2\22\316\236\207\377W\4\13\244\313\333]%\257W\340X\35c\14#0\202`((*-9\243\32\4\333\1\20Q\323u\11\214\3\234\254{t\52\363\3453\304\232,{ \202\262\3234\233\220\2\6\2\333\234\3\14\0\0\10K\232\1\351\34\3@ \302&!e\23{\207\267l\302\336\334 `\350\34\365f\311\276\273\4&\17,\227u\237\2351\4", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00368   896   NtReadFile  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\225\2717\312GuN\20\204*Q\33\313\330\177{$\227\223\203\342\350u\327\366Fd \7+\16\253\266D<\12\260)\213!\346 \266;\11\353\16*n~\2442\253\352\343\357\12|\354\315\261`\13\35\341\11\24Q\252\312\1\372O+\277*\334k\336\307\356y\216%\326\22\220\11qZ\2603v-%\31\367\370\366\271\367kx%\276\227)!Bn92\362`\5\300\3759\5-gF\31\335[\333\2038\22\205_\223\263\331\257\337>K\237uq\6\271\267jP!\356C\4 \270\6\6z\254`\2I\201/\202\36\260HF\217*B\213j\373\232k\311\244\332\254%\273v\350\3478\273\312\347Ys\20\2466\222\2d\316\351\352`b\302\2249\217];'\271\5+N\201Vb\32\234[\2148\31\373Y7(C\254\14\253o$\347\217O\16\33\202\206\226\226\253%\15\303\212\253\301\33\212\302/\275\326\215l[\256I\374%\352\37\14J\342\345d\344,\320\17^\330\325E\10\20C\25qB!-\231\13\177\2cje!\10G\335t\276"X\211\351\257m)\14\347a\200\374E\301\247cY\235$\30\244\31\221\337\15\321G\262}\14\233u^\21\32\0\12\14\7\332\2730\27\373\206,\340\344J1\256\206c\202S\358\370y\301\377%\346\256\324\21\22HK\24\232\344B\347bq-\356@\266\337\11v\326\202`\362\336[\367;\340w[V\261Om1\361\227lY\270\207")l)\343\363\261}c\304\2668\12\257\332@#", ) \276\227)!Bn92\362`\5\300\3759\5-gF\31\335[\333\2038\22\205_\223\263\331\257\337>K\237uq\6\271\267jP!\356C\4 \270\6\6z\254`\2I\201/\202\36\260HF\217*B\213j\373\232k\311\244\332\254%\273v\350\3478\273\312\347Ys\20\2466\222\2d\316\351\352`b\302\2249\217];'\271\5+N\201Vb\32\234[\2148\31\373Y7(C\254\14\253o$\347\217O\16\33\202\206\226\226\253%\15\303\212\253\301\33\212\302/\275\326\215l[\256I\374%\352\37\14J\342\345d\344,\320\17^\330\325E\10\20C\25qB!-\231\13\177\2cje!\10G\335t\276 (32, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\225\2717\312GuN\20\204*Q\33\313\330\177{$\227\223\203\342\350u\327\366Fd \7+\16\253\266D<\12\260)\213!\346 \266;\11\353\16*n~\2442\253\352\343\357\12|\354\315\261`\13\35\341\11\24Q\252\312\1\372O+\277*\334k\336\307\356y\216%\326\22\220\11qZ\2603v-%\31\367\370\366\271\367kx%\276\227)!Bn92\362`\5\300\3759\5-gF\31\335[\333\2038\22\205_\223\263\331\257\337>K\237uq\6\271\267jP!\356C\4 \270\6\6z\254`\2I\201/\202\36\260HF\217*B\213j\373\232k\311\244\332\254%\273v\350\3478\273\312\347Ys\20\2466\222\2d\316\351\352`b\302\2249\217];'\271\5+N\201Vb\32\234[\2148\31\373Y7(C\254\14\253o$\347\217O\16\33\202\206\226\226\253%\15\303\212\253\301\33\212\302/\275\326\215l[\256I\374%\352\37\14J\342\345d\344,\320\17^\330\325E\10\20C\25qB!-\231\13\177\2cje!\10G\335t\276"X\211\351\257m)\14\347a\200\374E\301\247cY\235$\30\244\31\221\337\15\321G\262}\14\233u^\21\32\0\12\14\7\332\2730\27\373\206,\340\344J1\256\206c\202S\358\370y\301\377%\346\256\324\21\22HK\24\232\344B\347bq-\356@\266\337\11v\326\202`\362\336[\367;\340w[V\261Om1\361\227lY\270\207")l)\343\363\261}c\304\2668\12\257\332@#", ) )l)\343\363\261}c\304\2668\12\257\332@#", ) == 0x0
 00369   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\276\3|\312l\317\5\20\257\220\32\33\340b4{\17-\330\20\30X\243u\374L\15d\13\275`\16\200\14\17\313\21\260\30\314f%2M\263\366\222M x\16\206\14\344f\11K(H\16\22\240a\240\13\20E\212\330\254\215@|d\12\11\221\233\315\2\210\333\21S\370\336a\331\11I\13\B\343\1\217w\267\14\306\217\376\213\250X\302*\30\301\260`!\20\212\23z\4\301\373\252\211:X6\13R\216\22\14\223\271\230\365\227\2\233\11n\22\210\271`.z\2669.\227,F2g\20\333\250\202Y\205t)\370\331\204euK\264\317:\6\222\15!P\12T\10\4\13\2M\6Q\26+\2b;d\2025\12\3F\244\220\11\213AA\321k\342\36\221\254\16\1=\350\314\202\360\312\314\3438\20\215\214\331\2Ot\242\352K\330\211\224\225\26;\14\3N+e;\35b1&\20\214\23\243\260Y\34\222\10\254'\21$$\3145\4\1608\315\226\275\21n\15\3500\340\30100\211/\226l\306lp\24\2\374\16PT\14aX\256d\317\226\233\17ub\236E#\252\10\2\36\313\11!\6#@\177)\331!e\12\262\14\335_\4iX\242S\344m\2\266\254a\253F\16\301\214\331\22\235\17\242\357\31\272eF\321l\106\14\260\317\25\211\272A\14,`\3600"\2\326b\343\330\136c\357\14s\12\204`\13#", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \313\21\260\30\314f%2M\263\366\222M x\16\206\14\344f\11K(H\16\22\240a\240\13\20E\212\330\254\215@|d\12\11\221\233\315\2\210\333\21S\370\336a\331\11I\13\B\343\1\217w\267\14\306\217\376\213\250X\302*\30\301\260`!\20\212\23z\4\301\373\252\211:X6\13R\216\22\14\223\271\230\365\227\2\233\11n\22\210\271`.z\2669.\227,F2g\20\333\250\202Y\205t)\370\331\204euK\264\317:\6\222\15!P\12T\10\4\13\2M\6Q\26+\2b;d\2025\12\3F\244\220\11\213AA\321k\342\36\221\254\16\1=\350\314\202\360\312\314\3438\20\215\214\331\2Ot\242\352K\330\211\224\225\26;\14\3N+e;\35b1&\20\214\23\243\260Y\34\222\10\254'\21$$\3145\4\1608\315\226\275\21n\15\3500\340\30100\211/\226l\306lp\24\2\374\16PT\14aX\256d\317\226\233\17ub\236E#\252\10\2\36\313\11!\6#@\177)\331!e\12\262\14\335_\4iX\242S\344m\2\266\254a\253F\16\301\214\331\22\235\17\242\357\31\272eF\321l\106\14\260\317\25\211\272A\14,`\3600315,\313^\11\205<(\202x\247s\370R{\264%\315\24\237\219\362\0\24\261^\11\347I\313f\356k\14\224\11]l\311`\331d\20\367\20Z<[}\13\4m\32K\334lr\2\314 (36, 0, 0, 0, "\276\3|\312l\317\5\20\257\220\32\33\340b4{\17-\330\20\30X\243u\374L\15d\13\275`\16\200\14\17\313\21\260\30\314f%2M\263\366\222M x\16\206\14\344f\11K(H\16\22\240a\240\13\20E\212\330\254\215@|d\12\11\221\233\315\2\210\333\21S\370\336a\331\11I\13\B\343\1\217w\267\14\306\217\376\213\250X\302*\30\301\260`!\20\212\23z\4\301\373\252\211:X6\13R\216\22\14\223\271\230\365\227\2\233\11n\22\210\271`.z\2669.\227,F2g\20\333\250\202Y\205t)\370\331\204euK\264\317:\6\222\15!P\12T\10\4\13\2M\6Q\26+\2b;d\2025\12\3F\244\220\11\213AA\321k\342\36\221\254\16\1=\350\314\202\360\312\314\3438\20\215\214\331\2Ot\242\352K\330\211\224\225\26;\14\3N+e;\35b1&\20\214\23\243\260Y\34\222\10\254'\21$$\3145\4\1608\315\226\275\21n\15\3500\340\30100\211/\226l\306lp\24\2\374\16PT\14aX\256d\317\226\233\17ub\236E#\252\10\2\36\313\11!\6#@\177)\331!e\12\262\14\335_\4iX\242S\344m\2\266\254a\253F\16\301\214\331\22\235\17\242\357\31\272eF\321l\106\14\260\317\25\211\272A\14,`\3600"\2\326b\343\330\136c\357\14s\12\204`\13#", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00370   896   NtReadFile  (32, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048},  (32, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\367\351K\0\307\351K\0\203\336K\0\223\336K\0\3\311K\0\23\311K\0c\311K\0{\311K\0s\311K\0K\311K\0C\311K\0[\311K\0S\311K\0\253\311K\0\243\311K\0\273\311K\0\317\311K\0\323\311K\07\316K\0K\316K\0\277\316K\0\307\316K\0?\317K\0\177\317K\0\377\317K\0\7\314K\0\343\315K\0\37\303K\0_\303K\0s\300K\0\317\300K\0\223\306K\0\353\304K\0\243:K\0G;K\0'8K\0\2478K\0\3478K\0\3539K\0\3139K\0/>K\0\37>K\0\263\351N\0\313\351N\0\374\203L\0\300\203L\0)\200L\01\200L\0\37\200L\0e\200L\0B\200L\0\257\200L\0\213\200L\0\222\200L\0\377\200L\0\303\200L\0\325\200L\09\201L\0\3\201L\0j\201L\0{\201L\0V\201L\0\275\201L\0\234\201L\0\372\201L\0\323\201L\00\206L\0a\206L\0D\206L\0\271\206L\0\352\206L\0\312\206L\0/\207L\0\22\207L\0L\207L\0W\207L\0\271\207L\0\201\207L\0\353\207L\0\375\207L\0\307\207L\0*\204L\01\204L\0\4\204L\0o\204L\0u\204L\0R\204L\0\257\204L\0\241\204L\0\270\204L\0\264\204L\07\272]\0<\272R\0?\272S\0>\272Q\0/\272H\0#\272L\0-\272N\0\0\272P\06\272U\0\17\272k\0\3\272a\0\2\272j\0\10\272i\04\272n\0\15\272l\08\272Z\09\272G\0;\272E\0$\272F\0 \272A\0"\272g\0+\272I\0*\272e\0\6\272K\0+\272K\0+\272K\0+\272K@\17\302;$\32\210\5m^\336;@\177\364\6Uo\352K@\17\302;$\32\217\5m", ) \272g\0+\272I\0*\272e\0\6\272K\0+\272K\0+\272K\0+\272K@\17\302;$\32\210\5m^\336;@\177\364\6Uo\352K@\17\302;$\32\217\5m", ) == 0x0
 00371   896   NtWriteFile  (36, 0, 0, 0,  (36, 0, 0, 0, "\334S\0\0\354S\0\0\250d\0\0\270d\0\0(s\0\08s\0\0Hs\0\0Ps\0\0Xs\0\0`s\0\0hs\0\0ps\0\0xs\0\0\200s\0\0\210s\0\0\220s\0\0\344s\0\0\370s\0\0\34t\0\0`t\0\0\224t\0\0\354t\0\0\24u\0\0Tu\0\0\324u\0\0,v\0\0\310w\0\04y\0\0ty\0\0Xz\0\0\344z\0\0\270|\0\0\300~\0\0\210\200\0\0l\201\0\0\14\202\0\0\214\202\0\0\314\202\0\0\300\203\0\0\340\203\0\0\4\204\0\04\204\0\0\230S\5\0\340S\5\0\3279\7\0\3539\7\0\2:\7\0\32:\7\04:\7\0N:\7\0i:\7\0\204:\7\0\240:\7\0\271:\7\0\324:\7\0\350:\7\0\376:\7\0\22;\7\0(;\7\0A;\7\0P;\7\0};\7\0\226;\7\0\267;\7\0\321;\7\0\370;\7\0\33<\7\0J<\7\0o<\7\0\222<\7\0\301<\7\0\341<\7\0\4=\7\09=\7\0g=\7\0|=\7\0\222=\7\0\252=\7\0\300=\7\0\326=\7\0\354=\7\0\1>\7\0\32>\7\0/>\7\0D>\7\0^>\7\0y>\7\0\204>\7\0\212>\7\0\223>\7\0\237>\7\0\34\0\26\0\27\0\31\0\24\0\30\0\25\0\32\0\4\0\3\0\10\0\7\0\6\0\5\0+\0\33\0\35\0\36\0$\0 \0(\0*\0)\0!\0#\0"\0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) \0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) == 0x0
 00372   896   NtClose  (36, ... ) == 0x0
 00373   896   NtClose  (32, ... ) == 0x0
 00374   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.tmp"}, 1242356, ... ) }, 1242356, ... ) == 0x0
 00375   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.tmp"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00376   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 32, ... 36, ) == 0x0
 00377   896   NtClose  (32, ... ) == 0x0
 00378   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x320000), 0x0, 176128, ) == 0x0
 00379   896   NtClose  (36, ... ) == 0x0
 00380   896   NtUnmapViewOfSection  (-1, 0x320000, ... ) == 0x0
 00381   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.tmp"}, 1242664, ... ) }, 1242664, ... ) == 0x0
 00382   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.tmp"}, 1242664, ... ) }, 1242664, ... ) == 0x0
 00383   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.tmp"}, 5, 96, ... 36, {status=0x0, info=1}, ) }, 5, 96, ... 36, {status=0x0, info=1}, ) == 0x0
 00384   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 36, ... 32, ) == 0x0
 00385   896   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00386   896   NtOpenProcessToken  (-1, 0x8, ... 40, ) == 0x0
 00387   896   NtQueryInformationToken  (40, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00388   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00389   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 44, ) }, ... 44, ) == 0x0
 00390   896   NtQueryValueKey  (44,  (44, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (44, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00391   896   NtClose  (44, ... ) == 0x0
 00392   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00393   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 44, ) == 0x0
 00394   896   NtQueryInformationToken  (44, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00395   896   NtClose  (44, ... ) == 0x0
 00396   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00397   896   NtClose  (40, ... ) == 0x0
 00398   896   NtClose  (36, ... ) == 0x0
 00399   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x320000), 0x0, 475136, ) == STATUS_IMAGE_NOT_AT_BASE
 00400   896   NtMapViewOfSection  (32, -1, (0x320000), 0, 0, 0x0, 475136, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00401   896   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00402   896   NtClose  (32, ... ) == 0x0
 00403   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 8, ) == 0x0
 00404   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 8, ... (0x393000), 4096, 4, ) == 0x0
 00405   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00406   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00407   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00408   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00409   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.DLL"}, ... 32, ) }, ... 32, ) == 0x0
 00410   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 00411   896   NtClose  (32, ... ) == 0x0
 00412   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00413   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00414   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00415   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 32, ) }, ... 32, ) == 0x0
 00416   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00417   896   NtClose  (32, ... ) == 0x0
 00418   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00419   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00420   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00421   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00422   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00423   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00424   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 32, ) }, ... 32, ) == 0x0
 00425   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00426   896   NtClose  (32, ... ) == 0x0
 00427   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00428   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00429   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00430   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00431   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00432   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00433   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00434   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00435   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00436   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00437   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00438   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00439   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00440   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00441   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00442   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00443   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00444   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00445   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00446   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00447   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00448   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00449   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00450   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00451   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00452   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00453   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00454   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00455   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00456   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00457   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.DLL"}, ... 32, ) }, ... 32, ) == 0x0
 00458   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 73728, ) == 0x0
 00459   896   NtClose  (32, ... ) == 0x0
 00460   896   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00461   896   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00462   896   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00463   896   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00464   896   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00465   896   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00466   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00467   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00468   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00469   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 32, ) }, ... 32, ) == 0x0
 00470   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00471   896   NtClose  (32, ... ) == 0x0
 00472   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00473   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00474   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00475   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00476   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00477   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00478   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00479   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00480   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00481   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 32, ) }, ... 32, ) == 0x0
 00482   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00483   896   NtClose  (32, ... ) == 0x0
 00484   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00485   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00486   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00487   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00488   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00489   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00490   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00491   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00492   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00493   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00494   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00495   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00496   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00497   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00498   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00499   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00500   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00501   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00502   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.DLL"}, ... 32, ) }, ... 32, ) == 0x0
 00503   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00504   896   NtClose  (32, ... ) == 0x0
 00505   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00506   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00507   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00508   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00509   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00510   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00511   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00512   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00513   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00514   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00515   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00516   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00517   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00518   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00519   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00520   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00521   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00522   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00523   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00524   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00525   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00526   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00527   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00528   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00529   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00530   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00531   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00532   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00533   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WSOCK32.DLL"}, 1241868, ... ) }, 1241868, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00534   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 1241868, ... ) }, 1241868, ... ) == 0x0
 00535   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00536   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 32, ... 36, ) == 0x0
 00537   896   NtQuerySection  (36, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00538   896   NtClose  (32, ... ) == 0x0
 00539   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0
 00540   896   NtClose  (36, ... ) == 0x0
 00541   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00542   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1241052, ... ) }, 1241052, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00543   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1241052, ... ) }, 1241052, ... ) == 0x0
 00544   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 36, {status=0x0, info=1}, ) }, 5, 96, ... 36, {status=0x0, info=1}, ) == 0x0
 00545   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 36, ... 32, ) == 0x0
 00546   896   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00547   896   NtClose  (36, ... ) == 0x0
 00548   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00549   896   NtClose  (32, ... ) == 0x0
 00550   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00551   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00552   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00553   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00554   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1240236, ... ) }, 1240236, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00555   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1240236, ... ) }, 1240236, ... ) == 0x0
 00556   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00557   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 32, ... 36, ) == 0x0
 00558   896   NtQuerySection  (36, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00559   896   NtClose  (32, ... ) == 0x0
 00560   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00561   896   NtClose  (36, ... ) == 0x0
 00562   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00563   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00564   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00565   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00566   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00567   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00568   896   NtProtectVirtualMemory  (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0
 00569   896   NtProtectVirtualMemory  (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0
 00570   896   NtFlushInstructionCache  (-1, 1907167232, 52, ... ) == 0x0
 00571   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00572   896   NtProtectVirtualMemory  (-1, (0x393000), 4096, 4, ... (0x393000), 4096, 4, ) == 0x0
 00573   896   NtFlushInstructionCache  (-1, 3747840, 4096, ... ) == 0x0
 00574   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00575   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00576   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1241312, 2090320424, 1241348, 1241324}  (24, {28, 56, new_msg, 0, 1241312, 2090320424, 1241348, 1241324} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81835, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81835, 0}  (24, {28, 56, new_msg, 0, 1241312, 2090320424, 1241348, 1241324} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81835, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00577   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238716, ... ) }, 1238716, ... ) == 0x0
 00578   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 36, {status=0x0, info=1}, ) }, 5, 96, ... 36, {status=0x0, info=1}, ) == 0x0
 00579   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 36, ... 32, ) == 0x0
 00580   896   NtClose  (36, ... ) == 0x0
 00581   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3a0000), 0x0, 110592, ) == 0x0
 00582   896   NtClose  (32, ... ) == 0x0
 00583   896   NtUnmapViewOfSection  (-1, 0x3a0000, ... ) == 0x0
 00584   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238624, ... ) }, 1238624, ... ) == 0x0
 00585   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00586   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 32, ... 36, ) == 0x0
 00587   896   NtClose  (32, ... ) == 0x0
 00588   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3a0000), 0x0, 110592, ) == 0x0
 00589   896   NtClose  (36, ... ) == 0x0
 00590   896   NtUnmapViewOfSection  (-1, 0x3a0000, ... ) == 0x0
 00591   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238932, ... ) }, 1238932, ... ) == 0x0
 00592   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 36, {status=0x0, info=1}, ) }, 5, 96, ... 36, {status=0x0, info=1}, ) == 0x0
 00593   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 36, ... 32, ) == 0x0
 00594   896   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00595   896   NtClose  (36, ... ) == 0x0
 00596   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00597   896   NtClose  (32, ... ) == 0x0
 00598   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00599   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00600   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00601   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00602   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00603   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00604   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00605   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00606   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00607   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00608   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00609   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1235848, ... ) }, 1235848, ... ) == 0x0
 00610   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00611   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMCTL32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00612   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPR.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00613   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00614   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLE32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00615   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00616   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00617   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00618   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00619   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ebe3.tmp"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00620   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 00621   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00622   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0
 00623   896   NtQueryValueKey  (32,  (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00624   896   NtClose  (32, ... ) == 0x0
 00625   896   NtMapViewOfSection  (-2147482756, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x550000), 0x0, 1060864, ) == 0x0
 00626   896   NtClose  (-2147482756, ... ) == 0x0
 00627   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00628   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00629   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482756, ) == 0x0
 00630   896   NtQueryInformationToken  (-2147482756, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00631   896   NtQueryInformationToken  (-2147482756, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00632   896   NtClose  (-2147482756, ... ) == 0x0
 00633   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3801088, 4096, ) == 0x0
 00634   896   NtFreeVirtualMemory  (-1, (0x3a0000), 4096, 32768, ... (0x3a0000), 4096, ) == 0x0
 00635   896   NtDuplicateObject  (-1, 36, -1, 0x0, 0, 2, ... 44, ) == 0x0
 00636   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00637   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00638   896   NtClose  (-2147482756, ... ) == 0x0
 00639   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00640   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00641   896   NtClose  (-2147482756, ... ) == 0x0
 00642   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00643   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00644   896   NtUserCallNoParam  (24, ... ) == 0x0
 00645   896   NtGdiCreateCompatibleDC  (0, ...
 00646   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3801088, 4096, ) == 0x0
 00645   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00647   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00648   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00649   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00650   896   NtGdiCreateSolidBrush  (0, 0, ...
 00651   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3866624, 4096, ) == 0x0
 00650   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00652   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00653   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00654   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00655   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x28
 00656   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 48, ) }, ... 48, ) == 0x0
 00657   896   NtQueryValueKey  (48,  (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00658   896   NtClose  (48, ... ) == 0x0
 00659   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10011
 00660   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 673, 128, 0, ... ) == 0x8177c017
 00661   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10011
 00662   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 674, 128, 0, ... ) == 0x8177c01c
 00663   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10011
 00664   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 675, 128, 0, ... ) == 0x8177c01e
 00665   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10011
 00666   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 676, 128, 0, ... ) == 0x81778002
 00667   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10013
 00668   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 677, 128, 0, ... ) == 0x8177c018
 00669   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10011
 00670   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 678, 128, 0, ... ) == 0x8177c01a
 00671   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10011
 00672   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 679, 128, 0, ... ) == 0x8177c01d
 00673   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10011
 00674   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 681, 128, 0, ... ) == 0x8177c026
 00675   896   NtUserFindExistingCursorIcon  (1240428, 1240444, 1240492, ... ) == 0x10011
 00676   896   NtUserRegisterClassExWOW  (1240440, 1240508, 1240524, 1240540, 680, 128, 0, ... ) == 0x8177c019
 00677   896   NtUserRegisterClassExWOW  (1240392, 1240460, 1240476, 1240492, 0, 128, 0, ... ) == 0x8177c020
 00678   896   NtUserRegisterClassExWOW  (1240648, 1240744, 1240728, 1240716, 0, 130, 0, ... ) == 0x8177c022
 00679   896   NtUserRegisterClassExWOW  (1240392, 1240460, 1240476, 1240492, 0, 128, 0, ... ) == 0x8177c023
 00680   896   NtUserRegisterClassExWOW  (1240648, 1240744, 1240728, 1240716, 0, 130, 0, ... ) == 0x8177c024
 00681   896   NtUserRegisterClassExWOW  (1240392, 1240460, 1240476, 1240492, 0, 128, 0, ... ) == 0x8177c025
 00682   896   NtCallbackReturn  (0, 0, 0, ...
 00683   896   NtGdiInit  (... ) == 0x1
 00684   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00685   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00686   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00687   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3932160, 65536, ) == 0x0
 00688   896   NtAllocateVirtualMemory  (-1, 3932160, 0, 4096, 4096, 4, ... 3932160, 4096, ) == 0x0
 00689   896   NtAllocateVirtualMemory  (-1, 3936256, 0, 8192, 4096, 4, ... 3936256, 8192, ) == 0x0
 00690   896   NtAllocateVirtualMemory  (-1, 3944448, 0, 4096, 4096, 4, ... 3944448, 4096, ) == 0x0
 00691   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 48, ) }, ... 48, ) == 0x0
 00692   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x3d0000), 0x0, 12288, ) == 0x0
 00693   896   NtClose  (48, ... ) == 0x0
 00694   896   NtAllocateVirtualMemory  (-1, 3948544, 0, 4096, 4096, 4, ... 3948544, 4096, ) == 0x0
 00695   896   NtQueryDefaultUILanguage  (1240984, ...
 00696   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00697   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 00698   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00699   896   NtClose  (-2147482756, ... ) == 0x0
 00700   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00701   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00702   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00703   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00704   896   NtClose  (-2147481452, ... ) == 0x0
 00705   896   NtClose  (-2147482756, ... ) == 0x0
 00695   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00706   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL"}, 1, 96, ... 48, {status=0x0, info=1}, ) }, 1, 96, ... 48, {status=0x0, info=1}, ) == 0x0
 00707   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 48, ... 52, ) == 0x0
 00708   896   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x960000), 0x0, 618496, ) == 0x0
 00709   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00710   896   NtQueryDefaultUILanguage  (2090319928, ...
 00711   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00712   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 00713   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00714   896   NtClose  (-2147482756, ... ) == 0x0
 00715   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00716   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00717   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00718   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00719   896   NtClose  (-2147481452, ... ) == 0x0
 00720   896   NtClose  (-2147482756, ... ) == 0x0
 00710   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00721   896   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00722   896   NtQueryDefaultLocale  (1, 1239080, ... ) == 0x0
 00723   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00724   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240116, 1179817, 1239840}  (24, {128, 156, new_msg, 0, 2088850039, 1240116, 1179817, 1239840} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\10\0\0\0\377\377\377\377\0\0\0\0\340q\235\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0(\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81838, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\10\0\0\0\377\377\377\377\0\0\0\0\340q\235\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0(\360\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81838, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240116, 1179817, 1239840} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\10\0\0\0\377\377\377\377\0\0\0\0\340q\235\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0(\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81838, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\10\0\0\0\377\377\377\377\0\0\0\0\340q\235\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0(\360\22\0\0\0\0\0" )  ) == 0x0
 00725   896   NtClose  (48, ... ) == 0x0
 00726   896   NtClose  (52, ... ) == 0x0
 00727   896   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 00728   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00729   896   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 52, ) == 0x0
 00730   896   NtQueryInformationProcess  (52, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00731   896   NtClose  (52, ... ) == 0x0
 00732   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00733   896   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 00734   896   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 00735   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00736   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 52, ) == 0x0
 00737   896   NtQueryInformationToken  (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00738   896   NtClose  (52, ... ) == 0x0
 00739   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 52, ) }, ... 52, ) == 0x0
 00740   896   NtOpenProcessToken  (-1, 0x8, ... 48, ) == 0x0
 00741   896   NtAccessCheck  (1330816, 48, 0x1, 1242176, 1242228, 56, 1242208, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00742   896   NtClose  (48, ... ) == 0x0
 00743   896   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Control Panel\Desktop"}, ... 48, ) }, ... 48, ) == 0x0
 00744   896   NtQueryValueKey  (48,  (48, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00745   896   NtClose  (48, ... ) == 0x0
 00746   896   NtUserSystemParametersInfo  (41, 500, 1242356, 0, ... ) == 0x1
 00747   896   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 00748   896   NtClose  (52, ... ) == 0x0
 00749   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00750   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00751   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c03b
 00752   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c03d
 00753   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00754   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c03f
 00755   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00756   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c041
 00757   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00758   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c043
 00759   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c045
 00760   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00761   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c047
 00762   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00763   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c049
 00764   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00765   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c04b
 00766   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00767   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c04d
 00768   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00769   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c04f
 00770   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c051
 00771   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00772   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c053
 00773   896   NtUserFindExistingCursorIcon  (1242104, 1242120, 1242168, ... ) == 0x10011
 00774   896   NtUserRegisterClassExWOW  (1242048, 1242116, 1242132, 1242148, 0, 384, 0, ... ) == 0x8177c055
 00775   896   NtUserFindExistingCursorIcon  (1242104, 1242120, 1242168, ... ) == 0x10011
 00776   896   NtUserRegisterClassExWOW  (1242048, 1242116, 1242132, 1242148, 0, 384, 0, ... ) == 0x8177c057
 00777   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00778   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c059
 00779   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10013
 00780   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c05b
 00781   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00782   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c05d
 00783   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00784   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c05f
 00785   896   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 52, ) == 0x0
 00786   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 48, ) == 0x0
 00787   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 56, ) }, ... 56, ) == 0x0
 00788   896   NtNotifyChangeKey  (56, 48, 0, 0, 2011455960, 4, 0, 0, 0, 1, ... ) == 0x103
 00789   896   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00790   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 60, ) == 0x0
 00791   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 64, ) == 0x0
 00792   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00793   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 00794   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 4096, 4096, 4, ... 4128768, 4096, ) == 0x0
 00795   896   NtAllocateVirtualMemory  (-1, 4132864, 0, 8192, 4096, 4, ... 4132864, 8192, ) == 0x0
 00796   896   NtAllocateVirtualMemory  (-1, 4141056, 0, 4096, 4096, 4, ... 4141056, 4096, ) == 0x0
 00797   896   NtAllocateVirtualMemory  (-1, 4145152, 0, 4096, 4096, 4, ... 4145152, 4096, ) == 0x0
 00798   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00799   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00800   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00801   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00802   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00803   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 68, {status=0x0, info=0}, ) }, 7, 16, ... 68, {status=0x0, info=0}, ) == 0x0
 00804   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "j\304\202\333\270\22\341\230@X\212\251\266^\257\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00805   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00806   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00807   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00808   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00809   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00810   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00811   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00812   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482756, 2, ) }, 0, 0x0, 0, ... -2147482756, 2, ) == 0x0
 00813   896   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "\326\2317\254AR\232\347\255\266\367&\326:\200\332\30\333\244\271~P\264\17\344\36\326\327$\21t\3535\356`\330\210\360\327\27\6\274\201\242(\257W\240\207\270kJ\370]\344\221\367p\350\30^fw\270\215\217\320\266yG\226\4\216\320\327l%A\205G", 80, ... ) , 0, 3,  (-2147482756, "Seed", 0, 3, "\326\2317\254AR\232\347\255\266\367&\326:\200\332\30\333\244\271~P\264\17\344\36\326\327$\21t\3535\356`\330\210\360\327\27\6\274\201\242(\257W\240\207\270kJ\370]\344\221\367p\350\30^fw\270\215\217\320\266yG\226\4\216\320\327l%A\205G", 80, ... ) , 80, ... ) == 0x0
 00814   896   NtClose  (-2147482756, ... ) == 0x0
 00804   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\235\351Aj\7l\335\274\312^\327i\306K\212E;\353|\25\300\372\332\341\357d2\31\3141}\363o\2166\342\261+\2343b\332-\263D\27\223\376^\333'M\277\241kw\221\336\264\301"\345\211\245\311\314\2225p\230z\244\234\217up:\376mC:\224\232Wj\353\373,r=T\304Qr\255\13/\2105\331\2062\275D\204R\340\23m\15\177\323\251\373%\240i^\306\275\370cQ\x\367\321\214m\255\240?$\243,\327\335\214\311!\30\324/\234\371\272\35\237\26\2352\227\373\354v\252\316\230\16\337\3150\243:\370\371q\23\23k\207\7\335:U\377\244\253.NI5\321\34\372\6\354\6\203\37\346\10\36H\10\215\247{\13\255H\331\300\241\213D\264\34\256\247\256\2\356\346\347\346\25\370m\373\5\224\363\254\257\311\7\2612\274\26\3122@\225L\236\311"\22\212\2315}D\24f#\1\206\214q_\240", ) \345\211\245\311\314\2225p\230z\244\234\217up:\376mC:\224\232Wj\353\373,r=T\304Qr\255\13/\2105\331\2062\275D\204R\340\23m\15\177\323\251\373%\240i^\306\275\370cQ\x\367\321\214m\255\240?$\243,\327\335\214\311!\30\324/\234\371\272\35\237\26\2352\227\373\354v\252\316\230\16\337\3150\243:\370\371q\23\23k\207\7\335:U\377\244\253.NI5\321\34\372\6\354\6\203\37\346\10\36H\10\215\247{\13\255H\331\300\241\213D\264\34\256\247\256\2\356\346\347\346\25\370m\373\5\224\363\254\257\311\7\2612\274\26\3122@\225L\236\311 ... {status=0x0, info=256}, "\235\351Aj\7l\335\274\312^\327i\306K\212E;\353|\25\300\372\332\341\357d2\31\3141}\363o\2166\342\261+\2343b\332-\263D\27\223\376^\333'M\277\241kw\221\336\264\301"\345\211\245\311\314\2225p\230z\244\234\217up:\376mC:\224\232Wj\353\373,r=T\304Qr\255\13/\2105\331\2062\275D\204R\340\23m\15\177\323\251\373%\240i^\306\275\370cQ\x\367\321\214m\255\240?$\243,\327\335\214\311!\30\324/\234\371\272\35\237\26\2352\227\373\354v\252\316\230\16\337\3150\243:\370\371q\23\23k\207\7\335:U\377\244\253.NI5\321\34\372\6\354\6\203\37\346\10\36H\10\215\247{\13\255H\331\300\241\213D\264\34\256\247\256\2\356\346\347\346\25\370m\373\5\224\363\254\257\311\7\2612\274\26\3122@\225L\236\311"\22\212\2315}D\24f#\1\206\214q_\240", ) , ) == 0x0
 00815   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00816   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00817   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 72, ) }, ... 72, ) == 0x0
 00818   896   NtQueryValueKey  (72,  (72, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00819   896   NtClose  (72, ... ) == 0x0
 00820   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 72, ) }, ... 72, ) == 0x0
 00821   896   NtQueryValueKey  (72,  (72, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00822   896   NtClose  (72, ... ) == 0x0
 00823   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00824   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00825   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00826   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00827   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 72, ) }, ... 72, ) == 0x0
 00828   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00829   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00830   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00831   896   NtClose  (72, ... ) == 0x0
 00832   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 72, ) }, ... 72, ) == 0x0
 00833   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00834   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00835   896   NtClose  (72, ... ) == 0x0
 00836   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 72, ) }, ... 72, ) == 0x0
 00837   896   NtOpenEvent  (0x1f0003, {24, 72, 0x0, 0, 0,  (0x1f0003, {24, 72, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00838   896   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 00839   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00840   896   NtOpenKey  (0x9, {24, 16, 0x40, 0, 0,  (0x9, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00841   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00842   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00843   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00844   896   NtQueryPerformanceCounter  (... {-1449377996, 16}, {3579545, 0}, ) == 0x0
 00845   896   NtUserCallOneParam  (0, 41, ... ) == 0x4
 00846   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 8192, 4096, 4, ... 1339392, 8192, ) == 0x0
 00847   896   NtQueryVirtualMemory  (-1, 0x12f62c, Basic, 28, ... {BaseAddress=0x12f000,AllocationBase=0x30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 00848   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 9830400, 1048576, ) == 0x0
 00849   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00850   896   NtAllocateVirtualMemory  (-1, 9830400, 0, 16384, 4096, 4, ... 9830400, 16384, ) == 0x0
 00851   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00852   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00853   896   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00854   896   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00855   896   NtOpenProcessToken  (-1, 0x8, ... 76, ) == 0x0
 00856   896   NtQueryInformationToken  (76, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00857   896   NtClose  (76, ... ) == 0x0
 00858   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.ENU"}, 1241096, ... ) }, 1241096, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00859   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.ENU"}, 1240692, ... ) }, 1240692, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00860   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.ENU.DLL"}, 1240692, ... ) }, 1240692, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00861   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.EN"}, 1241096, ... ) }, 1241096, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00862   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.EN"}, 1240692, ... ) }, 1240692, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00863   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ebe3.EN.DLL"}, 1240692, ... ) }, 1240692, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00864   896   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 76, ) == 0x0
 00865   896   NtUserGetDC  (0, ... ) == 0x1010052
 00866   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00867   896   NtUserGetDC  (0, ... ) == 0x1010052
 00868   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00869   896   NtGdiCreatePaletteInternal  (1241800, 16, ... ) == 0x64080596
 00870   896   NtGdiGetStockObject  (7, ... ) == 0x1b00017
 00871   896   NtGdiGetStockObject  (5, ... ) == 0x1900015
 00872   896   NtUserFindExistingCursorIcon  (1242164, 1242180, 1242228, ... ) == 0x10003
 00873   896   NtAddAtom  ( ("D\0e\0l\0p\0h\0i\00\00\00\00\00\04\0E\04\0", 28, 1242728, ... ) , 28, 1242728, ... ) == 0x0
 00874   896   NtAddAtom  ( ("C\0o\0n\0t\0r\0o\0l\0O\0f\0s\00\00\03\02\00\00\00\00\00\00\00\00\00\03\08\00\0", 52, 1242728, ... ) , 52, 1242728, ... ) == 0x0
 00875   896   NtUserSystemParametersInfo  (104, 0, 9838148, 0, ... ) == 0x1
 00876   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10011
 00877   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10023
 00878   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x0
 00879   896   NtUserGetDC  (0, ... ) == 0x1010052
 00880   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xc9050697
 00881   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00882   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0x185000f
 00883   896   NtGdiGetDCforBitmap  (-922417513, ... ) == 0x860107ab
 00884   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00885   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0xc9050697
 00886   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00887   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00888   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 3687948, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 00889   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00890   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0xc9050697
 00891   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 00892   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc9050697
 00893   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xba0106e8
 00894   896   NtGdiExtGetObjectW  (-922417513, 24, 1241208, ... ) == 0x18
 00895   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x710504dc
 00896   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0x185000f
 00897   896   NtGdiSelectBitmap  (-1174337816, 1896154332, ... ) == 0x185000f
 00898   896   NtGdiBitBlt  (-1174337816, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00899   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc9050697
 00900   896   NtGdiSelectBitmap  (-1174337816, 25493519, ... ) == 0x710504dc
 00901   896   NtGdiDeleteObjectApp  (-922417513, ... ) == 0x1
 00902   896   NtGdiDeleteObjectApp  (-1174337816, ... ) == 0x1
 00903   896   NtUserCallOneParam  (0, 33, ... ) == 0x1580153
 00904   896   NtUserSetCursorIconData  (22544723, 1241312, 1241328, 1241392, ... ) == 0x1
 00905   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10029
 00906   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10027
 00907   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10025
 00908   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x0
 00909   896   NtUserGetDC  (0, ... ) == 0x1010052
 00910   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x750505de
 00911   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00912   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x185000f
 00913   896   NtGdiGetDCforBitmap  (1963263454, ... ) == 0x860107ab
 00914   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00915   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x750505de
 00916   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00917   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00918   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 3688256, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 00919   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00920   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x750505de
 00921   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 00922   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x750505de
 00923   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xcb010697
 00924   896   NtGdiExtGetObjectW  (1963263454, 24, 1241208, ... ) == 0x18
 00925   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x160506c8
 00926   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x185000f
 00927   896   NtGdiSelectBitmap  (-889125225, 369428168, ... ) == 0x185000f
 00928   896   NtGdiBitBlt  (-889125225, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00929   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x750505de
 00930   896   NtGdiSelectBitmap  (-889125225, 25493519, ... ) == 0x160506c8
 00931   896   NtGdiDeleteObjectApp  (1963263454, ... ) == 0x1
 00932   896   NtGdiDeleteObjectApp  (-889125225, ... ) == 0x1
 00933   896   NtUserCallOneParam  (0, 33, ... ) == 0x250297
 00934   896   NtUserSetCursorIconData  (2425495, 1241312, 1241328, 1241392, ... ) == 0x1
 00935   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x0
 00936   896   NtUserGetDC  (0, ... ) == 0x1010052
 00937   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xbc0506e8
 00938   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00939   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0x185000f
 00940   896   NtGdiGetDCforBitmap  (-1140521240, ... ) == 0x860107ab
 00941   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00942   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0xbc0506e8
 00943   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00944   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00945   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 3688564, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 00946   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00947   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0xbc0506e8
 00948   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 00949   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xbc0506e8
 00950   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0x770105de
 00951   896   NtGdiExtGetObjectW  (-1140521240, 24, 1241208, ... ) == 0x18
 00952   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x2a050554
 00953   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0x185000f
 00954   896   NtGdiSelectBitmap  (1996555742, 704972116, ... ) == 0x185000f
 00955   896   NtGdiBitBlt  (1996555742, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00956   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xbc0506e8
 00957   896   NtGdiSelectBitmap  (1996555742, 25493519, ... ) == 0x2a050554
 00958   896   NtGdiDeleteObjectApp  (-1140521240, ... ) == 0x1
 00959   896   NtGdiDeleteObjectApp  (1996555742, ... ) == 0x1
 00960   896   NtUserCallOneParam  (0, 33, ... ) == 0x3101e3
 00961   896   NtUserSetCursorIconData  (3211747, 1241312, 1241328, 1241392, ... ) == 0x1
 00962   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x0
 00963   896   NtUserGetDC  (0, ... ) == 0x1010052
 00964   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xcd050697
 00965   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00966   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0x185000f
 00967   896   NtGdiGetDCforBitmap  (-855308649, ... ) == 0x860107ab
 00968   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00969   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0xcd050697
 00970   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00971   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00972   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 3688872, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 00973   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00974   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0xcd050697
 00975   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 00976   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xcd050697
 00977   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xbe0106e8
 00978   896   NtGdiExtGetObjectW  (-855308649, 24, 1241208, ... ) == 0x18
 00979   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x6905057d
 00980   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0x185000f
 00981   896   NtGdiSelectBitmap  (-1107228952, 1761936765, ... ) == 0x185000f
 00982   896   NtGdiBitBlt  (-1107228952, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00983   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xcd050697
 00984   896   NtGdiSelectBitmap  (-1107228952, 25493519, ... ) == 0x6905057d
 00985   896   NtGdiDeleteObjectApp  (-855308649, ... ) == 0x1
 00986   896   NtGdiDeleteObjectApp  (-1107228952, ... ) == 0x1
 00987   896   NtUserCallOneParam  (0, 33, ... ) == 0x2c0293
 00988   896   NtUserSetCursorIconData  (2884243, 1241312, 1241328, 1241392, ... ) == 0x1
 00989   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x0
 00990   896   NtUserGetDC  (0, ... ) == 0x1010052
 00991   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x790505de
 00992   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00993   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x185000f
 00994   896   NtGdiGetDCforBitmap  (2030372318, ... ) == 0x860107ab
 00995   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00996   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x790505de
 00997   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00998   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00999   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 3689180, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 01000   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01001   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x790505de
 01002   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01003   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x790505de
 01004   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xcf010697
 01005   896   NtGdiExtGetObjectW  (2030372318, 24, 1241208, ... ) == 0x18
 01006   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xcf0506b6
 01007   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x185000f
 01008   896   NtGdiSelectBitmap  (-822016361, -821754186, ... ) == 0x185000f
 01009   896   NtGdiBitBlt  (-822016361, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01010   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x790505de
 01011   896   NtGdiSelectBitmap  (-822016361, 25493519, ... ) == 0xcf0506b6
 01012   896   NtGdiDeleteObjectApp  (2030372318, ... ) == 0x1
 01013   896   NtGdiDeleteObjectApp  (-822016361, ... ) == 0x1
 01014   896   NtUserCallOneParam  (0, 33, ... ) == 0x19018f
 01015   896   NtUserSetCursorIconData  (1638799, 1241312, 1241328, 1241392, ... ) == 0x1
 01016   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x0
 01017   896   NtUserGetDC  (0, ... ) == 0x1010052
 01018   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xc00506e8
 01019   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01020   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0x185000f
 01021   896   NtGdiGetDCforBitmap  (-1073412376, ... ) == 0x860107ab
 01022   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01023   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0xc00506e8
 01024   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01025   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01026   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 3689796, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 01027   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01028   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0xc00506e8
 01029   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01030   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc00506e8
 01031   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0x7b0105de
 01032   896   NtGdiExtGetObjectW  (-1073412376, 24, 1241208, ... ) == 0x18
 01033   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x220505f7
 01034   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0x185000f
 01035   896   NtGdiSelectBitmap  (2063664606, 570754551, ... ) == 0x185000f
 01036   896   NtGdiBitBlt  (2063664606, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01037   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc00506e8
 01038   896   NtGdiSelectBitmap  (2063664606, 25493519, ... ) == 0x220505f7
 01039   896   NtGdiDeleteObjectApp  (-1073412376, ... ) == 0x1
 01040   896   NtGdiDeleteObjectApp  (2063664606, ... ) == 0x1
 01041   896   NtUserCallOneParam  (0, 33, ... ) == 0x4b01ff
 01042   896   NtUserSetCursorIconData  (4915711, 1241312, 1241328, 1241392, ... ) == 0x1
 01043   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x0
 01044   896   NtUserGetDC  (0, ... ) == 0x1010052
 01045   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xd1050697
 01046   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01047   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0x185000f
 01048   896   NtGdiGetDCforBitmap  (-788199785, ... ) == 0x860107ab
 01049   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01050   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0xd1050697
 01051   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01052   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01053   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 3689488, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 01054   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01055   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0xd1050697
 01056   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01057   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xd1050697
 01058   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xc20106e8
 01059   896   NtGdiExtGetObjectW  (-788199785, 24, 1241208, ... ) == 0x18
 01060   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xce0506aa
 01061   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0x185000f
 01062   896   NtGdiSelectBitmap  (-1040120088, -838531414, ... ) == 0x185000f
 01063   896   NtGdiBitBlt  (-1040120088, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01064   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xd1050697
 01065   896   NtGdiSelectBitmap  (-1040120088, 25493519, ... ) == 0xce0506aa
 01066   896   NtGdiDeleteObjectApp  (-788199785, ... ) == 0x1
 01067   896   NtGdiDeleteObjectApp  (-1040120088, ... ) == 0x1
 01068   896   NtUserCallOneParam  (0, 33, ... ) == 0x450281
 01069   896   NtUserSetCursorIconData  (4522625, 1241312, 1241328, 1241392, ... ) == 0x1
 01070   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10015
 01071   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10019
 01072   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x1001f
 01073   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x1001b
 01074   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10021
 01075   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x1001d
 01076   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10013
 01077   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10017
 01078   896   NtUserFindExistingCursorIcon  (1242048, 1242064, 1242112, ... ) == 0x10011
 01079   896   NtUserCallOneParam  (0, 40, ... ) == 0x4090409
 01080   896   NtUserGetDC  (0, ... ) == 0x1010052
 01081   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01082   896   NtUserEnumDisplayMonitors  (0, 0, 3410856, 9838728, ... ) == 0x1
 01083   896   NtUserSystemParametersInfo  (31, 60, 1241028, 0, ... ) == 0x1
 01084   896   NtGdiHfontCreate  (1241908, 356, 0, 0, 1330888, ... ) == 0xc30a06e8
 01085   896   NtGdiExtGetObjectW  (-1022753048, 420, 1241732, ... ) == 0x164
 01086   896   NtUserSystemParametersInfo  (41, 0, 1241228, 0, ... ) == 0x1
 01087   896   NtGdiHfontCreate  (1241908, 356, 0, 0, 1330880, ... ) == 0x7d0a05de
 01088   896   NtGdiExtGetObjectW  (2097808862, 420, 1241732, ... ) == 0x164
 01089   896   NtGdiHfontCreate  (1241908, 356, 0, 0, 1330872, ... ) == 0xd20a0697
 01090   896   NtGdiExtGetObjectW  (-771094889, 420, 1241732, ... ) == 0x164
 01091   896   NtUserFindExistingCursorIcon  (1241808, 1241824, 1241872, ... ) == 0x0
 01092   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 10878976, 4096, ) == 0x0
 01093   896   NtUserGetKeyboardLayoutList  (64, 1242396, ... ) == 0x1
 01094   896   NtUserRegisterWindowMessage  ( ("Delphi Picture", ... ) , ... ) == 0xc13a
 01095   896   NtUserRegisterWindowMessage  ( ("Delphi Component", ... ) , ... ) == 0xc13b
 01096   896   NtOpenMutant  (0x1f0001, {24, 72, 0x0, 0, 0,  (0x1f0001, {24, 72, 0x0, 0, 0, "Residented"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01097   896   NtUserSetWindowsHookEx  (3276800, 1243780, 0, 4, 3284500, 2, ... ) == 0x5a01d7
 01098   896   NtProtectVirtualMemory  (-1, (0x4000e0), 4096, 4, ... (0x400000), 8192, 2, ) == 0x0
 01099   896   NtProtectVirtualMemory  (-1, (0x4000e0), 4096, 4, ... (0x400000), 8192, 4, ) == 0x0
 01100   896   NtAllocateVirtualMemory  (-1, 0, 0, 16777216, 4096, 64, ... 10944512, 16777216, ) == 0x0
 01101   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01102   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 27721728, 65536, ) == 0x0
 01103   896   NtAllocateVirtualMemory  (-1, 27721728, 0, 4096, 4096, 4, ... 27721728, 4096, ) == 0x0
 01104   896   NtAllocateVirtualMemory  (-1, 27725824, 0, 8192, 4096, 4, ... 27725824, 8192, ) == 0x0
 01105   896   NtAllocateVirtualMemory  (-1, 27734016, 0, 4096, 4096, 4, ... 27734016, 4096, ) == 0x0
 01106   896   NtAllocateVirtualMemory  (-1, 27738112, 0, 4096, 4096, 4, ... 27738112, 4096, ) == 0x0
 01107   896   NtQueryVirtualMemory  (-1, 0x41cd5f, Basic, 28, ... {BaseAddress=0x41c000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x61000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01108   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01109   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01110   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01111   896   NtQueryPerformanceCounter  (... {-1448904947, 16}, {3579545, 0}, ) == 0x0
 01112   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 80, ) }, ... 80, ) == 0x0
 01113   896   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 01114   896   NtClose  (80, ... ) == 0x0
 01115   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01116   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01117   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01118   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01119   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01120   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01121   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 80, ) }, ... 80, ) == 0x0
 01122   896   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 01123   896   NtClose  (80, ... ) == 0x0
 01124   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01125   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01126   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01127   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01128   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01129   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01130   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01131   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01132   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01133   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01134   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01135   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01136   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01137   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01138   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01139   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01140   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01141   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01142   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01143   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01144   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01145   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01146   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01147   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01148   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01149   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01150   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01151   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 80, ) }, ... 80, ) == 0x0
 01152   896   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x1a80000), 0x0, 36864, ) == STATUS_IMAGE_NOT_AT_BASE
 01153   896   NtProtectVirtualMemory  (-1, (0x1a81000), 18944, 4, ... (0x1a81000), 20480, 32, ) == 0x0
 01154   896   NtProtectVirtualMemory  (-1, (0x1a87000), 1024, 4, ... (0x1a87000), 4096, 2, ) == 0x0
 01155   896   NtProtectVirtualMemory  (-1, (0x1a88000), 1536, 4, ... (0x1a88000), 4096, 2, ) == 0x0
 01156   896   NtMapViewOfSection  (80, -1, (0x1a80000), 0, 0, 0x0, 36864, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 01157   896   NtProtectVirtualMemory  (-1, (0x1a81000), 18944, 16, ... (0x1a81000), 20480, 4, ) == 0x0
 01158   896   NtProtectVirtualMemory  (-1, (0x1a87000), 1024, 2, ... (0x1a87000), 4096, 8, ) == 0x0
 01159   896   NtProtectVirtualMemory  (-1, (0x1a88000), 1536, 2, ... (0x1a88000), 4096, 8, ) == 0x0
 01160   896   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 01161   896   NtClose  (80, ... ) == 0x0
 01162   896   NtProtectVirtualMemory  (-1, (0x1a81000), 160, 4, ... (0x1a81000), 4096, 16, ) == 0x0
 01163   896   NtProtectVirtualMemory  (-1, (0x1a81000), 4096, 16, ... (0x1a81000), 4096, 4, ) == 0x0
 01164   896   NtFlushInstructionCache  (-1, 27791360, 160, ... ) == 0x0
 01165   896   NtProtectVirtualMemory  (-1, (0x1a81000), 160, 4, ... (0x1a81000), 4096, 16, ) == 0x0
 01166   896   NtProtectVirtualMemory  (-1, (0x1a81000), 4096, 16, ... (0x1a81000), 4096, 4, ) == 0x0
 01167   896   NtFlushInstructionCache  (-1, 27791360, 160, ... ) == 0x0
 01168   896   NtProtectVirtualMemory  (-1, (0x1a81000), 160, 4, ... (0x1a81000), 4096, 16, ) == 0x0
 01169   896   NtProtectVirtualMemory  (-1, (0x1a81000), 4096, 16, ... (0x1a81000), 4096, 4, ) == 0x0
 01170   896   NtFlushInstructionCache  (-1, 27791360, 160, ... ) == 0x0
 01171   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01172   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01173   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01174   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 80, ) }, ... 80, ) == 0x0
 01175   896   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 01176   896   NtClose  (80, ... ) == 0x0
 01177   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01178   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01179   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01180   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01181   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01182   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01183   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01184   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01185   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01186   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01187   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01188   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01189   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01190   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01191   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01192   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01193   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01194   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01195   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01196   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01197   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01198   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01199   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01200   896   NtCreateSemaphore  (0x1f0003, {24, 72, 0x80, 1351056, 0,  (0x1f0003, {24, 72, 0x80, 1351056, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 80, ) }, 0, 2147483647, ... 80, ) == STATUS_OBJECT_NAME_EXISTS
 01201   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01202   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01203   896   NtQueryPerformanceCounter  (... {-1448872263, 16}, {3579545, 0}, ) == 0x0
 01204   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininet.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01205   896   NtQueryPerformanceCounter  (... {-1448871699, 16}, {3579545, 0}, ) == 0x0
 01206   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 8192, 4096, 4, ... 1351680, 8192, ) == 0x0
 01207   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01208   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
 01209   896   NtAllocateVirtualMemory  (-1, 27852800, 0, 4096, 4096, 4, ... 27852800, 4096, ) == 0x0
 01210   896   NtAllocateVirtualMemory  (-1, 27856896, 0, 8192, 4096, 4, ... 27856896, 8192, ) == 0x0
 01211   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 84, ) == 0x0
 01212   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239680,  (0xc0100080, {24, 0, 0x40, 0, 1239680, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 88, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 88, {status=0x0, info=0}, ) == 0x0
 01213   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 92, ) == 0x0
 01214   896   NtDeviceIoControlFile  (88, 92, 0x0, 0x12eae0, 0x22414c,  (88, 92, 0x0, 0x12eae0, 0x22414c, "(\353\22\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 01215   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 01216   896   NtQueryValueKey  (-2147482756,  (-2147482756, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01217   896   NtQueryValueKey  (-2147482756,  (-2147482756, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   896   NtClose  (-2147482756, ... ) == 0x0
 01219   896   NtClose  (892, ... ) == 0x0
 01214   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " \30P\342\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#Seed\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01220   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239896,  (0xc0100080, {24, 0, 0x40, 0, 1239896, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 100, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 100, {status=0x0, info=0}, ) == 0x0
 01221   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 104, ) == 0x0
 01222   896   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 108, ) == 0x0
 01223   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 112, ) == 0x0
 01224   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 116, ) == 0x0
 01225   896   NtAllocateVirtualMemory  (-1, 27865088, 0, 8192, 4096, 4, ... 27865088, 8192, ) == 0x0
 01226   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28901376, 1048576, ) == 0x0
 01227   896   NtAllocateVirtualMemory  (-1, 29941760, 0, 8192, 4096, 4, ... 29941760, 8192, ) == 0x0
 01228   896   NtProtectVirtualMemory  (-1, (0x1c8e000), 4096, 260, ... (0x1c8e000), 4096, 4, ) == 0x0
 01229   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1238980, 1238924, 1, ... 120, {1252, 2016}, ) == 0x0
 01230   896   NtQueryInformationThread  (120, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 01231   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 27853176}  (24, {28, 56, new_msg, 0, 0, 0, 0, 27853176} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0x\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0x\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 27853176} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0x\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0x\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 01232   896   NtResumeThread  (120, ... 1, ) == 0x0
 01233   896   NtClose  (120, ... ) == 0x0
 01234   896   NtSetEvent  (104, ...
 01235  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 120, ) == 0x0
 01236  2016   NtWaitForSingleObject  (120, 0, 0x0, ...
 01234   896   NtSetEvent  ... 0x0, ) == 0x0
 01237   896   NtSetEvent  (84, ... 0x0, ) == 0x0
 01238   896   NtClose  (84, ... ) == 0x0
 01239   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 84, ) == 0x0
 01240   896   NtAllocateVirtualMemory  (-1, 27873280, 0, 4096, 4096, 4, ... 27873280, 4096, ) == 0x0
 01241   896   NtDeviceIoControlFile  (88, 92, 0x0, 0x12eae0, 0x22414c,  (88, 92, 0x0, 0x12eae0, 0x22414c, "(\353\22\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 01242   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 01243   896   NtQueryValueKey  (-2147482756,  (-2147482756, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01244   896   NtQueryValueKey  (-2147482756,  (-2147482756, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01245   896   NtClose  (-2147482756, ... ) == 0x0
 01246   896   NtClose  (892, ... ) == 0x0
 01241   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " (\267\341\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344HotKey\16\0\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0|\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01247   896   NtSetEvent  (104, ... 0x0, ) == 0x0
 01248   896   NtSetEvent  (84, ... 0x0, ) == 0x0
 01249   896   NtClose  (84, ... ) == 0x0
 01250   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 01251   896   NtOpenProcessToken  (-1, 0xa, ... 84, ) == 0x0
 01252   896   NtDuplicateToken  (84, 0xc, {24, 0, 0x0, 0, 1240164, 0x0}, 0, 2, ... 128, ) == 0x0
 01253   896   NtClose  (84, ... ) == 0x0
 01254   896   NtAccessCheck  (1356880, 128, 0x1, 1240240, 1240292, 56, 1240272, ... (0x1), ) == 0x0
 01255   896   NtClose  (128, ... ) == 0x0
 01256   896   NtQueryDefaultUILanguage  (1239044, ...
 01257   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01258   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 01259   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01260   896   NtClose  (-2147482756, ... ) == 0x0
 01261   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 01262   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01263   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01264   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01265   896   NtClose  (-2147481452, ... ) == 0x0
 01266   896   NtClose  (-2147482756, ... ) == 0x0
 01256   896   NtQueryDefaultUILanguage  ... ) == 0x0
 01267   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01268   896   NtQueryDefaultLocale  (1, 1237140, ... ) == 0x0
 01269   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01270   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238176, 1179817, 1237900}  (24, {128, 156, new_msg, 0, 2088850039, 1238176, 1179817, 1237900} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\224\350\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81840, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\224\350\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81840, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238176, 1179817, 1237900} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\224\350\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81840, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\224\350\22\0\0\0\0\0" )  ) == 0x0
 01271   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01272   896   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01273   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01274   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01275   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236368, ... ) }, 1236368, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01276   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01277   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01278   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01279   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1236432, ... ) }, 1236432, ... ) == 0x0
 01280   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 128, {status=0x0, info=1}, ) }, 3, 33, ... 128, {status=0x0, info=1}, ) == 0x0
 01281   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01282   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 84, {status=0x0, info=1}, ) }, 5, 96, ... 84, {status=0x0, info=1}, ) == 0x0
 01283   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 84, ... 132, ) == 0x0
 01284   896   NtClose  (84, ... ) == 0x0
 01285   896   NtMapViewOfSection  (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1ca0000), 0x0, 1056768, ) == 0x0
 01286   896   NtClose  (132, ... ) == 0x0
 01287   896   NtUnmapViewOfSection  (-1, 0x1ca0000, ... ) == 0x0
 01288   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01289   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 132, ... 84, ) == 0x0
 01290   896   NtQuerySection  (84, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01291   896   NtClose  (132, ... ) == 0x0
 01292   896   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 01293   896   NtClose  (84, ... ) == 0x0
 01294   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01295   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01296   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01297   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01298   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01299   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01300   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01301   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01302   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01303   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01304   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01305   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01306   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01307   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01308   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01309   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01310   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01311   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01312   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01313   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01314   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01315   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01316   896   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1237912, ... ) , 42, 1237912, ... ) == 0x0
 01317   896   NtQueryDefaultUILanguage  (1236596, ...
 01318   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01319   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 01320   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01321   896   NtClose  (-2147482756, ... ) == 0x0
 01322   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 01323   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01324   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01325   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01326   896   NtClose  (-2147481452, ... ) == 0x0
 01327   896   NtClose  (-2147482756, ... ) == 0x0
 01317   896   NtQueryDefaultUILanguage  ... ) == 0x0
 01328   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1235436, ... ) }, 1235436, ... ) == 0x0
 01329   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 84, {status=0x0, info=1}, ) }, 5, 96, ... 84, {status=0x0, info=1}, ) == 0x0
 01330   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 84, ... 132, ) == 0x0
 01331   896   NtClose  (84, ... ) == 0x0
 01332   896   NtMapViewOfSection  (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1ca0000), 0x0, 4096, ) == 0x0
 01333   896   NtClose  (132, ... ) == 0x0
 01334   896   NtUnmapViewOfSection  (-1, 0x1ca0000, ... ) == 0x0
 01335   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1235032, ... ) }, 1235032, ... ) == 0x0
 01336   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1235776,  (0x80100080, {24, 0, 0x40, 0, 1235776, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0
 01337   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 84, ) == 0x0
 01338   896   NtClose  (132, ... ) == 0x0
 01339   896   NtMapViewOfSection  (84, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x1ca0000), {0, 0}, 4096, ) == 0x0
 01340   896   NtClose  (84, ... ) == 0x0
 01341   896   NtUnmapViewOfSection  (-1, 0x1ca0000, ... ) == 0x0
 01342   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 84, {status=0x0, info=1}, ) }, 1, 96, ... 84, {status=0x0, info=1}, ) == 0x0
 01343   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 84, ... 132, ) == 0x0
 01344   896   NtMapViewOfSection  (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x1ca0000), 0x0, 4096, ) == 0x0
 01345   896   NtQueryInformationFile  (84, 1235428, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01346   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01347   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1235728, 1179817, 1235452}  (24, {128, 156, new_msg, 0, 2088850039, 1235728, 1179817, 1235452} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1T\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0\4\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81841, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1T\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0\4\337\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81841, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1235728, 1179817, 1235452} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1T\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0\4\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81841, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1T\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0\4\337\22\0\0\0\0\0" )  ) == 0x0
 01348   896   NtClose  (84, ... ) == 0x0
 01349   896   NtClose  (132, ... ) == 0x0
 01350   896   NtUnmapViewOfSection  (-1, 0x1ca0000, ... ) == 0x0
 01351   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01352   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01353   896   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 01354   896   NtUserGetDC  (0, ... ) == 0x1010052
 01355   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01356   896   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 01357   896   NtUserSystemParametersInfo  (66, 12, 1237428, 0, ... ) == 0x1
 01358   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01359   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 132, ) == 0x0
 01360   896   NtQueryInformationToken  (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01361   896   NtClose  (132, ... ) == 0x0
 01362   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 132, ) }, ... 132, ) == 0x0
 01363   896   NtOpenProcessToken  (-1, 0x8, ... 84, ) == 0x0
 01364   896   NtAccessCheck  (1356880, 84, 0x1, 1237260, 1237312, 56, 1237292, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01365   896   NtClose  (84, ... ) == 0x0
 01366   896   NtOpenKey  (0x20019, {24, 132, 0x40, 0, 0,  (0x20019, {24, 132, 0x40, 0, 0, "Control Panel\Desktop"}, ... 84, ) }, ... 84, ) == 0x0
 01367   896   NtQueryValueKey  (84,  (84, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01368   896   NtClose  (84, ... ) == 0x0
 01369   896   NtUserSystemParametersInfo  (41, 500, 1237456, 0, ... ) == 0x1
 01370   896   NtOpenProcessToken  (-1, 0x8, ... 84, ) == 0x0
 01371   896   NtAccessCheck  (1356880, 84, 0x1, 1237260, 1237312, 56, 1237292, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01372   896   NtClose  (84, ... ) == 0x0
 01373   896   NtOpenKey  (0x20019, {24, 132, 0x40, 0, 0,  (0x20019, {24, 132, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 84, ) }, ... 84, ) == 0x0
 01374   896   NtQueryValueKey  (84,  (84, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01375   896   NtClose  (84, ... ) == 0x0
 01376   896   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 01377   896   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 01378   896   NtClose  (132, ... ) == 0x0
 01379   896   NtUserSystemParametersInfo  (4130, 0, 1237960, 0, ... ) == 0x1
 01380   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 132, ) }, ... 132, ) == 0x0
 01381   896   NtEnumerateValueKey  (132, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 01382   896   NtClose  (132, ... ) == 0x0
 01383   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01384   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c03b
 01385   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c03d
 01386   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01387   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c03f
 01388   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01389   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c041
 01390   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01391   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c043
 01392   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c045
 01393   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01394   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c047
 01395   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01396   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c049
 01397   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01398   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c04b
 01399   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01400   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c04d
 01401   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01402   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c04f
 01403   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c051
 01404   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01405   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c053
 01406   896   NtUserFindExistingCursorIcon  (1237204, 1237220, 1237268, ... ) == 0x10011
 01407   896   NtUserRegisterClassExWOW  (1237148, 1237216, 1237232, 1237248, 0, 384, 0, ... ) == 0x8177c055
 01408   896   NtUserFindExistingCursorIcon  (1237204, 1237220, 1237268, ... ) == 0x10011
 01409   896   NtUserRegisterClassExWOW  (1237148, 1237216, 1237232, 1237248, 0, 384, 0, ... ) == 0x8177c057
 01410   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01411   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c059
 01412   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10013
 01413   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c05b
 01414   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01415   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c05d
 01416   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01417   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c05f
 01418   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01419   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c017
 01420   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01421   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c019
 01422   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10013
 01423   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c018
 01424   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01425   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c01a
 01426   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01427   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c01c
 01428   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01429   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c01e
 01430   896   NtUserFindExistingCursorIcon  (1237200, 1237216, 1237264, ... ) == 0x10011
 01431   896   NtUserRegisterClassExWOW  (1237200, 1237268, 1237284, 1237300, 0, 384, 0, ... ) == 0x8177c01b
 01432   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01433   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c068
 01434   896   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01435   896   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x8177c06a
 01436   896   NtCreateKey  (0x2001f, {24, 28, 0x40, 0, 0,  (0x2001f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 132, 2, ) }, 0, 0x0, 0, ... 132, 2, ) == 0x0
 01437   896   NtSetEventBoostPriority  (120, ...
 01236  2016   NtWaitForSingleObject  ... ) == 0x0
 01438  2016   NtTestAlert  (... ) == 0x0
 01439  2016   NtContinue  (29949232, 1, ...
 01440  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01441  2016   NtDeviceIoControlFile  (100, 112, 0x0, 0x77e466a0, 0x228144,  (100, 112, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0l\0\0\0\0\0\0\0|\0\0\0\0\0\0\0`\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 01437   896   NtSetEventBoostPriority  ... ) == 0x0
 01442  2016   NtWaitForMultipleObjects  (2, (104, 112, ), 1, 1, {1294967296, -1}, ... ) == 0x0
 01443  2016   NtDeviceIoControlFile  (100, 116, 0x0, 0x77e46680, 0x228144,  (100, 116, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0l\0\0\0\0\0\0\0|\0\0\0\0\0\0\0`\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 01444  2016   NtWaitForMultipleObjects  (2, (104, 116, ), 1, 1, {1294967296, -1}, ...
 01445   896   NtQueryValueKey  (132,  (132, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01446   896   NtQueryValueKey  (132,  (132, "SecureProtocols", Partial, 144, ... TitleIdx=0, Type=4, Data="\240\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "SecureProtocols", Partial, 144, ... TitleIdx=0, Type=4, Data="\240\0\0\0"}, 16, ) }, 16, ) == 0x0
 01447   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies"}, ... 84, ) }, ... 84, ) == 0x0
 01448   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies"}, ... 136, ) }, ... 136, ) == 0x0
 01449   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software"}, ... 140, ) }, ... 140, ) == 0x0
 01450   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software"}, ... 144, ) }, ... 144, ) == 0x0
 01451   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01452   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01453   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01454   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 148, ) }, ... 148, ) == 0x0
 01455   896   NtQueryValueKey  (148,  (148, "CertificateRevocation", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "CertificateRevocation", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01456   896   NtClose  (148, ... ) == 0x0
 01457   896   NtQueryValueKey  (132,  (132, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01458   896   NtQueryValueKey  (132,  (132, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01459   896   NtQueryValueKey  (132,  (132, "IdnEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01460   896   NtQueryValueKey  (132,  (132, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01461   896   NtQueryValueKey  (132,  (132, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01462   896   NtQueryValueKey  (132,  (132, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01463   896   NtQueryValueKey  (132,  (132, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01464   896   NtQueryValueKey  (132,  (132, "DisableBasicOverClearChannel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01465   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01466   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01467   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01468   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 148, ) }, ... 148, ) == 0x0
 01469   896   NtQueryValueKey  (148,  (148, "Feature_ClientAuthCertFilter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01470   896   NtClose  (148, ... ) == 0x0
 01471   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01472   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01473   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1239684, ... ) }, 1239684, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01474   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 1239684, ... ) }, 1239684, ... ) == 0x0
 01475   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 01476   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 152, ) == 0x0
 01477   896   NtQuerySection  (152, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01478   896   NtClose  (148, ... ) == 0x0
 01479   896   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77fe0000), 0x0, 69632, ) == 0x0
 01480   896   NtClose  (152, ... ) == 0x0
 01481   896   NtProtectVirtualMemory  (-1, (0x77fe1000), 388, 4, ... (0x77fe1000), 4096, 32, ) == 0x0
 01482   896   NtProtectVirtualMemory  (-1, (0x77fe1000), 4096, 32, ... (0x77fe1000), 4096, 4, ) == 0x0
 01483   896   NtFlushInstructionCache  (-1, 2013138944, 388, ... ) == 0x0
 01484   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01485   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 152, ) == 0x0
 01486   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 148, ) == 0x0
 01487   896   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 156, ) }, ... 156, ) == 0x0
 01488   896   NtQueryEvent  (156, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 01489   896   NtClose  (156, ... ) == 0x0
 01490   896   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1241256, 140, ... 156, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241256, 140, ... 156, 0x0, 0x0, 256, 140, ) == 0x0
 01491   896   NtRequestWaitReplyPort  (156, {28, 52, new_msg, 0, 0, 0, 0, 0}  (156, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\10\2\220\36\24\0" ... {188, 212, reply, 0, 1252, 896, 81843, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ... {188, 212, reply, 0, 1252, 896, 81843, 0}  (156, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\10\2\220\36\24\0" ... {188, 212, reply, 0, 1252, 896, 81843, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ) == 0x0
 01492   896   NtQueryValueKey  (132,  (132, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01493   896   NtOpenKey  (0x9, {24, 16, 0x40, 0, 0,  (0x9, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 160, ) }, ... 160, ) == 0x0
 01494   896   NtQueryValueKey  (160,  (160, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01495   896   NtClose  (160, ... ) == 0x0
 01496   896   NtOpenKey  (0xf, {24, 16, 0x40, 0, 0,  (0xf, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 160, ) }, ... 160, ) == 0x0
 01497   896   NtOpenKey  (0xf, {24, 28, 0x40, 0, 0,  (0xf, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 164, ) }, ... 164, ) == 0x0
 01498   896   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 168, ) }, ... 168, ) == 0x0
 01499   896   NtQueryValueKey  (168,  (168, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01500   896   NtQueryValueKey  (168,  (168, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01501   896   NtClose  (168, ... ) == 0x0
 01502   896   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "Content"}, ... 168, ) }, ... 168, ) == 0x0
 01503   896   NtQueryValueKey  (168,  (168, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01504   896   NtOpenKey  (0xf, {24, 160, 0x40, 0, 0,  (0xf, {24, 160, 0x40, 0, 0, "Content"}, ... 172, ) }, ... 172, ) == 0x0
 01505   896   NtQueryValueKey  (172,  (172, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01506   896   NtClose  (172, ... ) == 0x0
 01507   896   NtClose  (168, ... ) == 0x0
 01508   896   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "Content"}, ... 168, ) }, ... 168, ) == 0x0
 01509   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHELL32.dll"}, ... 172, ) }, ... 172, ) == 0x0
 01510   896   NtMapViewOfSection  (172, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c9c0000), 0x0, 8482816, ) == 0x0
 01511   896   NtClose  (172, ... ) == 0x0
 01512   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01513   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01514   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01515   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01516   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01517   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01518   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01519   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01520   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01521   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01522   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01523   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01524   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01525   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01526   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01527   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01528   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01529   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01530   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01531   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01532   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01533   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01534   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01535   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01536   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01537   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 172, ) }, ... 172, ) == 0x0
 01538   896   NtQueryValueKey  (172,  (172, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01539   896   NtClose  (172, ... ) == 0x0
 01540   896   NtQueryDefaultUILanguage  (1236280, ...
 01541   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01542   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 01543   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01544   896   NtClose  (-2147482756, ... ) == 0x0
 01545   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 01546   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01547   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01548   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01549   896   NtClose  (-2147481452, ... ) == 0x0
 01550   896   NtClose  (-2147482756, ... ) == 0x0
 01540   896   NtQueryDefaultUILanguage  ... ) == 0x0
 01551   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll"}, 1, 96, ... 172, {status=0x0, info=1}, ) }, 1, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01552   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 172, ... 176, ) == 0x0
 01553   896   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x1cc0000), 0x0, 8462336, ) == 0x0
 01554   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01555   896   NtQueryDefaultLocale  (1, 1234376, ... ) == 0x0
 01556   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01557   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1235412, 1179817, 1235136}  (24, {128, 156, new_msg, 0, 2088850039, 1235412, 1179817, 1235136} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\254\0\0\0\377\377\377\377\0\0\0\0@ \357\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\310\335\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81844, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\254\0\0\0\377\377\377\377\0\0\0\0@ \357\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\310\335\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81844, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1235412, 1179817, 1235136} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\254\0\0\0\377\377\377\377\0\0\0\0@ \357\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\310\335\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81844, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\254\0\0\0\377\377\377\377\0\0\0\0@ \357\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\310\335\22\0\0\0\0\0" )  ) == 0x0
 01558   896   NtClose  (172, ... ) == 0x0
 01559   896   NtClose  (176, ... ) == 0x0
 01560   896   NtUnmapViewOfSection  (-1, 0x1cc0000, ... ) == 0x0
 01561   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01562   896   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01563   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01564   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01565   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1233568, ... ) }, 1233568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01566   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01567   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01568   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01569   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1233632, ... ) }, 1233632, ... ) == 0x0
 01570   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 176, {status=0x0, info=1}, ) }, 3, 33, ... 176, {status=0x0, info=1}, ) == 0x0
 01571   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01572   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01573   896   NtCreateSemaphore  (0x1f0003, {24, 72, 0x80, 1351056, 0,  (0x1f0003, {24, 72, 0x80, 1351056, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 172, ) }, 0, 2147483647, ... 172, ) == STATUS_OBJECT_NAME_EXISTS
 01574   896   NtReleaseSemaphore  (172, 1, ... 0, ) == 0x0
 01575   896   NtWaitForSingleObject  (172, 0, {0, 0}, ... ) == 0x0
 01576   896   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 180, 2, ) }, 0, 0x0, 0, ... 180, 2, ) == 0x0
 01577   896   NtQueryValueKey  (180,  (180, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (180, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01578   896   NtClose  (180, ... ) == 0x0
 01579   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1239352, ... ) }, 1239352, ... ) == 0x0
 01580   896   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 180, 2, ) }, 0, 0x0, 0, ... 180, 2, ) == 0x0
 01581   896   NtSetValueKey  (180,  (180, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 162, ... ) , 0, 1,  (180, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 162, ... ) , 162, ... ) == 0x0
 01582   896   NtClose  (180, ... ) == 0x0
 01583   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01584   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 01585   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01586   896   NtSetInformationFile  (180, 1239224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01587   896   NtClose  (180, ... ) == 0x0
 01588   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\desktop.ini"}, 1239248, ... ) }, 1239248, ... ) == 0x0
 01589   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01590   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 01591   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01592   896   NtSetInformationFile  (180, 1239224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01593   896   NtClose  (180, ... ) == 0x0
 01594   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1239248, ... ) }, 1239248, ... ) == 0x0
 01595   896   NtQueryValueKey  (168,  (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01596   896   NtQueryValueKey  (168,  (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01597   896   NtQueryValueKey  (168,  (168, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\260\376\3\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\260\376\3\0"}, 16, ) }, 16, ) == 0x0
 01598   896   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "Cookies"}, ... 180, ) }, ... 180, ) == 0x0
 01599   896   NtQueryValueKey  (180,  (180, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01600   896   NtOpenKey  (0xf, {24, 160, 0x40, 0, 0,  (0xf, {24, 160, 0x40, 0, 0, "Cookies"}, ... 184, ) }, ... 184, ) == 0x0
 01601   896   NtQueryValueKey  (184,  (184, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (184, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01602   896   NtClose  (184, ... ) == 0x0
 01603   896   NtClose  (180, ... ) == 0x0
 01604   896   NtClose  (168, ... ) == 0x0
 01605   896   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "Cookies"}, ... 168, ) }, ... 168, ) == 0x0
 01606   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01607   896   NtReleaseSemaphore  (172, 1, ... 0, ) == 0x0
 01608   896   NtWaitForSingleObject  (172, 0, {0, 0}, ... ) == 0x0
 01609   896   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 180, 2, ) }, 0, 0x0, 0, ... 180, 2, ) == 0x0
 01610   896   NtQueryValueKey  (180,  (180, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (180, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01611   896   NtClose  (180, ... ) == 0x0
 01612   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies"}, 1239352, ... ) }, 1239352, ... ) == 0x0
 01613   896   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 180, 2, ) }, 0, 0x0, 0, ... 180, 2, ) == 0x0
 01614   896   NtSetValueKey  (180,  (180, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 98, ... ) , 0, 1,  (180, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 98, ... ) , 98, ... ) == 0x0
 01615   896   NtClose  (180, ... ) == 0x0
 01616   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01617   896   NtQueryValueKey  (168,  (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01618   896   NtQueryValueKey  (168,  (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01619   896   NtQueryValueKey  (168,  (168, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01620   896   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "History"}, ... 180, ) }, ... 180, ) == 0x0
 01621   896   NtQueryValueKey  (180,  (180, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01622   896   NtOpenKey  (0xf, {24, 160, 0x40, 0, 0,  (0xf, {24, 160, 0x40, 0, 0, "History"}, ... 184, ) }, ... 184, ) == 0x0
 01623   896   NtQueryValueKey  (184,  (184, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (184, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01624   896   NtClose  (184, ... ) == 0x0
 01625   896   NtClose  (180, ... ) == 0x0
 01626   896   NtClose  (168, ... ) == 0x0
 01627   896   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "History"}, ... 168, ) }, ... 168, ) == 0x0
 01628   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01629   896   NtReleaseSemaphore  (172, 1, ... 0, ) == 0x0
 01630   896   NtWaitForSingleObject  (172, 0, {0, 0}, ... ) == 0x0
 01631   896   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 180, 2, ) }, 0, 0x0, 0, ... 180, 2, ) == 0x0
 01632   896   NtQueryValueKey  (180,  (180, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (180, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01633   896   NtClose  (180, ... ) == 0x0
 01634   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1239352, ... ) }, 1239352, ... ) == 0x0
 01635   896   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 180, 2, ) }, 0, 0x0, 0, ... 180, 2, ) == 0x0
 01636   896   NtSetValueKey  (180,  (180, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 128, ... ) , 0, 1,  (180, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 128, ... ) , 128, ... ) == 0x0
 01637   896   NtClose  (180, ... ) == 0x0
 01638   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01639   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 01640   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01641   896   NtSetInformationFile  (180, 1239224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01642   896   NtClose  (180, ... ) == 0x0
 01643   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\desktop.ini"}, 1239248, ... ) }, 1239248, ... ) == 0x0
 01644   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01645   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 01646   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01647   896   NtSetInformationFile  (180, 1239224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01648   896   NtClose  (180, ... ) == 0x0
 01649   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\desktop.ini"}, 1239248, ... ) }, 1239248, ... ) == 0x0
 01650   896   NtQueryValueKey  (168,  (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01651   896   NtQueryValueKey  (168,  (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01652   896   NtQueryValueKey  (168,  (168, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01653   896   NtClose  (168, ... ) == 0x0
 01654   896   NtClose  (164, ... ) == 0x0
 01655   896   NtClose  (160, ... ) == 0x0
 01656   896   NtOpenMutant  (0x100000, {24, 72, 0x0, 0, 0,  (0x100000, {24, 72, 0x0, 0, 0, "Local\_!MSFTHISTORY!_"}, ... 160, ) }, ... 160, ) == 0x0
 01657   896   NtOpenMutant  (0x100000, {24, 72, 0x0, 0, 0,  (0x100000, {24, 72, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!local settings!temporary internet files!content.ie5!"}, ... 164, ) }, ... 164, ) == 0x0
 01658   896   NtWaitForSingleObject  (164, 0, 0x0, ... ) == 0x0
 01659   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241352, ... ) }, 1241352, ... ) == 0x0
 01660   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 168, {status=0x0, info=1}, ) }, 7, 2113568, ... 168, {status=0x0, info=1}, ) == 0x0
 01661   896   NtSetInformationFile  (168, 1241328, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01662   896   NtClose  (168, ... ) == 0x0
 01663   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241268,  (0xc0100080, {24, 0, 0x40, 0, 1241268, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 168, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 168, {status=0x0, info=1}, ) == 0x0
 01664   896   NtSetInformationFile  (168, 1241320, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01665   896   NtQueryInformationFile  (168, 1241320, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01666   896   NtOpenSection  (0x2, {24, 72, 0x0, 0, 0,  (0x2, {24, 72, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Local Settings_Temporary Internet Files_Content.IE5_index.dat_802816"}, ... 180, ) }, ... 180, ) == 0x0
 01667   896   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1cc0000), {0, 0}, 802816, ) == 0x0
 01668   896   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 01669   896   NtOpenMutant  (0x100000, {24, 72, 0x0, 0, 0,  (0x100000, {24, 72, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!cookies!"}, ... 184, ) }, ... 184, ) == 0x0
 01670   896   NtWaitForSingleObject  (184, 0, 0x0, ... ) == 0x0
 01671   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies\"}, 1241352, ... ) }, 1241352, ... ) == 0x0
 01672   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies\"}, 7, 2113568, ... 188, {status=0x0, info=1}, ) }, 7, 2113568, ... 188, {status=0x0, info=1}, ) == 0x0
 01673   896   NtSetInformationFile  (188, 1241328, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01674   896   NtClose  (188, ... ) == 0x0
 01675   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241268,  (0xc0100080, {24, 0, 0x40, 0, 1241268, "\??\C:\Documents and Settings\Martim Carbone\Cookies\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 188, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 188, {status=0x0, info=1}, ) == 0x0
 01676   896   NtSetInformationFile  (188, 1241320, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01677   896   NtQueryInformationFile  (188, 1241320, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01678   896   NtOpenSection  (0x2, {24, 72, 0x0, 0, 0,  (0x2, {24, 72, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Cookies_index.dat_32768"}, ... 192, ) }, ... 192, ) == 0x0
 01679   896   NtMapViewOfSection  (192, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1d90000), {0, 0}, 32768, ) == 0x0
 01680   896   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 01681   896   NtOpenMutant  (0x100000, {24, 72, 0x0, 0, 0,  (0x100000, {24, 72, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!local settings!history!history.ie5!"}, ... 196, ) }, ... 196, ) == 0x0
 01682   896   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 01683   896   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01684   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 1241352, ... ) }, 1241352, ... ) == 0x0
 01685   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 7, 2113568, ... 200, {status=0x0, info=1}, ) }, 7, 2113568, ... 200, {status=0x0, info=1}, ) == 0x0
 01686   896   NtSetInformationFile  (200, 1241328, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01687   896   NtClose  (200, ... ) == 0x0
 01688   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241268,  (0xc0100080, {24, 0, 0x40, 0, 1241268, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 200, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 200, {status=0x0, info=1}, ) == 0x0
 01689   896   NtSetInformationFile  (200, 1241320, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01690   896   NtQueryInformationFile  (200, 1241320, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01691   896   NtOpenSection  (0x2, {24, 72, 0x0, 0, 0,  (0x2, {24, 72, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Local Settings_History_History.IE5_index.dat_81920"}, ... 204, ) }, ... 204, ) == 0x0
 01692   896   NtMapViewOfSection  (204, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1da0000), {0, 0}, 81920, ) == 0x0
 01693   896   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 01694   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 1240928, ... ) }, 1240928, ... ) == 0x0
 01695   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 208, {status=0x0, info=1}, ) }, 7, 2113568, ... 208, {status=0x0, info=1}, ) == 0x0
 01696   896   NtSetInformationFile  (208, 1240900, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01697   896   NtClose  (208, ... ) == 0x0
 01698   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1240924, ... ) }, 1240924, ... ) == 0x0
 01699   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 1240928, ... ) }, 1240928, ... ) == 0x0
 01700   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 7, 2113568, ... 208, {status=0x0, info=1}, ) }, 7, 2113568, ... 208, {status=0x0, info=1}, ) == 0x0
 01701   896   NtSetInformationFile  (208, 1240900, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01702   896   NtClose  (208, ... ) == 0x0
 01703   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\desktop.ini"}, 1240924, ... ) }, 1240924, ... ) == 0x0
 01704   896   NtWaitForSingleObject  (164, 0, 0x0, ... ) == 0x0
 01705   896   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 01706   896   NtOpenKey  (0xf, {24, 28, 0x40, 0, 0,  (0xf, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 208, ) }, ... 208, ) == 0x0
 01707   896   NtOpenKey  (0xf, {24, 208, 0x40, 0, 0,  (0xf, {24, 208, 0x40, 0, 0, "Extensible Cache"}, ... 212, ) }, ... 212, ) == 0x0
 01708   896   NtClose  (208, ... ) == 0x0
 01709   896   NtWaitForSingleObject  (160, 0, {-600000000, -1}, ... ) == 0x0
 01710   896   NtEnumerateKey  (212, 0, Basic, 288, ... {LastWrite={0x47401762,0x1c74db1}, TitleIdx=0, Name= (212, 0, Basic, 288, ... {LastWrite={0x47401762,0x1c74db1}, TitleIdx=0, Name="feedplat"}, 32, ) }, 32, ) == 0x0
 01711   896   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "feedplat"}, ... 208, ) }, ... 208, ) == 0x0
 01712   896   NtQueryValueKey  (208,  (208, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01713   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01714   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (208, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) }, 148, ) == 0x0
 01715   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01716   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (208, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) }, 148, ) == 0x0
 01717   896   NtQueryValueKey  (208,  (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) }, 32, ) == 0x0
 01718   896   NtQueryValueKey  (208,  (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) }, 32, ) == 0x0
 01719   896   NtQueryValueKey  (208,  (208, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01720   896   NtQueryValueKey  (208,  (208, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01721   896   NtClose  (208, ... ) == 0x0
 01722   896   NtEnumerateKey  (212, 1, Basic, 288, ... {LastWrite={0x450668aa,0x1c8b090}, TitleIdx=0, Name= (212, 1, Basic, 288, ... {LastWrite={0x450668aa,0x1c8b090}, TitleIdx=0, Name="MSHist012008050720080508"}, 64, ) }, 64, ) == 0x0
 01723   896   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "MSHist012008050720080508"}, ... 208, ) }, ... 208, ) == 0x0
 01724   896   NtQueryValueKey  (208,  (208, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01725   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01726   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0\0\0"}, 160, ) , Partial, 160, ... TitleIdx=0, Type=2, Data= (208, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0\0\0"}, 160, ) }, 160, ) == 0x0
 01727   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01728   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0\0\0"}, 160, ) , Partial, 160, ... TitleIdx=0, Type=2, Data= (208, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0\0\0"}, 160, ) }, 160, ) == 0x0
 01729   896   NtQueryValueKey  (208,  (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01730   896   NtQueryValueKey  (208,  (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01731   896   NtQueryValueKey  (208,  (208, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01732   896   NtQueryValueKey  (208,  (208, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 01733   896   NtClose  (208, ... ) == 0x0
 01734   896   NtEnumerateKey  (212, 2, Basic, 288, ... {LastWrite={0x2030327f,0x1c7701e}, TitleIdx=0, Name= (212, 2, Basic, 288, ... {LastWrite={0x2030327f,0x1c7701e}, TitleIdx=0, Name="UserData"}, 32, ) }, 32, ) == 0x0
 01735   896   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "UserData"}, ... 208, ) }, ... 208, ) == 0x0
 01736   896   NtQueryValueKey  (208,  (208, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01737   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01738   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (208, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) }, 148, ) == 0x0
 01739   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01740   896   NtQueryValueKey  (208,  (208, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (208, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) }, 148, ) == 0x0
 01741   896   NtQueryValueKey  (208,  (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) }, 30, ) == 0x0
 01742   896   NtQueryValueKey  (208,  (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (208, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) }, 30, ) == 0x0
 01743   896   NtQueryValueKey  (208,  (208, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\350\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\350\3\0\0"}, 16, ) }, 16, ) == 0x0
 01744   896   NtQueryValueKey  (208,  (208, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\10\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\10\0\0\0"}, 16, ) }, 16, ) == 0x0
 01745   896   NtClose  (208, ... ) == 0x0
 01746   896   NtEnumerateKey  (212, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 01747   896   NtReleaseMutant  (160, ... 0x0, ) == 0x0
 01748   896   NtClose  (212, ... ) == 0x0
 01749   896   NtWaitForSingleObject  (164, 0, 0x0, ... ) == 0x0
 01750   896   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 01751   896   NtWaitForSingleObject  (164, 0, 0x0, ... ) == 0x0
 01752   896   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 01753   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01754   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01755   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01756   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01757   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01758   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01759   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01760   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 212, ) }, ... 212, ) == 0x0
 01761   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01762   896   NtOpenKey  (0x1, {24, 212, 0x40, 0, 0,  (0x1, {24, 212, 0x40, 0, 0, "RETRY_HEADERONLYPOST_ONCONNECTIONRESET"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01763   896   NtClose  (212, ... ) == 0x0
 01764   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01765   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01766   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 212, ) }, ... 212, ) == 0x0
 01767   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01768   896   NtOpenKey  (0x1, {24, 212, 0x40, 0, 0,  (0x1, {24, 212, 0x40, 0, 0, "FEATURE_BUFFERBREAKING_818408"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01769   896   NtClose  (212, ... ) == 0x0
 01770   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01771   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01772   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 212, ) }, ... 212, ) == 0x0
 01773   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01774   896   NtOpenKey  (0x1, {24, 212, 0x40, 0, 0,  (0x1, {24, 212, 0x40, 0, 0, "FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01775   896   NtClose  (212, ... ) == 0x0
 01776   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01777   896   NtQueryValueKey  (132,  (132, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01778   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01779   896   NtQueryValueKey  (212,  (212, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01780   896   NtClose  (212, ... ) == 0x0
 01781   896   NtQueryValueKey  (132,  (132, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01782   896   NtQueryValueKey  (132,  (132, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01783   896   NtQueryValueKey  (132,  (132, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01784   896   NtQueryValueKey  (132,  (132, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01785   896   NtQueryValueKey  (132,  (132, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01786   896   NtQueryValueKey  (132,  (132, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01787   896   NtQueryValueKey  (132,  (132, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01788   896   NtQueryValueKey  (132,  (132, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01789   896   NtQueryValueKey  (132,  (132, "ConnectTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01790   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01791   896   NtQueryValueKey  (212,  (212, "ConnectTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01792   896   NtClose  (212, ... ) == 0x0
 01793   896   NtQueryValueKey  (132,  (132, "ConnectRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01794   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01795   896   NtQueryValueKey  (212,  (212, "ConnectRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01796   896   NtClose  (212, ... ) == 0x0
 01797   896   NtQueryValueKey  (132,  (132, "SendTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01798   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01799   896   NtQueryValueKey  (212,  (212, "SendTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01800   896   NtClose  (212, ... ) == 0x0
 01801   896   NtQueryValueKey  (132,  (132, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01802   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01803   896   NtQueryValueKey  (212,  (212, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01804   896   NtClose  (212, ... ) == 0x0
 01805   896   NtQueryValueKey  (132,  (132, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01806   896   NtQueryValueKey  (132,  (132, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01807   896   NtQueryValueKey  (132,  (132, "CertCacheNoValidate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01808   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 212, ) }, ... 212, ) == 0x0
 01809   896   NtQueryValueKey  (212,  (212, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01810   896   NtClose  (212, ... ) == 0x0
 01811   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01812   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01813   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01814   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 212, ) }, ... 212, ) == 0x0
 01815   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 208, ) }, ... 208, ) == 0x0
 01816   896   NtQueryValueKey  (208,  (208, "ScavengeCacheFileLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01817   896   NtQueryValueKey  (212,  (212, "ScavengeCacheFileLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01818   896   NtClose  (212, ... ) == 0x0
 01819   896   NtClose  (208, ... ) == 0x0
 01820   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01821   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01822   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 208, ) }, ... 208, ) == 0x0
 01823   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01824   896   NtOpenKey  (0x1, {24, 208, 0x40, 0, 0,  (0x1, {24, 208, 0x40, 0, 0, "FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01825   896   NtClose  (208, ... ) == 0x0
 01826   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01827   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01828   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 208, ) }, ... 208, ) == 0x0
 01829   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01830   896   NtOpenKey  (0x1, {24, 208, 0x40, 0, 0,  (0x1, {24, 208, 0x40, 0, 0, "FEATURE_USE_CNAME_FOR_SPN_KB911149"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01831   896   NtClose  (208, ... ) == 0x0
 01832   896   NtQueryValueKey  (132,  (132, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01833   896   NtQueryValueKey  (132,  (132, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01834   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01835   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01836   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 208, ) }, ... 208, ) == 0x0
 01837   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01838   896   NtOpenKey  (0x1, {24, 208, 0x40, 0, 0,  (0x1, {24, 208, 0x40, 0, 0, "FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01839   896   NtClose  (208, ... ) == 0x0
 01840   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01841   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01842   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 208, ) }, ... 208, ) == 0x0
 01843   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01844   896   NtOpenKey  (0x1, {24, 208, 0x40, 0, 0,  (0x1, {24, 208, 0x40, 0, 0, "FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK"}, ... 212, ) }, ... 212, ) == 0x0
 01845   896   NtQueryValueKey  (212,  (212, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01846   896   NtQueryValueKey  (212,  (212, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01847   896   NtClose  (212, ... ) == 0x0
 01848   896   NtClose  (208, ... ) == 0x0
 01849   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01850   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01851   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 208, ) }, ... 208, ) == 0x0
 01852   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01853   896   NtOpenKey  (0x1, {24, 208, 0x40, 0, 0,  (0x1, {24, 208, 0x40, 0, 0, "FEATURE_DIGEST_NO_EXTRAS_IN_URI"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01854   896   NtClose  (208, ... ) == 0x0
 01855   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01856   896   NtQueryValueKey  (208,  (208, "DisableCachingOfSSLPages", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (208, "DisableCachingOfSSLPages", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01857   896   NtClose  (208, ... ) == 0x0
 01858   896   NtQueryValueKey  (132,  (132, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01859   896   NtQueryValueKey  (132,  (132, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01860   896   NtQueryValueKey  (132,  (132, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01861   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01862   896   NtQueryValueKey  (208,  (208, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01863   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01864   896   NtQueryValueKey  (212,  (212, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01865   896   NtClose  (208, ... ) == 0x0
 01866   896   NtClose  (212, ... ) == 0x0
 01867   896   NtQueryValueKey  (132,  (132, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01868   896   NtQueryValueKey  (132,  (132, "BypassFtpTimeCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01869   896   NtQueryValueKey  (132,  (132, "ReleaseSocketDuringAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01870   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01871   896   NtQueryValueKey  (212,  (212, "ReleaseSocketDuring401Auth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01872   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01873   896   NtQueryValueKey  (208,  (208, "ReleaseSocketDuring401Auth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01874   896   NtClose  (212, ... ) == 0x0
 01875   896   NtClose  (208, ... ) == 0x0
 01876   896   NtQueryValueKey  (132,  (132, "WpadSearchAllDomains", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01877   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01878   896   NtQueryValueKey  (208,  (208, "DisableLegacyPreAuthAsServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01879   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01880   896   NtQueryValueKey  (212,  (212, "DisableLegacyPreAuthAsServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01881   896   NtClose  (208, ... ) == 0x0
 01882   896   NtClose  (212, ... ) == 0x0
 01883   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01884   896   NtQueryValueKey  (212,  (212, "BypassHTTPNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01885   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01886   896   NtQueryValueKey  (208,  (208, "BypassHTTPNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01887   896   NtClose  (212, ... ) == 0x0
 01888   896   NtClose  (208, ... ) == 0x0
 01889   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01890   896   NtQueryValueKey  (208,  (208, "BypassSSLNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01891   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01892   896   NtQueryValueKey  (212,  (212, "BypassSSLNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01893   896   NtClose  (208, ... ) == 0x0
 01894   896   NtClose  (212, ... ) == 0x0
 01895   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01896   896   NtQueryValueKey  (212,  (212, "EnableHttpTrace", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01897   896   NtClose  (212, ... ) == 0x0
 01898   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01899   896   NtQueryValueKey  (212,  (212, "NoCheckAutodialOverRide", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01900   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01901   896   NtQueryValueKey  (208,  (208, "NoCheckAutodialOverRide", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01902   896   NtClose  (212, ... ) == 0x0
 01903   896   NtClose  (208, ... ) == 0x0
 01904   896   NtQueryValueKey  (132,  (132, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01905   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01906   896   NtQueryValueKey  (208,  (208, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01907   896   NtClose  (208, ... ) == 0x0
 01908   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 208, ) }, ... 208, ) == 0x0
 01909   896   NtQueryValueKey  (208,  (208, "ShareCredsWithWinHttp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01910   896   NtClose  (208, ... ) == 0x0
 01911   896   NtQueryValueKey  (132,  (132, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01912   896   NtQueryValueKey  (132,  (132, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01913   896   NtQueryValueKey  (132,  (132, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01914   896   NtQueryValueKey  (132,  (132, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01915   896   NtQueryValueKey  (132,  (132, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01916   896   NtQueryValueKey  (132,  (132, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01917   896   NtQueryValueKey  (132,  (132, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01918   896   NtQueryValueKey  (132,  (132, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01919   896   NtQueryValueKey  (132,  (132, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (132, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01920   896   NtQueryValueKey  (132,  (132, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01921   896   NtQueryValueKey  (132,  (132, "WarnOnZoneCrossing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "WarnOnZoneCrossing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01922   896   NtQueryValueKey  (132,  (132, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01923   896   NtQueryValueKey  (132,  (132, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01924   896   NtQueryValueKey  (132,  (132, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01925   896   NtQueryValueKey  (132,  (132, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01926   896   NtQueryValueKey  (132,  (132, "WarnOnHTTPSToHTTPRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01927   896   NtOpenMutant  (0x100000, {24, 72, 0x0, 0, 0,  (0x100000, {24, 72, 0x0, 0, 0, "Local\WininetStartupMutex"}, ... 208, ) }, ... 208, ) == 0x0
 01928   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 212, ) }, ... 212, ) == 0x0
 01929   896   NtQueryValueKey  (212,  (212, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01930   896   NtQueryValueKey  (212,  (212, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01931   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 216, ) == 0x0
 01932   896   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "Protocol_Catalog9"}, ... 220, ) }, ... 220, ) == 0x0
 01933   896   NtQueryValueKey  (220,  (220, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01934   896   NtNotifyChangeKey  (220, 216, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01935   896   NtQueryValueKey  (220,  (220, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01936   896   NtOpenKey  (0x2000000, {24, 220, 0x40, 0, 0,  (0x2000000, {24, 220, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01937   896   NtQueryValueKey  (220,  (220, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01938   896   NtQueryValueKey  (220,  (220, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01939   896   NtOpenKey  (0x2000000, {24, 220, 0x40, 0, 0,  (0x2000000, {24, 220, 0x40, 0, 0, "Catalog_Entries"}, ... 224, ) }, ... 224, ) == 0x0
 01940   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000001"}, ... 228, ) }, ... 228, ) == 0x0
 01941   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01942   896   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 01943   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01944   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\231\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\231\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\232\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\231\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\231\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\232\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\231\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\231\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\232\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01945   896   NtClose  (228, ... ) == 0x0
 01946   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000002"}, ... 228, ) }, ... 228, ) == 0x0
 01947   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01948   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01949   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\236\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\236\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\237\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\236\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\236\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\237\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\236\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\236\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\237\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01950   896   NtClose  (228, ... ) == 0x0
 01951   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000003"}, ... 228, ) }, ... 228, ) == 0x0
 01952   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01953   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01954   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\243\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\244\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\245\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01955   896   NtClose  (228, ... ) == 0x0
 01956   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000004"}, ... 228, ) }, ... 228, ) == 0x0
 01957   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01958   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01959   896   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ... 1372160, 4096, ) == 0x0
 01960   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\252\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\254\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\252\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\254\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\254\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\251\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\252\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\253\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\254\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01961   896   NtClose  (228, ... ) == 0x0
 01962   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000005"}, ... 228, ) }, ... 228, ) == 0x0
 01963   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01964   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01965   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\256\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\256\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\257\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\260\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\256\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\256\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\257\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\260\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\256\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\256\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\257\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\260\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01966   896   NtClose  (228, ... ) == 0x0
 01967   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000006"}, ... 228, ) }, ... 228, ) == 0x0
 01968   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01969   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01970   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\263\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\263\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\264\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\265\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\263\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\263\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\264\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\265\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\263\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\263\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\264\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\265\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01971   896   NtClose  (228, ... ) == 0x0
 01972   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000007"}, ... 228, ) }, ... 228, ) == 0x0
 01973   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01974   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01975   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\270\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\270\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\271\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\271\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\272\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\272\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\273\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\270\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\270\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\271\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\271\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\272\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\272\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\273\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\272\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\273\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\270\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\270\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\271\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\271\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\272\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\272\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\273\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01976   896   NtClose  (228, ... ) == 0x0
 01977   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000008"}, ... 228, ) }, ... 228, ) == 0x0
 01978   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01979   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01980   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\275\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\275\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\276\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\276\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\277\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\277\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\300\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\275\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\275\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\276\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\276\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\277\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\277\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\300\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\277\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\300\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\275\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\275\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\276\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\276\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\277\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\277\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\300\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01981   896   NtClose  (228, ... ) == 0x0
 01982   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000009"}, ... 228, ) }, ... 228, ) == 0x0
 01983   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01984   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01985   896   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0
 01986   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\303\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\303\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\304\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\304\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\305\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\305\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\306\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\303\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\303\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\304\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\304\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\305\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\305\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\306\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\305\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\306\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\303\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\303\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\304\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\304\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\305\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\305\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\306\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01987   896   NtClose  (228, ... ) == 0x0
 01988   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000010"}, ... 228, ) }, ... 228, ) == 0x0
 01989   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01990   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01991   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\310\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\310\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\311\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\311\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\312\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\312\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\313\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\310\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\310\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\311\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\311\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\312\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\312\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\313\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\312\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\313\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\310\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\310\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\311\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\311\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\312\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\312\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\313\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01992   896   NtClose  (228, ... ) == 0x0
 01993   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000011"}, ... 228, ) }, ... 228, ) == 0x0
 01994   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01995   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01996   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\315\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\315\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\316\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\316\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\317\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\317\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\320\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\315\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\315\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\316\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\316\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\317\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\317\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\320\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\317\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\320\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\315\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\315\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\316\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\316\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\317\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\317\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\320\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01997   896   NtClose  (228, ... ) == 0x0
 01998   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000012"}, ... 228, ) }, ... 228, ) == 0x0
 01999   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02000   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02001   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\322\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\322\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\323\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\323\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\324\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\324\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\325\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\322\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\322\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\323\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\323\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\324\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\324\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\325\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\324\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\325\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\322\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\322\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\323\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\323\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\324\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\324\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\325\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02002   896   NtClose  (228, ... ) == 0x0
 02003   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000013"}, ... 228, ) }, ... 228, ) == 0x0
 02004   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02005   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02006   896   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0
 02007   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\330\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\330\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\331\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\331\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\332\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\332\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\333\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\330\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\330\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\331\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\331\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\332\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\332\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\333\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\332\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\333\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\330\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\330\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\331\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\331\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\332\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\332\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\333\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02008   896   NtClose  (228, ... ) == 0x0
 02009   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000014"}, ... 228, ) }, ... 228, ) == 0x0
 02010   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02011   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02012   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\335\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\335\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\336\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\336\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\337\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\337\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\340\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\335\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\335\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\336\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\336\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\337\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\337\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\340\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\337\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\340\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\335\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\335\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\336\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\336\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\337\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\337\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\340\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02013   896   NtClose  (228, ... ) == 0x0
 02014   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000015"}, ... 228, ) }, ... 228, ) == 0x0
 02015   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02016   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02017   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\342\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\342\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\343\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\343\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\344\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\344\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\345\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\342\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\342\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\343\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\343\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\344\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\344\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\345\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\344\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\345\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\342\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\342\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\343\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\343\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\344\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\344\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\345\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02018   896   NtClose  (228, ... ) == 0x0
 02019   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000016"}, ... 228, ) }, ... 228, ) == 0x0
 02020   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02021   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02022   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\347\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\347\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\350\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\350\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\351\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\351\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\352\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\347\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\347\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\350\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\350\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\351\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\351\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\352\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\351\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\352\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\347\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\347\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\350\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\350\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\351\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\351\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\352\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02023   896   NtClose  (228, ... ) == 0x0
 02024   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000017"}, ... 228, ) }, ... 228, ) == 0x0
 02025   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02026   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02027   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\354\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\354\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\355\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\355\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\356\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\356\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\357\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\354\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\354\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\355\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\355\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\356\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\356\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\357\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\356\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\357\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\354\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\354\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\355\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\355\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\356\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\356\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\357\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02028   896   NtClose  (228, ... ) == 0x0
 02029   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000018"}, ... 228, ) }, ... 228, ) == 0x0
 02030   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02031   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02032   896   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0
 02033   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\362\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\362\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\363\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\363\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\364\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\364\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\365\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\362\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\362\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\363\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\363\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\364\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\364\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\365\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\364\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\365\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\362\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\362\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\363\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\363\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\364\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\364\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\365\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02034   896   NtClose  (228, ... ) == 0x0
 02035   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000019"}, ... 228, ) }, ... 228, ) == 0x0
 02036   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02037   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02038   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\367\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\367\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\370\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\370\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\371\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\371\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\372\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\367\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\367\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\370\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\370\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\371\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\371\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\372\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\371\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\372\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\367\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\367\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\370\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\370\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\371\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\371\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\372\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02039   896   NtClose  (228, ... ) == 0x0
 02040   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000020"}, ... 228, ) }, ... 228, ) == 0x0
 02041   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02042   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02043   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\374\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\374\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\375\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\375\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\376\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\376\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\377\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\374\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\374\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\375\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\375\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\376\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\376\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\377\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\376\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\377\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\374\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\374\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\375\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\375\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\376\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\376\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\377\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02044   896   NtClose  (228, ... ) == 0x0
 02045   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000021"}, ... 228, ) }, ... 228, ) == 0x0
 02046   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02047   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02048   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\1\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\1\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\2\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\2\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\3\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\3\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\4\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\1\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\1\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\2\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\2\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\3\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\3\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\4\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\3\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\4\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0 (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\1\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\1\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\2\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\340\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\334\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\2\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0\3\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\3\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\4\10\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\344\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02049   896   NtClose  (228, ... ) == 0x0
 02050   896   NtOpenKey  (0x20019, {24, 224, 0x40, 0, 0,  (0x20019, {24, 224, 0x40, 0, 0, "000000000022"}, ... 228, ) }, ... 228, ) == 0x0
 02051   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02052   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02053   896   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 02054   896   NtQueryValueKey  (228,  (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\7\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\7\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\10\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\340\0\0\0\10\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\11\10\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\330\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\11\10\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\12\10\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\12\10\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\340\0\0\0\13\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\324\0\0\0\320\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0h\231\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (228, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\7\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\7\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\10\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\340\0\0\0\10\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\11\10\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\330\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\11\10\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\12\10\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\12\10\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\340\0\0\0\13\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\324\0\0\0\320\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0h\231\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\7\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0\7\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\10\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\340\0\0\0\10\10\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\11\10\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\330\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\11\10\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\12\10\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\12\10\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\340\0\0\0\13\10\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\324\0\0\0\320\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0h\231\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 02055   896   NtClose  (228, ... ) == 0x0
 02056   896   NtClose  (224, ... ) == 0x0
 02057   896   NtWaitForSingleObject  (216, 0, {0, 0}, ... ) == 0x102
 02058   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 224, ) == 0x0
 02059   896   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 228, ) }, ... 228, ) == 0x0
 02060   896   NtQueryValueKey  (228,  (228, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 02061   896   NtNotifyChangeKey  (228, 224, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 02062   896   NtQueryValueKey  (228,  (228, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 02063   896   NtOpenKey  (0x2000000, {24, 228, 0x40, 0, 0,  (0x2000000, {24, 228, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02064   896   NtQueryValueKey  (228,  (228, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 02065   896   NtOpenKey  (0x2000000, {24, 228, 0x40, 0, 0,  (0x2000000, {24, 228, 0x40, 0, 0, "Catalog_Entries"}, ... 232, ) }, ... 232, ) == 0x0
 02066   896   NtOpenKey  (0x20019, {24, 232, 0x40, 0, 0,  (0x20019, {24, 232, 0x40, 0, 0, "000000000001"}, ... 236, ) }, ... 236, ) == 0x0
 02067   896   NtQueryValueKey  (236,  (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02068   896   NtQueryValueKey  (236,  (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02069   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 02070   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 02071   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 02072   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 02073   896   NtQueryValueKey  (236,  (236, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 02074   896   NtQueryValueKey  (236,  (236, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02075   896   NtQueryValueKey  (236,  (236, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 02076   896   NtQueryValueKey  (236,  (236, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02077   896   NtQueryValueKey  (236,  (236, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02078   896   NtQueryValueKey  (236,  (236, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02079   896   NtClose  (236, ... ) == 0x0
 02080   896   NtOpenKey  (0x20019, {24, 232, 0x40, 0, 0,  (0x20019, {24, 232, 0x40, 0, 0, "000000000002"}, ... 236, ) }, ... 236, ) == 0x0
 02081   896   NtQueryValueKey  (236,  (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 02082   896   NtQueryValueKey  (236,  (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 02083   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 02084   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 02085   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 02086   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 02087   896   NtQueryValueKey  (236,  (236, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 02088   896   NtQueryValueKey  (236,  (236, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02089   896   NtQueryValueKey  (236,  (236, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 02090   896   NtQueryValueKey  (236,  (236, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02091   896   NtQueryValueKey  (236,  (236, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02092   896   NtQueryValueKey  (236,  (236, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02093   896   NtClose  (236, ... ) == 0x0
 02094   896   NtOpenKey  (0x20019, {24, 232, 0x40, 0, 0,  (0x20019, {24, 232, 0x40, 0, 0, "000000000003"}, ... 236, ) }, ... 236, ) == 0x0
 02095   896   NtQueryValueKey  (236,  (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02096   896   NtQueryValueKey  (236,  (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02097   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 02098   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 02099   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 02100   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 02101   896   NtQueryValueKey  (236,  (236, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 02102   896   NtQueryValueKey  (236,  (236, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02103   896   NtQueryValueKey  (236,  (236, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 02104   896   NtQueryValueKey  (236,  (236, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02105   896   NtQueryValueKey  (236,  (236, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02106   896   NtQueryValueKey  (236,  (236, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02107   896   NtClose  (236, ... ) == 0x0
 02108   896   NtOpenKey  (0x20019, {24, 232, 0x40, 0, 0,  (0x20019, {24, 232, 0x40, 0, 0, "000000000004"}, ... 236, ) }, ... 236, ) == 0x0
 02109   896   NtQueryValueKey  (236,  (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 02110   896   NtQueryValueKey  (236,  (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 02111   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 02112   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 02113   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 02114   896   NtQueryValueKey  (236,  (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (236, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 02115   896   NtQueryValueKey  (236,  (236, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 02116   896   NtQueryValueKey  (236,  (236, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02117   896   NtQueryValueKey  (236,  (236, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 02118   896   NtQueryValueKey  (236,  (236, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02119   896   NtQueryValueKey  (236,  (236, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02120   896   NtQueryValueKey  (236,  (236, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02121   896   NtClose  (236, ... ) == 0x0
 02122   896   NtClose  (232, ... ) == 0x0
 02123   896   NtWaitForSingleObject  (224, 0, {0, 0}, ... ) == 0x102
 02124   896   NtClose  (212, ... ) == 0x0
 02125   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02126   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02127   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 212, ) }, ... 212, ) == 0x0
 02128   896   NtQueryValueKey  (212,  (212, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02129   896   NtClose  (212, ... ) == 0x0
 02130   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 212, ) == 0x0
 02131   896   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 232, ) == 0x0
 02132   896   NtQueryValueKey  (132,  (132, "GlobalUserOffline", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "GlobalUserOffline", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02133   896   NtWaitForSingleObject  (164, 0, 0x0, ... ) == 0x0
 02134   896   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 02135   896   NtOpenMutant  (0x100000, {24, 72, 0x0, 0, 0,  (0x100000, {24, 72, 0x0, 0, 0, "Local\WininetConnectionMutex"}, ... 236, ) }, ... 236, ) == 0x0
 02136   896   NtOpenMutant  (0x100000, {24, 72, 0x0, 0, 0,  (0x100000, {24, 72, 0x0, 0, 0, "Local\WininetProxyRegistryMutex"}, ... 240, ) }, ... 240, ) == 0x0
 02137   896   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 244, ) == 0x0
 02138   896   NtQueryValueKey  (132,  (132, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02139   896   NtQueryValueKey  (132,  (132, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02140   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 248, ) == 0x0
 02141   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 252, ) }, ... 252, ) == 0x0
 02142   896   NtQueryValueKey  (252,  (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02143   896   NtQueryValueKey  (252,  (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02144   896   NtClose  (252, ... ) == 0x0
 02145   896   NtQueryValueKey  (132,  (132, "TruncateFileName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02146   896   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 02147   896   NtQueryValueKey  (132,  (132, "BadProxyExpiresTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02148   896   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 252, ) == 0x0
 02149   896   NtWaitForSingleObject  (252, 0, 0x0, ... ) == 0x0
 02150   896   NtClearEvent  (252, ... ) == 0x0
 02151   896   NtSetEvent  (252, ... 0x0, ) == 0x0
 02152   896   NtClearEvent  (232, ... ) == 0x0
 02153   896   NtSetEvent  (232, ... 0x0, ) == 0x0
 02154   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "icmp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02155   896   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 02156   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\icmp.dll"}, 1240240, ... ) }, 1240240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02157   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\icmp.dll"}, 1240240, ... ) }, 1240240, ... ) == 0x0
 02158   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\icmp.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02159   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 260, ) == 0x0
 02160   896   NtQuerySection  (260, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02161   896   NtClose  (256, ... ) == 0x0
 02162   896   NtMapViewOfSection  (260, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74290000), 0x0, 16384, ) == 0x0
 02163   896   NtClose  (260, ... ) == 0x0
 02164   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02165   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\iphlpapi.dll"}, 1240712, ... ) }, 1240712, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02166   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 1240712, ... ) }, 1240712, ... ) == 0x0
 02167   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 5, 96, ... 260, {status=0x0, info=1}, ) }, 5, 96, ... 260, {status=0x0, info=1}, ) == 0x0
 02168   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 260, ... 256, ) == 0x0
 02169   896   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02170   896   NtClose  (260, ... ) == 0x0
 02171   896   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d60000), 0x0, 102400, ) == 0x0
 02172   896   NtClose  (256, ... ) == 0x0
 02173   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02174   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02175   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02176   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02177   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02178   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02179   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02180   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02181   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02182   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02183   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02184   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02185   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02186   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02187   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02188   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02189   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02190   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02191   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02192   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02193   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31195136, 65536, ) == 0x0
 02194   896   NtAllocateVirtualMemory  (-1, 31195136, 0, 4096, 4096, 4, ... 31195136, 4096, ) == 0x0
 02195   896   NtAllocateVirtualMemory  (-1, 31199232, 0, 8192, 4096, 4, ... 31199232, 8192, ) == 0x0
 02196   896   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 256, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 256, {status=0x0, info=0}, ) == 0x0
 02197   896   NtCreateFile  (0x40000000, {24, 0, 0x40, 0, 0,  (0x40000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 260, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 260, {status=0x0, info=0}, ) == 0x0
 02198   896   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 264, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 264, {status=0x0, info=0}, ) == 0x0
 02199   896   NtCreateFile  (0x100003, {24, 0, 0x40, 0, 0,  (0x100003, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 268, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 268, {status=0x0, info=0}, ) == 0x0
 02200   896   NtCreateFile  (0x20100080, {24, 0, 0x40, 0, 1241436,  (0x20100080, {24, 0, 0x40, 0, 1241436, "\??\Ip"}, 0x0, 128, 3, 1, 64, 0, 0, ... 272, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 64, 0, 0, ... 272, {status=0x0, info=0}, ) == 0x0
 02201   896   NtAllocateVirtualMemory  (-1, 31207424, 0, 36864, 4096, 4, ... 31207424, 36864, ) == 0x0
 02202   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 276, ) == 0x0
 02203   896   NtDeviceIoControlFile  (256, 276, 0x0, 0x0, 0x120003,  (256, 276, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (256, 276, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 02204   896   NtClose  (276, ... ) == 0x0
 02205   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 276, ) == 0x0
 02206   896   NtDeviceIoControlFile  (256, 276, 0x0, 0x0, 0x120003,  (256, 276, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , 36, 348, ... {status=0x0, info=118},  (256, 276, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , ) == 0x0
 02207   896   NtClose  (276, ... ) == 0x0
 02208   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 276, ) == 0x0
 02209   896   NtDeviceIoControlFile  (256, 276, 0x0, 0x0, 0x120003,  (256, 276, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363[\201\1\0\0\0\5\0\0\0\232A\250\25\213Z\245\6@\206\1\0\326\1\0\0\0\0\0\0\0\0\0\0\0\0\0\02rk\0:\222\0\0\356\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , 36, 348, ... {status=0x0, info=158},  (256, 276, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363[\201\1\0\0\0\5\0\0\0\232A\250\25\213Z\245\6@\206\1\0\326\1\0\0\0\0\0\0\0\0\0\0\0\0\0\02rk\0:\222\0\0\356\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , ) == 0x0
 02210   896   NtClose  (276, ... ) == 0x0
 02211   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 276, ) == 0x0
 02212   896   NtDeviceIoControlFile  (256, 276, 0x0, 0x0, 0x120003,  (256, 276, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (256, 276, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 02213   896   NtClose  (276, ... ) == 0x0
 02214   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 276, ) == 0x0
 02215   896   NtDeviceIoControlFile  (256, 276, 0x0, 0x0, 0x120003,  (256, 276, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , 36, 4, ... {status=0x0, info=4},  (256, 276, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , ) == 0x0
 02216   896   NtClose  (276, ... ) == 0x0
 02217   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 276, ) == 0x0
 02218   896   NtDeviceIoControlFile  (256, 276, 0x0, 0x0, 0x120003,  (256, 276, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , 36, 8, ... {status=0x0, info=8},  (256, 276, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , ) == 0x0
 02219   896   NtClose  (276, ... ) == 0x0
 02220   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 276, ) == 0x0
 02221   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 280, ) == 0x0
 02222   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02223   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02224   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02225   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02226   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02227   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02228   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02229   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02230   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02231   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02232   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02233   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02234   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02235   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02236   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02237   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02238   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02239   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02240   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02241   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02242   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02243   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02244   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02245   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02246   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02247   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02248   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02249   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02250   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02251   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02252   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02253   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02254   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02255   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02256   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02257   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02258   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02259   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02260   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02261   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02262   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02263   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02264   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02265   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02266   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02267   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02268   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02269   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02270   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02271   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02272   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02273   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02274   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02275   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02276   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02277   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02278   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02279   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02280   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02281   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02282   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02283   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02284   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02285   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02286   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02287   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02288   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02289   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02290   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02291   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02292   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02293   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02294   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02295   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02296   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02297   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02298   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02299   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02300   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02301   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02302   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02303   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02304   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02305   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02306   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02307   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02308   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02309   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02310   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02311   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02312   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02313   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02314   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02315   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02316   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02317   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02318   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02319   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02320   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02321   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02322   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02323   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02324   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02325   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02326   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02327   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02328   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02329   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02330   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02331   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02332   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02333   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02334   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02335   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02336   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02337   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02338   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02339   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02340   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02341   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02342   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 31260672, 65536, ) == 0x0
 02343   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02344   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 1, 4096, 4, ... 31260672, 4096, ) == 0x0
 02345   896   NtQueryVirtualMemory  (-1, 0x1dd0000, Basic, 28, ... {BaseAddress=0x1dd0000,AllocationBase=0x1dd0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02346   896   NtFreeVirtualMemory  (-1, (0x1dd0000), 0, 32768, ... (0x1dd0000), 65536, ) == 0x0
 02347   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Linkage"}, ... 284, ) }, ... 284, ) == 0x0
 02348   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\"}, ... 288, ) }, ... 288, ) == 0x0
 02349   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces"}, ... 292, ) }, ... 292, ) == 0x0
 02350   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters"}, ... 296, ) }, ... 296, ) == 0x0
 02351   896   NtQueryDefaultLocale  (1, 1241416, ... ) == 0x0
 02352   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02353   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "netapi32.dll"}, ... 300, ) }, ... 300, ) == 0x0
 02354   896   NtMapViewOfSection  (300, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0
 02355   896   NtClose  (300, ... ) == 0x0
 02356   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02357   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02358   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02359   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02360   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02361   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02362   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02363   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02364   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02365   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02366   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02367   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02368   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02369   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02370   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02371   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netapi32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02372   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "dnsapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02373   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\dnsapi.dll"}, 1240240, ... ) }, 1240240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02374   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dnsapi.dll"}, 1240240, ... ) }, 1240240, ... ) == 0x0
 02375   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dnsapi.dll"}, 5, 96, ... 300, {status=0x0, info=1}, ) }, 5, 96, ... 300, {status=0x0, info=1}, ) == 0x0
 02376   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 300, ... 304, ) == 0x0
 02377   896   NtQuerySection  (304, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02378   896   NtClose  (300, ... ) == 0x0
 02379   896   NtMapViewOfSection  (304, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 02380   896   NtClose  (304, ... ) == 0x0
 02381   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02382   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02383   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02384   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02385   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02386   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02387   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02388   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02389   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02390   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02391   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02392   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02393   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02394   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02395   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02396   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02397   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02398   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02399   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dnsapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02400   896   NtCreateKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 304, 2, ) }, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 304, 2, ) , 0, ... 304, 2, ) == 0x0
 02401   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 300, ) }, ... 300, ) == 0x0
 02402   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02403   896   NtQueryValueKey  (300,  (300, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02404   896   NtQueryValueKey  (304,  (304, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02405   896   NtQueryValueKey  (300,  (300, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02406   896   NtQueryValueKey  (304,  (304, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (304, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02407   896   NtQueryValueKey  (300,  (300, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02408   896   NtQueryValueKey  (304,  (304, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02409   896   NtQueryValueKey  (300,  (300, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02410   896   NtQueryValueKey  (304,  (304, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02411   896   NtQueryValueKey  (300,  (300, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02412   896   NtQueryValueKey  (300,  (300, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02413   896   NtQueryValueKey  (300,  (300, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02414   896   NtQueryValueKey  (300,  (300, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02415   896   NtQueryValueKey  (300,  (300, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02416   896   NtQueryValueKey  (300,  (300, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02417   896   NtQueryValueKey  (300,  (300, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02418   896   NtQueryValueKey  (300,  (300, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02419   896   NtQueryValueKey  (300,  (300, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02420   896   NtQueryValueKey  (304,  (304, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02421   896   NtQueryValueKey  (300,  (300, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02422   896   NtQueryValueKey  (300,  (300, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02423   896   NtQueryValueKey  (304,  (304, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02424   896   NtQueryValueKey  (300,  (300, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02425   896   NtQueryValueKey  (304,  (304, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02426   896   NtQueryValueKey  (300,  (300, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02427   896   NtQueryValueKey  (304,  (304, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02428   896   NtQueryValueKey  (300,  (300, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02429   896   NtQueryValueKey  (304,  (304, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02430   896   NtQueryValueKey  (300,  (300, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02431   896   NtQueryValueKey  (304,  (304, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02432   896   NtQueryValueKey  (300,  (300, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02433   896   NtQueryValueKey  (304,  (304, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02434   896   NtQueryValueKey  (300,  (300, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02435   896   NtQueryValueKey  (304,  (304, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02436   896   NtQueryValueKey  (300,  (300, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02437   896   NtQueryValueKey  (300,  (300, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02438   896   NtQueryValueKey  (300,  (300, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02439   896   NtQueryValueKey  (300,  (300, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02440   896   NtQueryValueKey  (300,  (300, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02441   896   NtQueryValueKey  (300,  (300, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02442   896   NtQueryValueKey  (300,  (300, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02443   896   NtQueryValueKey  (300,  (300, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02444   896   NtQueryValueKey  (300,  (300, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02445   896   NtQueryValueKey  (300,  (300, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02446   896   NtQueryValueKey  (300,  (300, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02447   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 308, ) }, ... 308, ) == 0x0
 02448   896   NtQueryValueKey  (308,  (308, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (308, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02449   896   NtClose  (308, ... ) == 0x0
 02450   896   NtClose  (304, ... ) == 0x0
 02451   896   NtClose  (300, ... ) == 0x0
 02452   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 300, ) }, ... 300, ) == 0x0
 02453   896   NtQueryValueKey  (300,  (300, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02454   896   NtQueryValueKey  (300,  (300, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02455   896   NtQueryValueKey  (300,  (300, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02456   896   NtClose  (300, ... ) == 0x0
 02457   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "odbc32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02458   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\odbc32.dll"}, 1240240, ... ) }, 1240240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02459   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbc32.dll"}, 1240240, ... ) }, 1240240, ... ) == 0x0
 02460   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbc32.dll"}, 5, 96, ... 300, {status=0x0, info=1}, ) }, 5, 96, ... 300, {status=0x0, info=1}, ) == 0x0
 02461   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 300, ... 304, ) == 0x0
 02462   896   NtQuerySection  (304, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02463   896   NtClose  (300, ... ) == 0x0
 02464   896   NtMapViewOfSection  (304, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74320000), 0x0, 249856, ) == 0x0
 02465   896   NtClose  (304, ... ) == 0x0
 02466   896   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02467   896   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02468   896   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02469   896   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02470   896   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02471   896   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02472   896   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02473   896   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02474   896   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02475   896   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02476   896   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02477   896   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02478   896   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02479   896   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02480   896   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02481   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comdlg32.dll"}, ... 304, ) }, ... 304, ) == 0x0
 02482   896   NtMapViewOfSection  (304, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x763b0000), 0x0, 299008, ) == 0x0
 02483   896   NtClose  (304, ... ) == 0x0
 02484   896   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02485   896   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02486   896   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02487   896   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02488   896   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02489   896   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02490   896   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02491   896   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02492   896   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02493   896   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02494   896   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02495   896   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02496   896   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02497   896   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02498   896   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02499   896   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02500   896   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02501   896   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02502   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comdlg32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02503   896   NtUserRegisterWindowMessage  ( ("WOWLFChange", ... ) , ... ) == 0xc06c
 02504   896   NtUserRegisterWindowMessage  ( ("WOWDirChange", ... ) , ... ) == 0xc06d
 02505   896   NtUserRegisterWindowMessage  ( ("WOWCHOOSEFONT_GETLOGFONT", ... ) , ... ) == 0xc06e
 02506   896   NtUserRegisterWindowMessage  ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06f
 02507   896   NtUserRegisterWindowMessage  ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc070
 02508   896   NtUserRegisterWindowMessage  ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc071
 02509   896   NtUserRegisterWindowMessage  ( ("commdlg_ColorOK", ... ) , ... ) == 0xc072
 02510   896   NtUserRegisterWindowMessage  ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc073
 02511   896   NtUserRegisterWindowMessage  ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06f
 02512   896   NtUserRegisterWindowMessage  ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc070
 02513   896   NtUserRegisterWindowMessage  ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc071
 02514   896   NtUserRegisterWindowMessage  ( ("commdlg_ColorOK", ... ) , ... ) == 0xc072
 02515   896   NtUserRegisterWindowMessage  ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc073
 02516   896   NtUserRegisterWindowMessage  ( ("Shell IDList Array", ... ) , ... ) == 0xc074
 02517   896   NtUserRegisterWindowMessage  ( ("commdlg_help", ... ) , ... ) == 0xc075
 02518   896   NtUserRegisterWindowMessage  ( ("commdlg_help", ... ) , ... ) == 0xc075
 02519   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\odbc32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02520   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\BidInterface\Loader"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02521   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\MDAC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02522   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02523   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02524   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02525   896   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 31260672, 262144, ) == 0x0
 02526   896   NtAllocateVirtualMemory  (-1, 31260672, 0, 4096, 4096, 4, ... 31260672, 4096, ) == 0x0
 02527   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02528   896   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 31522816, 262144, ) == 0x0
 02529   896   NtAllocateVirtualMemory  (-1, 31522816, 0, 4096, 4096, 4, ... 31522816, 4096, ) == 0x0
 02530   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02531   896   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 31784960, 262144, ) == 0x0
 02532   896   NtAllocateVirtualMemory  (-1, 31784960, 0, 4096, 4096, 4, ... 31784960, 4096, ) == 0x0
 02533   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02534   896   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 32047104, 262144, ) == 0x0
 02535   896   NtAllocateVirtualMemory  (-1, 32047104, 0, 4096, 4096, 4, ... 32047104, 4096, ) == 0x0
 02536   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02537   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02538   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02539   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02540   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 1236612, ... ) }, 1236612, ... ) == 0x0
 02541   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 5, 96, ... 304, {status=0x0, info=1}, ) }, 5, 96, ... 304, {status=0x0, info=1}, ) == 0x0
 02542   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 304, ... 300, ) == 0x0
 02543   896   NtClose  (304, ... ) == 0x0
 02544   896   NtMapViewOfSection  (300, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1ed0000), 0x0, 94208, ) == 0x0
 02545   896   NtClose  (300, ... ) == 0x0
 02546   896   NtUnmapViewOfSection  (-1, 0x1ed0000, ... ) == 0x0
 02547   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 1236920, ... ) }, 1236920, ... ) == 0x0
 02548   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 5, 96, ... 300, {status=0x0, info=1}, ) }, 5, 96, ... 300, {status=0x0, info=1}, ) == 0x0
 02549   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 300, ... 304, ) == 0x0
 02550   896   NtQuerySection  (304, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02551   896   NtClose  (300, ... ) == 0x0
 02552   896   NtMapViewOfSection  (304, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x20000000), 0x0, 94208, ) == 0x0
 02553   896   NtClose  (304, ... ) == 0x0
 02554   896   NtQueryDefaultLocale  (1, 1238752, ... ) == 0x0
 02555   896   NtAllocateVirtualMemory  (-1, 31264768, 0, 4096, 4096, 4, ... 31264768, 4096, ) == 0x0
 02556   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE"}, ... 304, ) }, ... 304, ) == 0x0
 02557   896   NtClose  (304, ... ) == 0x0
 02558   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02559   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02560   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02561   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02562   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\odbcint.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02563   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02564   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02565   896   NtCreateMutant  (0x1f0001, {24, 72, 0x80, 0, 0,  (0x1f0001, {24, 72, 0x80, 0, 0, "Bot018"}, 0, ... 304, ) }, 0, ... 304, ) == 0x0
 02566   896   NtWaitForSingleObject  (304, 0, {-300000000, -1}, ... ) == 0x0
 02567   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\oxtdujo32.exe"}, 1242248, ... ) }, 1242248, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02568   896   NtDelayExecution  (0, {-20000000, -1}, ... ) == 0x0
 02569   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241136,  (0x80100080, {24, 0, 0x40, 0, 1241136, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 300, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 300, {status=0x0, info=1}, ) == 0x0
 02570   896   NtQueryInformationFile  (300, 1241572, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 02571   896   NtQueryInformationFile  (300, 1241488, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02572   896   NtQueryInformationFile  (300, 1241304, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02573   896   NtAllocateVirtualMemory  (-1, 1400832, 0, 8192, 4096, 4, ... 1400832, 8192, ) == 0x0
 02574   896   NtQueryInformationFile  (300, 1398240, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 02575   896   NtQueryInformationFile  (300, 1239752, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02576   896   NtQueryInformationFile  (300, 1240028, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 02577   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1239904,  (0x40110080, {24, 0, 0x40, 0, 1239904, "\??\C:\WINDOWS\system32\oxtdujo32.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 02578   896   NtClose  (-2147482756, ... ) == 0x0
 02577   896   NtCreateFile  ... 308, {status=0x0, info=2}, ) == 0x0
 02579   896   NtQueryVolumeInformationFile  (308, 1240056, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 02580   896   NtQueryInformationFile  (308, 1239640, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02581   896   NtQueryVolumeInformationFile  (300, 1240056, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 02582   896   NtQueryVolumeInformationFile  (300, 1239400, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02583   896   NtSetInformationFile  (308, 1239956, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02584   896   NtAllocateVirtualMemory  (-1, 1409024, 0, 65536, 4096, 4, ... 1409024, 65536, ) == 0x0
 02585   896   NtReadFile  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440},  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0,\354.\261h\215@\342h\215@\342h\215@\342\242\256g\342i\215@\342\222\251\0\342v\215@\342\222\251\\342\344\215@\342\222\256Y\342m\215@\342h\215A\342\344\215@\342\222\251]\342-\215@\342\222\251}\342i\215@\342Richh\215@\342\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\5\0\247\25{C\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\332\1\0\0\274\5\0\0\0\0\0\0\340\7\0\0\20\0\0\0\360\1\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\360\7\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\334\3\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\300\7\0\36\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\304\330\1\0\0\20\0\0\0\16\1\0\0\4\0\0\0\0\0\0", ) , ) == 0x0
 02586   896   NtWriteFile  (308, 0, 0, 0,  (308, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0,\354.\261h\215@\342h\215@\342h\215@\342\242\256g\342i\215@\342\222\251\0\342v\215@\342\222\251\\342\344\215@\342\222\256Y\342m\215@\342h\215A\342\344\215@\342\222\251]\342-\215@\342\222\251}\342i\215@\342Richh\215@\342\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\5\0\247\25{C\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\332\1\0\0\274\5\0\0\0\0\0\0\340\7\0\0\20\0\0\0\360\1\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\360\7\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\334\3\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\300\7\0\36\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\304\330\1\0\0\20\0\0\0\16\1\0\0\4\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 02587   896   NtReadFile  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440},  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "J$\230\340\235\362\222\357\23\20\13\327\200yt8\251\250^\21\212\5\16:\17uXR\323\324~\305\301N\222\16@\278\321uE\360N\241\357W\3176\25;4\322e\306\6\350\2\265\343_^\361d%\220\270+\363H\247\201~HN\3179W\347M\20G\365F\14.\357\315\352\353 \35\2\267.b\24\314\13_\203\330\330\16\210\204\304\213r\26\24\178\312\307@f\34\362\356\362\336\240\11\23\201H\341\302\235\224\342\63;r\311j+\312\240\177\2508\246\231B\14\201\361\215F\377&\232H\320\205;\15\365 \3\376s%\232\301G\6>FJ\274+\236\326<\350\227-6l\316\2645\237\24\237\36\222\351\7\36\20I7\10?a\23Sj\3641\276\223\12\365\30\276\12\366\377%\250\245&\7\372\20\4\232'[\360\237/\230\305\224\343{\226\205 \304\215|\21X\255*%\371\2\117\2038a\3002nsQ\37\25\266+\310\177\210PN\260\236\241\302\203\14\215\263J\220\377\31\342\276\276\33Ps\36\225\25\30\262\6\201\242w\3\213\360`+\326\304C\236\324\341HA\215SVv\260q}W\215\34\250<\2133\240\305\300\301P\347\267\367\274?D9\352\302\340(\177\10\332\15\37Y\222#\362g\304\352\3d\206\25E-r\260\367\221J\33/\31s\37c\10\213\270\13\27D8\14\355?\222\3524\307Ps\254\274D|\201\235\323*\234QAUj\13\203\315\370\3504\332\211\301Uy\217-!!\13\350\240\211'3\333\361\201\11\24\277L\2577'\205\366Q.\211\215\206\331\12\37^\324F\367\24uN\275\310-\210k\260Q\27\16#-\212tm\261\302\262\257 \215^\14S\254\256\200Ct\33\373X\223\213\325\337\217;\306(\5`\3;\360r\236\353\34\362\16_\300{+\7-", ) , ) == 0x0
 02588   896   NtWriteFile  (308, 0, 0, 0,  (308, 0, 0, 0, "J$\230\340\235\362\222\357\23\20\13\327\200yt8\251\250^\21\212\5\16:\17uXR\323\324~\305\301N\222\16@\278\321uE\360N\241\357W\3176\25;4\322e\306\6\350\2\265\343_^\361d%\220\270+\363H\247\201~HN\3179W\347M\20G\365F\14.\357\315\352\353 \35\2\267.b\24\314\13_\203\330\330\16\210\204\304\213r\26\24\178\312\307@f\34\362\356\362\336\240\11\23\201H\341\302\235\224\342\63;r\311j+\312\240\177\2508\246\231B\14\201\361\215F\377&\232H\320\205;\15\365 \3\376s%\232\301G\6>FJ\274+\236\326<\350\227-6l\316\2645\237\24\237\36\222\351\7\36\20I7\10?a\23Sj\3641\276\223\12\365\30\276\12\366\377%\250\245&\7\372\20\4\232'[\360\237/\230\305\224\343{\226\205 \304\215|\21X\255*%\371\2\117\2038a\3002nsQ\37\25\266+\310\177\210PN\260\236\241\302\203\14\215\263J\220\377\31\342\276\276\33Ps\36\225\25\30\262\6\201\242w\3\213\360`+\326\304C\236\324\341HA\215SVv\260q}W\215\34\250<\2133\240\305\300\301P\347\267\367\274?D9\352\302\340(\177\10\332\15\37Y\222#\362g\304\352\3d\206\25E-r\260\367\221J\33/\31s\37c\10\213\270\13\27D8\14\355?\222\3524\307Ps\254\274D|\201\235\323*\234QAUj\13\203\315\370\3504\332\211\301Uy\217-!!\13\350\240\211'3\333\361\201\11\24\277L\2577'\205\366Q.\211\215\206\331\12\37^\324F\367\24uN\275\310-\210k\260Q\27\16#-\212tm\261\302\262\257 \215^\14S\254\256\200Ct\33\373X\223\213\325\337\217;\306(\5`\3;\360r\236\353\34\362\16_\300{+\7-", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 02589   896   NtReadFile  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440},  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\377\275\34\321\241\320[_x\325I\22588\31\27'\225\376\322\27\216C{\316\240\275@\256\314@\5\361\274N\1_\257\245\377\333\321[\10^\277\3228\3503\114\354\370{}/\20\22\266#\263w87\21\317\5\213\17\325\310\17|\333'n\321\203ZxC8\276\316\377\367gj\370\203'\351g\30/\35605\1\304Ax6:0K\10\332*\204\3741g\227\271-\32\5Z\16\2659\317\372\375\177\236\315{r+#A0\236\304\245\320\353\277p\322\15\372\36\10\360\274\331x\242\235\210\253g?W\362\235\231\1774\356\270r\200\235\220\276^<\366TH\33y\13\7;KN.|[4\323,\265\314\341B \245 [\14\37\3_7\355\321w \355\330\224K\374\33-\261\34\242I\261<1!\273"\272"ySJ\275\6\341T\275\366\3\0\200\10W\266;\156\30o\372\371\34\231\366\21dw\342\200a`\211KR`\331\37P\7='#I\256}dK\10W\262\247\320jlCp9\310\31\310Gt[\37h\31\7q1|\36\362n\20\270\302\10\202d\231S\177\256$\326\244\217\266\211\25%\1\2709\201\376I\361\237\352r\34\251M\213+\240, ) \272 (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\377\275\34\321\241\320[_x\325I\22588\31\27'\225\376\322\27\216C{\316\240\275@\256\314@\5\361\274N\1_\257\245\377\333\321[\10^\277\3228\3503\114\354\370{}/\20\22\266#\263w87\21\317\5\213\17\325\310\17|\333'n\321\203ZxC8\276\316\377\367gj\370\203'\351g\30/\35605\1\304Ax6:0K\10\332*\204\3741g\227\271-\32\5Z\16\2659\317\372\375\177\236\315{r+#A0\236\304\245\320\353\277p\322\15\372\36\10\360\274\331x\242\235\210\253g?W\362\235\231\1774\356\270r\200\235\220\276^<\366TH\33y\13\7;KN.|[4\323,\265\314\341B \245 [\14\37\3_7\355\321w \355\330\224K\374\33-\261\34\242I\261<1!\273"\272"ySJ\275\6\341T\275\366\3\0\200\10W\266;\156\30o\372\371\34\231\366\21dw\342\200a`\211KR`\331\37P\7='#I\256}dK\10W\262\247\320jlCp9\310\31\310Gt[\37h\31\7q1|\36\362n\20\270\302\10\202d\231S\177\256$\326\244\217\266\211\25%\1\2709\201\376I\361\237\352r\34\251M\213+\240, ) , ) == 0x0
 02590   896   NtWriteFile  (308, 0, 0, 0,  (308, 0, 0, 0, "\377\275\34\321\241\320[_x\325I\22588\31\27'\225\376\322\27\216C{\316\240\275@\256\314@\5\361\274N\1_\257\245\377\333\321[\10^\277\3228\3503\114\354\370{}/\20\22\266#\263w87\21\317\5\213\17\325\310\17|\333'n\321\203ZxC8\276\316\377\367gj\370\203'\351g\30/\35605\1\304Ax6:0K\10\332*\204\3741g\227\271-\32\5Z\16\2659\317\372\375\177\236\315{r+#A0\236\304\245\320\353\277p\322\15\372\36\10\360\274\331x\242\235\210\253g?W\362\235\231\1774\356\270r\200\235\220\276^<\366TH\33y\13\7;KN.|[4\323,\265\314\341B \245 [\14\37\3_7\355\321w \355\330\224K\374\33-\261\34\242I\261<1!\273"\272"ySJ\275\6\341T\275\366\3\0\200\10W\266;\156\30o\372\371\34\231\366\21dw\342\200a`\211KR`\331\37P\7='#I\256}dK\10W\262\247\320jlCp9\310\31\310Gt[\37h\31\7q1|\36\362n\20\270\302\10\202d\231S\177\256$\326\244\217\266\211\25%\1\2709\201\376I\361\237\352r\34\251M\213+\240, 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \272 (308, 0, 0, 0, "\377\275\34\321\241\320[_x\325I\22588\31\27'\225\376\322\27\216C{\316\240\275@\256\314@\5\361\274N\1_\257\245\377\333\321[\10^\277\3228\3503\114\354\370{}/\20\22\266#\263w87\21\317\5\213\17\325\310\17|\333'n\321\203ZxC8\276\316\377\367gj\370\203'\351g\30/\35605\1\304Ax6:0K\10\332*\204\3741g\227\271-\32\5Z\16\2659\317\372\375\177\236\315{r+#A0\236\304\245\320\353\277p\322\15\372\36\10\360\274\331x\242\235\210\253g?W\362\235\231\1774\356\270r\200\235\220\276^<\366TH\33y\13\7;KN.|[4\323,\265\314\341B \245 [\14\37\3_7\355\321w \355\330\224K\374\33-\261\34\242I\261<1!\273"\272"ySJ\275\6\341T\275\366\3\0\200\10W\266;\156\30o\372\371\34\231\366\21dw\342\200a`\211KR`\331\37P\7='#I\256}dK\10W\262\247\320jlCp9\310\31\310Gt[\37h\31\7q1|\36\362n\20\270\302\10\202d\231S\177\256$\326\244\217\266\211\25%\1\2709\201\376I\361\237\352r\34\251M\213+\240, 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 02591   896   NtReadFile  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440},  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "5\373\342_?\230\16\1\215\341\32\240\303\34A_\3209\261u\234T\222\22\255/v\265(f\177\7\346W>M\374\271\252\17\336\276H\24m\202\333uL\37`_\202\223\223S8\321\177\7\236VY\3023\231N\3\235\277\2340%\273\213\312=\14B $\372\253\262\13\234:\247\363R\241J\201\310\17\204\17\2329\222\1\344>\30QH\210\2763\222@A/\317W:s\342jU\373U/\1%\373_\370Q\351\207\226o>5\36\224Wx0\31\217\263:t\376 w\253\305$\351v\317:\36\263g\307#l\7^\10P\30\343\321\20j<\271b\2772S.\347\360QXa\14\272\207\32\370\227\357~\364\261=P7\22\37\323{&\22)\265\272\204>^d'\1/\5\0\305\13{\7\360\32\275\217\244!\330\261~\275?\274\240\13\241\242P`\246\37\301\224sE\212\364ZqPz\253k\240\267\311\234\216j\212\241\20\244\231Jp\261\3563\322\30\210}X\267\222@|7Y70+<[\213nJ\313f(K\313\0\7\307\226\214.\25\246\271U\177V\25\272\210L\344*\350\361\336\201fs\344\273\371\375Y#\270H\4!\234L9.\211\213\276\272\6\357\303\365\13\373h\10\343.\306\217\266\225\222\252+\37\301\360tS\254\11\264=\336F\277\300\221+\30k\206\227*\23\372'\362\17\3}\203\224W\14\257\310\230\2733\6^#\207\357\354\340)\303\\364\344\370!\242}\14`oU\31\350\277\344\257\26;ak\1,w_\0\350\304%z:\235\375\27\223\213\303Kj\272\10~\d\207\2\343u\337\37\337\270\253Y\7\224@\2\371\370\37E\252<_\27~\12\247\10+\267>$=\242k\15", ) \360QXa\14\272\207\32\370\227\357~\364\261=P7\22\37\323{&\22)\265\272\204>^d'\1/\5\0\305\13{\7\360\32\275\217\244!\330\261~\275?\274\240\13\241\242P`\246\37\301\224sE\212\364ZqPz\253k\240\267\311\234\216j\212\241\20\244\231Jp\261\3563\322\30\210}X\267\222@|7Y70+<[\213nJ\313f(K\313\0\7\307\226\214.\25\246\271U\177V\25\272\210L\344*\350\361\336\201fs\344\273\371\375Y#\270H\4!\234L9.\211\213\276\272\6\357\303\365\13\373h\10\343.\306\217\266\225\222\252+\37\301\360tS\254\11\264=\336F\277\300\221+\30k\206\227*\23\372'\362\17\3}\203\224W\14\257\310\230\2733\6^#\207\357\354\340)\303\\364\344\370!\242}\14`oU\31\350\277\344\257\26;ak\1,w_\0\350\304%z:\235\375\27\223\213\303Kj\272\10~\d\207\2\343u\337\37\337\270\253Y\7\224@\2\371\370\37E\252<_\27~\12\247\10+\267>$=\242k\15", ) == 0x0
 02592   896   NtWriteFile  (308, 0, 0, 0,  (308, 0, 0, 0, "5\373\342_?\230\16\1\215\341\32\240\303\34A_\3209\261u\234T\222\22\255/v\265(f\177\7\346W>M\374\271\252\17\336\276H\24m\202\333uL\37`_\202\223\223S8\321\177\7\236VY\3023\231N\3\235\277\2340%\273\213\312=\14B $\372\253\262\13\234:\247\363R\241J\201\310\17\204\17\2329\222\1\344>\30QH\210\2763\222@A/\317W:s\342jU\373U/\1%\373_\370Q\351\207\226o>5\36\224Wx0\31\217\263:t\376 w\253\305$\351v\317:\36\263g\307#l\7^\10P\30\343\321\20j<\271b\2772S.\347\360QXa\14\272\207\32\370\227\357~\364\261=P7\22\37\323{&\22)\265\272\204>^d'\1/\5\0\305\13{\7\360\32\275\217\244!\330\261~\275?\274\240\13\241\242P`\246\37\301\224sE\212\364ZqPz\253k\240\267\311\234\216j\212\241\20\244\231Jp\261\3563\322\30\210}X\267\222@|7Y70+<[\213nJ\313f(K\313\0\7\307\226\214.\25\246\271U\177V\25\272\210L\344*\350\361\336\201fs\344\273\371\375Y#\270H\4!\234L9.\211\213\276\272\6\357\303\365\13\373h\10\343.\306\217\266\225\222\252+\37\301\360tS\254\11\264=\336F\277\300\221+\30k\206\227*\23\372'\362\17\3}\203\224W\14\257\310\230\2733\6^#\207\357\354\340)\303\\364\344\370!\242}\14`oU\31\350\277\344\257\26;ak\1,w_\0\350\304%z:\235\375\27\223\213\303Kj\272\10~\d\207\2\343u\337\37\337\270\253Y\7\224@\2\371\370\37E\252<_\27~\12\247\10+\267>$=\242k\15", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \360QXa\14\272\207\32\370\227\357~\364\261=P7\22\37\323{&\22)\265\272\204>^d'\1/\5\0\305\13{\7\360\32\275\217\244!\330\261~\275?\274\240\13\241\242P`\246\37\301\224sE\212\364ZqPz\253k\240\267\311\234\216j\212\241\20\244\231Jp\261\3563\322\30\210}X\267\222@|7Y70+<[\213nJ\313f(K\313\0\7\307\226\214.\25\246\271U\177V\25\272\210L\344*\350\361\336\201fs\344\273\371\375Y#\270H\4!\234L9.\211\213\276\272\6\357\303\365\13\373h\10\343.\306\217\266\225\222\252+\37\301\360tS\254\11\264=\336F\277\300\221+\30k\206\227*\23\372'\362\17\3}\203\224W\14\257\310\230\2733\6^#\207\357\354\340)\303\\364\344\370!\242}\14`oU\31\350\277\344\257\26;ak\1,w_\0\350\304%z:\235\375\27\223\213\303Kj\272\10~\d\207\2\343u\337\37\337\270\253Y\7\224@\2\371\370\37E\252<_\27~\12\247\10+\267>$=\242k\15", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 02593   896   NtReadFile  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=33028},  (300, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=33028}, "\355\277j\1:\267\236O/l\337YN\252V\224\12\234\356\266\370\331F\272\306\311\200\320>Q\360+c_4P\214\243\26/\337\370\300_\16;\251\246\3}yj\3\305[\300\13)\16\106\31\17\334YD)B\2422\210\25\6\17-\372\242\217(\263\362\331B\360\306\11\374\314Zq\3121Y\5R\317UEE[]\262=\\234\250\2\245\205\21\221T\234\240t\204\16\36\252\331v2\273NY\211Ot\5\270\214a\3770\32\215p\37\220\210\205R\240\26\317\15\277\226@\25\243\245\201"}S\324j\22\242\340\22)\224\320\366\22\20\230\30@s\177\265O/\205\266^\356\20\233N#\223E\302\20?\16\22\271|\21_\261\216\253\20*;p\13\214'\31}No|BJ\221\376C\12^V\240\22q\7F5/\2543\274\240\202E\372\241\370\233\14{\334\15\374n3\311\221-\241\220Oz\215\361\10X\225\177:h$I\02`&\342-\2539\356\4\4G\330\\27\261;\320\315Z\35\300A=\357\324\271L\20\372\326\351\225+:\223\377!\201\6\370T*Hu\240\307\367d7\16\23\315\33\22\276xD\23,A.\262\374-\345v\31\260\274\12\243\332%*\220~W\371L, \316c\31|\257\36\300 \266\17\215t\276P\25\246\24\5\272?p\36\30'fTp?\210p7WP$\257k\372\315\344\217\36\373h\342I[\254\217AHb-\373\377\346\325\14\05\2349\264\355C\373\367\377.\21.\320\333\277\261Y\216\240\324.\332:\300Cu\364\17\202\210\226\304o23\22\200\253\244\373(\233\32Ix<\242X\203W)~\26\3N\204\177\302\316\15q\241\270#\0\252\7\213\260\374\253\350-\3601SQ|T\30\364z%\35\307\366\202t\263Q\315P\221|\271o\377&\304\236\214", ) }S\324j\22\242\340\22)\224\320\366\22\20\230\30@s\177\265O/\205\266^\356\20\233N#\223E\302\20?\16\22\271|\21_\261\216\253\20*;p\13\214'\31}No|BJ\221\376C\12^V\240\22q\7F5/\2543\274\240\202E\372\241\370\233\14{\334\15\374n3\311\221-\241\220Oz\215\361\10X\225\177:h$I\02`&\342-\2539\356\4\4G\330\\27\261;\320\315Z\35\300A=\357\324\271L\20\372\326\351\225+:\223\377!\201\6\370T*Hu\240\307\367d7\16\23\315\33\22\276xD\23,A.\262\374-\345v\31\260\274\12\243\332%*\220~W\371L, \316c\31|\257\36\300 \266\17\215t\276P\25\246\24\5\272?p\36\30'fTp?\210p7WP$\257k\372\315\344\217\36\373h\342I[\254\217AHb-\373\377\346\325\14\05\2349\264\355C\373\367\377.\21.\320\333\277\261Y\216\240\324.\332:\300Cu\364\17\202\210\226\304o23\22\200\253\244\373(\233\32Ix<\242X\203W)~\26\3N\204\177\302\316\15q\241\270#\0\252\7\213\260\374\253\350-\3601SQ|T\30\364z%\35\307\366\202t\263Q\315P\221|\271o\377&\304\236\214", ) == 0x0
 02594   896   NtWriteFile  (308, 0, 0, 0,  (308, 0, 0, 0, "\355\277j\1:\267\236O/l\337YN\252V\224\12\234\356\266\370\331F\272\306\311\200\320>Q\360+c_4P\214\243\26/\337\370\300_\16;\251\246\3}yj\3\305[\300\13)\16\106\31\17\334YD)B\2422\210\25\6\17-\372\242\217(\263\362\331B\360\306\11\374\314Zq\3121Y\5R\317UEE[]\262=\\234\250\2\245\205\21\221T\234\240t\204\16\36\252\331v2\273NY\211Ot\5\270\214a\3770\32\215p\37\220\210\205R\240\26\317\15\277\226@\25\243\245\201"}S\324j\22\242\340\22)\224\320\366\22\20\230\30@s\177\265O/\205\266^\356\20\233N#\223E\302\20?\16\22\271|\21_\261\216\253\20*;p\13\214'\31}No|BJ\221\376C\12^V\240\22q\7F5/\2543\274\240\202E\372\241\370\233\14{\334\15\374n3\311\221-\241\220Oz\215\361\10X\225\177:h$I\02`&\342-\2539\356\4\4G\330\\27\261;\320\315Z\35\300A=\357\324\271L\20\372\326\351\225+:\223\377!\201\6\370T*Hu\240\307\367d7\16\23\315\33\22\276xD\23,A.\262\374-\345v\31\260\274\12\243\332%*\220~W\371L, \316c\31|\257\36\300 \266\17\215t\276P\25\246\24\5\272?p\36\30'fTp?\210p7WP$\257k\372\315\344\217\36\373h\342I[\254\217AHb-\373\377\346\325\14\05\2349\264\355C\373\367\377.\21.\320\333\277\261Y\216\240\324.\332:\300Cu\364\17\202\210\226\304o23\22\200\253\244\373(\233\32Ix<\242X\203W)~\26\3N\204\177\302\316\15q\241\270#\0\252\7\213\260\374\253\350-\3601SQ|T\30\364z%\35\307\366\202t\263Q\315P\221|\271o\377&\304\236\214", 33028, 0x0, 0, ... {status=0x0, info=33028}, ) }S\324j\22\242\340\22)\224\320\366\22\20\230\30@s\177\265O/\205\266^\356\20\233N#\223E\302\20?\16\22\271|\21_\261\216\253\20*;p\13\214'\31}No|BJ\221\376C\12^V\240\22q\7F5/\2543\274\240\202E\372\241\370\233\14{\334\15\374n3\311\221-\241\220Oz\215\361\10X\225\177:h$I\02`&\342-\2539\356\4\4G\330\\27\261;\320\315Z\35\300A=\357\324\271L\20\372\326\351\225+:\223\377!\201\6\370T*Hu\240\307\367d7\16\23\315\33\22\276xD\23,A.\262\374-\345v\31\260\274\12\243\332%*\220~W\371L, \316c\31|\257\36\300 \266\17\215t\276P\25\246\24\5\272?p\36\30'fTp?\210p7WP$\257k\372\315\344\217\36\373h\342I[\254\217AHb-\373\377\346\325\14\05\2349\264\355C\373\367\377.\21.\320\333\277\261Y\216\240\324.\332:\300Cu\364\17\202\210\226\304o23\22\200\253\244\373(\233\32Ix<\242X\203W)~\26\3N\204\177\302\316\15q\241\270#\0\252\7\213\260\374\253\350-\3601SQ|T\30\364z%\35\307\366\202t\263Q\315P\221|\271o\377&\304\236\214", 33028, 0x0, 0, ... {status=0x0, info=33028}, ) == 0x0
 02595   896   NtReadFile  (300, 0, 0, 0, 61440, 0x0, 0, ... ) == STATUS_END_OF_FILE
 02596   896   NtFreeVirtualMemory  (-1, (0x157000), 69632, 16384, ... (0x157000), 69632, ) == 0x0
 02597   896   NtSetInformationFile  (308, 1241304, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02598   896   NtClose  (300, ... ) == 0x0
 02599   896   NtClose  (308, ... ) == 0x0
 02600   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02601   896   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02602   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02603   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02604   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == 0x0
 02605   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241924,  (0x80100080, {24, 0, 0x40, 0, 1241924, "\??\C:\WINDOWS\explorer.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 308, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 308, {status=0x0, info=1}, ) == 0x0
 02606   896   NtQueryInformationFile  (308, 1241976, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02607   896   NtClose  (308, ... ) == 0x0
 02608   896   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1241924,  (0x40100080, {24, 0, 0x40, 0, 1241924, "\??\C:\WINDOWS\system32\oxtdujo32.exe"}, 0x0, 128, 2, 1, 96, 0, 0, ... 308, {status=0x0, info=1}, ) }, 0x0, 128, 2, 1, 96, 0, 0, ... 308, {status=0x0, info=1}, ) == 0x0
 02609   896   NtSetInformationFile  (308, 1241976, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02610   896   NtClose  (308, ... ) == 0x0
 02611   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\oxtdujo32.exe"}, 7, 2113568, ... 308, {status=0x0, info=1}, ) }, 7, 2113568, ... 308, {status=0x0, info=1}, ) == 0x0
 02612   896   NtSetInformationFile  (308, 1242224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02613   896   NtClose  (308, ... ) == 0x0
 02614   896   NtOpenProcess  (0x100000, {24, 0, 0x2, 0, 0, 0x0}, {1252, 0}, ... 308, ) == 0x0
 02615   896   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 02616   896   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\oxtdujo32.exe"}, 5, 96, ... 300, {status=0x0, info=1}, ) }, 5, 96, ... 300, {status=0x0, info=1}, ) == 0x0
 02617   896   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 300, ... 312, ) == 0x0
 02618   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02619   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 316, ) }, ... 316, ) == 0x0
 02620   896   NtQueryValueKey  (316,  (316, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02621   896   NtClose  (316, ... ) == 0x0
 02622   896   NtQueryVolumeInformationFile  (300, 1238600, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02623   896   NtOpenMutant  (0x120001, {24, 72, 0x0, 0, 0,  (0x120001, {24, 72, 0x0, 0, 0, "ShimCacheMutex"}, ... 316, ) }, ... 316, ) == 0x0
 02624   896   NtWaitForSingleObject  (316, 0, {-1000000, -1}, ... ) == 0x0
 02625   896   NtOpenSection  (0x2, {24, 72, 0x0, 0, 0,  (0x2, {24, 72, 0x0, 0, 0, "ShimSharedMemory"}, ... 320, ) }, ... 320, ) == 0x0
 02626   896   NtMapViewOfSection  (320, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1ed0000), {0, 0}, 57344, ) == 0x0
 02627   896   NtReleaseMutant  (316, ... 0x0, ) == 0x0
 02628   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1236532, ... ) }, 1236532, ... ) == 0x0
 02629   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 324, {status=0x0, info=1}, ) }, 5, 96, ... 324, {status=0x0, info=1}, ) == 0x0
 02630   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 324, ... 328, ) == 0x0
 02631   896   NtClose  (324, ... ) == 0x0
 02632   896   NtMapViewOfSection  (328, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1ee0000), 0x0, 126976, ) == 0x0
 02633   896   NtClose  (328, ... ) == 0x0
 02634   896   NtUnmapViewOfSection  (-1, 0x1ee0000, ... ) == 0x0
 02635   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1236840, ... ) }, 1236840, ... ) == 0x0
 02636   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 328, {status=0x0, info=1}, ) }, 5, 96, ... 328, {status=0x0, info=1}, ) == 0x0
 02637   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 328, ... 324, ) == 0x0
 02638   896   NtQuerySection  (324, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02639   896   NtClose  (328, ... ) == 0x0
 02640   896   NtMapViewOfSection  (324, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 02641   896   NtClose  (324, ... ) == 0x0
 02642   896   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 02643   896   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 02644   896   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 02645   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02646   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 324, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 324, {status=0x0, info=1}, ) == 0x0
 02647   896   NtQueryInformationFile  (324, 1236856, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02648   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 324, ... 328, ) == 0x0
 02649   896   NtMapViewOfSection  (328, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1ee0000), 0x0, 1191936, ) == 0x0
 02650   896   NtQueryInformationFile  (324, 1236956, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02651   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02652   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02653   896   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02654   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02655   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 332, ) }, ... 332, ) == 0x0
 02656   896   NtQueryValueKey  (332,  (332, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (332, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02657   896   NtClose  (332, ... ) == 0x0
 02658   896   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02659   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 332, {status=0x0, info=1}, ) }, 3, 16417, ... 332, {status=0x0, info=1}, ) == 0x0
 02660   896   NtQueryDirectoryFile  (332, 0, 0, 0, 1234552, 616, BothDirectory, 1,  (332, 0, 0, 0, 1234552, 616, BothDirectory, 1, "oxtdujo32.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0
 02661   896   NtClose  (332, ... ) == 0x0
 02662   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02663   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02664   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\oxtdujo32.exe"}, 1234928, ... ) }, 1234928, ... ) == 0x0
 02665   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 332, {status=0x0, info=1}, ) }, 3, 16417, ... 332, {status=0x0, info=1}, ) == 0x0
 02666   896   NtQueryDirectoryFile  (332, 0, 0, 0, 1234356, 616, BothDirectory, 1,  (332, 0, 0, 0, 1234356, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02667   896   NtClose  (332, ... ) == 0x0
 02668   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 332, {status=0x0, info=1}, ) }, 3, 16417, ... 332, {status=0x0, info=1}, ) == 0x0
 02669   896   NtQueryDirectoryFile  (332, 0, 0, 0, 1234356, 616, BothDirectory, 1,  (332, 0, 0, 0, 1234356, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02670   896   NtClose  (332, ... ) == 0x0
 02671   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02672   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02673   896   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02674   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02675   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02676   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 332, ) == 0x0
 02677   896   NtQueryInformationToken  (332, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02678   896   NtClose  (332, ... ) == 0x0
 02679   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02680   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\oxtdujo32.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02681   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02682   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02683   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\oxtdujo32.exe"}, 1236180, ... ) }, 1236180, ... ) == 0x0
 02684   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 332, {status=0x0, info=1}, ) }, 3, 16417, ... 332, {status=0x0, info=1}, ) == 0x0
 02685   896   NtQueryDirectoryFile  (332, 0, 0, 0, 1235608, 616, BothDirectory, 1,  (332, 0, 0, 0, 1235608, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02686   896   NtClose  (332, ... ) == 0x0
 02687   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 332, {status=0x0, info=1}, ) }, 3, 16417, ... 332, {status=0x0, info=1}, ) == 0x0
 02688   896   NtQueryDirectoryFile  (332, 0, 0, 0, 1235608, 616, BothDirectory, 1,  (332, 0, 0, 0, 1235608, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02689   896   NtClose  (332, ... ) == 0x0
 02690   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02691   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02692   896   NtWaitForSingleObject  (316, 0, {-1000000, -1}, ... ) == 0x0
 02693   896   NtQueryVolumeInformationFile  (300, 1236836, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02694   896   NtQueryInformationFile  (300, 1236816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02695   896   NtQueryInformationFile  (300, 1236856, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02696   896   NtReleaseMutant  (316, ... 0x0, ) == 0x0
 02697   896   NtUnmapViewOfSection  (-1, 0x1ee0000, ... ) == 0x0
 02698   896   NtClose  (328, ... ) == 0x0
 02699   896   NtClose  (324, ... ) == 0x0
 02700   896   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 02701   896   NtOpenProcessToken  (-1, 0xa, ... 324, ) == 0x0
 02702   896   NtQueryInformationToken  (324, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 02703   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02704   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 328, ) }, ... 328, ) == 0x0
 02705   896   NtQueryValueKey  (328,  (328, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (328, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02706   896   NtQueryValueKey  (328,  (328, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (328, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02707   896   NtClose  (328, ... ) == 0x0
 02708   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02709   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 328, ) }, ... 328, ) == 0x0
 02710   896   NtQueryValueKey  (328,  (328, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02711   896   NtClose  (328, ... ) == 0x0
 02712   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02713   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02714   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02715   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02716   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02717   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02718   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02719   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02720   896   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ... 1404928, 4096, ) == 0x0
 02721   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02722   896   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02723   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 328, ) }, ... 328, ) == 0x0
 02724   896   NtEnumerateKey  (328, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (328, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 02725   896   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 332, ) }, ... 332, ) == 0x0
 02726   896   NtQueryValueKey  (332,  (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 02727   896   NtQueryValueKey  (332,  (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02728   896   NtClose  (332, ... ) == 0x0
 02729   896   NtEnumerateKey  (328, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 02730   896   NtClose  (328, ... ) == 0x0
 02731   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 328, ) }, ... 328, ) == 0x0
 02732   896   NtEnumerateKey  (328, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (328, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 02733   896   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 332, ) }, ... 332, ) == 0x0
 02734   896   NtQueryValueKey  (332,  (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 02735   896   NtQueryValueKey  (332,  (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02736   896   NtQueryValueKey  (332,  (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02737   896   NtQueryValueKey  (332,  (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02738   896   NtClose  (332, ... ) == 0x0
 02739   896   NtEnumerateKey  (328, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (328, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 02740   896   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 332, ) }, ... 332, ) == 0x0
 02741   896   NtQueryValueKey  (332,  (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 02742   896   NtQueryValueKey  (332,  (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02743   896   NtQueryValueKey  (332,  (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02744   896   NtQueryValueKey  (332,  (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02745   896   NtClose  (332, ... ) == 0x0
 02746   896   NtEnumerateKey  (328, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (328, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 02747   896   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 332, ) }, ... 332, ) == 0x0
 02748   896   NtQueryValueKey  (332,  (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 02749   896   NtQueryValueKey  (332,  (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02750   896   NtQueryValueKey  (332,  (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02751   896   NtQueryValueKey  (332,  (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02752   896   NtClose  (332, ... ) == 0x0
 02753   896   NtEnumerateKey  (328, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (328, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 02754   896   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 332, ) }, ... 332, ) == 0x0
 02755   896   NtQueryValueKey  (332,  (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 02756   896   NtQueryValueKey  (332,  (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02757   896   NtQueryValueKey  (332,  (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02758   896   NtQueryValueKey  (332,  (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02759   896   NtClose  (332, ... ) == 0x0
 02760   896   NtEnumerateKey  (328, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (328, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 02761   896   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 332, ) }, ... 332, ) == 0x0
 02762   896   NtQueryValueKey  (332,  (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (332, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 02763   896   NtQueryValueKey  (332,  (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02764   896   NtQueryValueKey  (332,  (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (332, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02765   896   NtQueryValueKey  (332,  (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (332, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02766   896   NtClose  (332, ... ) == 0x0
 02767   896   NtEnumerateKey  (328, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 02768   896   NtClose  (328, ... ) == 0x0
 02769   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02770   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02771   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02772   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02773   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02774   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02775   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02776   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02777   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02778   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02779   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02780   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02781   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02782   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02783   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02784   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02785   896   NtClose  (328, ... ) == 0x0
 02786   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02787   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02788   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02789   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02790   896   NtClose  (328, ... ) == 0x0
 02791   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02792   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02793   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02794   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02795   896   NtClose  (328, ... ) == 0x0
 02796   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02797   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02798   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02799   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02800   896   NtClose  (328, ... ) == 0x0
 02801   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02802   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02803   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02804   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02805   896   NtClose  (328, ... ) == 0x0
 02806   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02807   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02808   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02809   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02810   896   NtClose  (328, ... ) == 0x0
 02811   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02812   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02813   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02814   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02815   896   NtClose  (328, ... ) == 0x0
 02816   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02817   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02818   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02819   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02820   896   NtClose  (328, ... ) == 0x0
 02821   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02822   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02823   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02824   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02825   896   NtClose  (328, ... ) == 0x0
 02826   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02827   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02828   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02829   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02830   896   NtClose  (328, ... ) == 0x0
 02831   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02832   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02833   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02834   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02835   896   NtClose  (328, ... ) == 0x0
 02836   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02837   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02838   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02839   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02840   896   NtClose  (328, ... ) == 0x0
 02841   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02842   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02843   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02844   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02845   896   NtClose  (328, ... ) == 0x0
 02846   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02847   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02848   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02849   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02850   896   NtClose  (328, ... ) == 0x0
 02851   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02852   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02853   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02854   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02855   896   NtClose  (328, ... ) == 0x0
 02856   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02857   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 328, ) }, ... 328, ) == 0x0
 02858   896   NtQueryValueKey  (328,  (328, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (328, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (328, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 02859   896   NtClose  (328, ... ) == 0x0
 02860   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02861   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02862   896   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02863   896   NtClose  (328, ... ) == 0x0
 02864   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02865   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 02866   896   NtOpenProcessToken  (-1, 0xa, ... 328, ) == 0x0
 02867   896   NtDuplicateToken  (328, 0xc, {24, 0, 0x0, 0, 1238460, 0x0}, 0, 2, ... 332, ) == 0x0
 02868   896   NtClose  (328, ... ) == 0x0
 02869   896   NtAccessCheck  (1406312, 332, 0x1, 1238536, 1238588, 56, 1238568, ... (0x1), ) == 0x0
 02870   896   NtClose  (332, ... ) == 0x0
 02871   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 332, ) }, ... 332, ) == 0x0
 02872   896   NtQueryValueKey  (332,  (332, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (332, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02873   896   NtClose  (332, ... ) == 0x0
 02874   896   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 332, ) }, ... 332, ) == 0x0
 02875   896   NtQuerySymbolicLinkObject  (332, ...  (332, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 02876   896   NtClose  (332, ... ) == 0x0
 02877   896   NtQueryVolumeInformationFile  (300, 1236292, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02878   896   NtQueryInformationFile  (300, 1236408, 528, Name, ... {status=0x0, info=66}, ) == 0x0
 02879   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02880   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02881   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\oxtdujo32.exe"}, 1235580, ... ) }, 1235580, ... ) == 0x0
 02882   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 332, {status=0x0, info=1}, ) }, 3, 16417, ... 332, {status=0x0, info=1}, ) == 0x0
 02883   896   NtQueryDirectoryFile  (332, 0, 0, 0, 1235008, 616, BothDirectory, 1,  (332, 0, 0, 0, 1235008, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02884   896   NtClose  (332, ... ) == 0x0
 02885   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 332, {status=0x0, info=1}, ) }, 3, 16417, ... 332, {status=0x0, info=1}, ) == 0x0
 02886   896   NtQueryDirectoryFile  (332, 0, 0, 0, 1235008, 616, BothDirectory, 1,  (332, 0, 0, 0, 1235008, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02887   896   NtClose  (332, ... ) == 0x0
 02888   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02889   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02890   896   NtQueryInformationFile  (300, 1238448, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02891   896   NtCreateSection  (0xf0005, 0x0, {278788, 0}, 2, 134217728, 300, ... 332, ) == 0x0
 02892   896   NtMapViewOfSection  (332, -1, (0x0), 0, 0, {0, 0}, 278788, 1, 0, 2, ... (0x1ee0000), {0, 0}, 282624, ) == 0x0
 02893   896   NtClose  (332, ... ) == 0x0
 02894   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02895   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 332, ) == 0x0
 02896   896   NtQueryInformationToken  (332, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02897   896   NtClose  (332, ... ) == 0x0
 02898   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 332, ) }, ... 332, ) == 0x0
 02899   896   NtOpenKey  (0x20019, {24, 332, 0x40, 0, 0,  (0x20019, {24, 332, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 328, ) }, ... 328, ) == 0x0
 02900   896   NtClose  (332, ... ) == 0x0
 02901   896   NtQueryValueKey  (328,  (328, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02902   896   NtQueryValueKey  (328,  (328, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (328, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 02903   896   NtClose  (328, ... ) == 0x0
 02904   896   NtUnmapViewOfSection  (-1, 0x1ee0000, ... ) == 0x0
 02905   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 32374784, 4096, ) == 0x0
 02906   896   NtAllocateVirtualMemory  (-1, 32374784, 0, 4096, 4096, 4, ... 32374784, 4096, ) == 0x0
 02907   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 328, ) }, ... 328, ) == 0x0
 02908   896   NtQueryValueKey  (328,  (328, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02909   896   NtClose  (328, ... ) == 0x0
 02910   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02911   896   NtQueryInformationToken  (324, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 02912   896   NtQueryInformationToken  (324, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 02913   896   NtClose  (324, ... ) == 0x0
 02914   896   NtQuerySection  (312, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02915   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oxtdujo32.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02916   896   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 02917   896   NtCreateProcessEx  (1240372, 2035711, 0, -1, 4, 312, 0, 0, 0, ... ) == 0x0
 02918   896   NtSetInformationProcess  (324, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0
 02919   896   NtQueryInformationProcess  (324, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1276,ParentPid=1252,}, 0x0, ) == 0x0
 02920   896   NtReadVirtualMemory  (324, 0x7ffdf008, 4, ...  (324, 0x7ffdf008, 4, ... "\0\0@\0", 0x0, ) , 0x0, ) == 0x0
 02921   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\oxtdujo32.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02922   896   NtAllocateVirtualMemory  (-1, 1409024, 0, 8192, 4096, 4, ... 1409024, 8192, ) == 0x0
 02923   896   NtReadVirtualMemory  (324, 0x400000, 4096, ...  (324, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0,\354.\261h\215@\342h\215@\342h\215@\342\242\256g\342i\215@\342\222\251\0\342v\215@\342\222\251\\342\344\215@\342\222\256Y\342m\215@\342h\215A\342\344\215@\342\222\251]\342-\215@\342\222\251}\342i\215@\342Richh\215@\342\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\5\0\247\25{C\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\332\1\0\0\274\5\0\0\0\0\0\0\340\7\0\0\20\0\0\0\360\1\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\360\7\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\334\3\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\300\7\0\36\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\304\330\1\0\0\20\0\0\0\16\1\0\0\4\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 02924   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02925   896   NtQueryInformationProcess  (324, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1276,ParentPid=1252,}, 0x0, ) == 0x0
 02926   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1239324, ... ) }, 1239324, ... ) == 0x0
 02927   896   NtAllocateVirtualMemory  (-1, 0, 0, 2420, 4096, 4, ... 32440320, 4096, ) == 0x0
 02928   896   NtAllocateVirtualMemory  (324, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 02929   896   NtWriteVirtualMemory  (324, 0x10000,  (324, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 02930   896   NtAllocateVirtualMemory  (324, 0, 0, 2420, 4096, 4, ... 131072, 4096, ) == 0x0
 02931   896   NtWriteVirtualMemory  (324, 0x20000,  (324, 0x20000, "\0\20\0\0t\11\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0&\0\10\2\220\2\0\0\16\0\0\0\364\3\366\3\230\4\0\0B\0D\0\220\10\0\0t\0v\0\324\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\2\0L\11\0\0\36\0 \0P\11\0\0\0\0\2\0p\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2420, ... 0x0, ) , 2420, ... 0x0, ) == 0x0
 02932   896   NtWriteVirtualMemory  (324, 0x7ffdf010,  (324, 0x7ffdf010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02933   896   NtWriteVirtualMemory  (324, 0x7ffdf1e8,  (324, 0x7ffdf1e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02934   896   NtFreeVirtualMemory  (-1, (0x1ef0000), 0, 32768, ... (0x1ef0000), 4096, ) == 0x0
 02935   896   NtAllocateVirtualMemory  (324, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 02936   896   NtAllocateVirtualMemory  (324, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 02937   896   NtProtectVirtualMemory  (324, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 02938   896   NtCreateThread  (0x1f03ff, 0x0, 324, 1240380, 1240044, 1, ... 328, {1276, 220}, ) == 0x0
 02939   896   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 2089879886, 34769, 1240972, 1241912}  (24, {168, 196, new_msg, 0, 2089879886, 34769, 1240972, 1241912} "\0\0\0\0\0\0\1\0`\363\22\0\10\0\0\0G\1\0\0H\1\0\0\374\4\0\0\334\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\334\375\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\22\0\0\0\0\0" ... {168, 196, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\10\0\0\0D\1\0\0H\1\0\0\374\4\0\0\334\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\334\375\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\22\0\0\0\0\0" )  ... {168, 196, reply, 0, 1252, 896, 81853, 0}  (24, {168, 196, new_msg, 0, 2089879886, 34769, 1240972, 1241912} "\0\0\0\0\0\0\1\0`\363\22\0\10\0\0\0G\1\0\0H\1\0\0\374\4\0\0\334\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\334\375\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\22\0\0\0\0\0" ... {168, 196, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\10\0\0\0D\1\0\0H\1\0\0\374\4\0\0\334\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\334\375\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\22\0\0\0\0\0" )  ) == 0x0
 02940   896   NtResumeThread  (328, ... 1, ) == 0x0
 02941   896   NtClose  (300, ... ) == 0x0
 02942   896   NtClose  (312, ... ) == 0x0
 02943   896   NtDelayExecution  (0, {-2000000, -1}, ... ) == 0x0
 02944   896   NtClose  (324, ... ) == 0x0
 02945   896   NtClose  (328, ... ) == 0x0
 02946   896   NtTerminateProcess  (0, 0, ...
 01444  2016   NtWaitForMultipleObjects  ... ) == 0xc0
 02946   896   NtTerminateProcess  ... ) == 0x0
 02947   896   NtFreeVirtualMemory  (-1, (0x1dc0000), 0, 32768, ... (0x1dc0000), 65536, ) == 0x0
 02948   896   NtClose  (256, ... ) == 0x0
 02949   896   NtClose  (260, ... ) == 0x0
 02950   896   NtClose  (268, ... ) == 0x0
 02951   896   NtClose  (264, ... ) == 0x0
 02952   896   NtClose  (272, ... ) == 0x0
 02953   896   NtClose  (276, ... ) == 0x0
 02954   896   NtClose  (280, ... ) == 0x0
 02955   896   NtClose  (296, ... ) == 0x0
 02956   896   NtClose  (292, ... ) == 0x0
 02957   896   NtClose  (288, ... ) == 0x0
 02958   896   NtClose  (284, ... ) == 0x0
 02959   896   NtClose  (172, ... ) == 0x0
 02960   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xd,}, 4, ... ) == 0x0
 02961   896   NtUserQueryWindow  (65670, 0, ... ) == 0x6b8
 02962   896   NtUserQueryWindow  (65670, 1, ... ) == 0x6bc
 02963   896   NtUnmapViewOfSection  (-1, 0x1ca0000, ... ) == 0x0
 02964   896   NtClose  (176, ... ) == 0x0
 02965   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xb,}, 4, ... ) == 0x0
 02966   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xc,}, 4, ... ) == 0x0
 02967   896   NtClose  (152, ... ) == 0x0
 02968   896   NtClose  (148, ... ) == 0x0
 02969   896   NtClose  (156, ... ) == 0x0
 02970   896   NtUserGetAtomName  (49211, 1241212, ... ) == 0xf
 02971   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02972   896   NtUserGetAtomName  (49213, 1241212, ... ) == 0xd
 02973   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02974   896   NtUserGetAtomName  (49215, 1241212, ... ) == 0x10
 02975   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02976   896   NtUserGetAtomName  (49217, 1241212, ... ) == 0x12
 02977   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02978   896   NtUserGetAtomName  (49219, 1241212, ... ) == 0xd
 02979   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02980   896   NtUserGetAtomName  (49221, 1241212, ... ) == 0xb
 02981   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02982   896   NtUserGetAtomName  (49223, 1241212, ... ) == 0xf
 02983   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02984   896   NtUserGetAtomName  (49225, 1241212, ... ) == 0xd
 02985   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02986   896   NtUserGetAtomName  (49227, 1241212, ... ) == 0x11
 02987   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02988   896   NtUserGetAtomName  (49229, 1241212, ... ) == 0xf
 02989   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02990   896   NtUserGetAtomName  (49231, 1241212, ... ) == 0x11
 02991   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02992   896   NtUserGetAtomName  (49233, 1241212, ... ) == 0xf
 02993   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02994   896   NtUserGetAtomName  (49235, 1241212, ... ) == 0xc
 02995   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02996   896   NtUserGetAtomName  (49237, 1241204, ... ) == 0xd
 02997   896   NtUserUnregisterClass  (1241264, 2000486400, 1241252, ... ) == 0x1
 02998   896   NtUserGetAtomName  (49239, 1241204, ... ) == 0x11
 02999   896   NtUserUnregisterClass  (1241264, 2000486400, 1241252, ... ) == 0x1
 03000   896   NtUserGetAtomName  (49241, 1241212, ... ) == 0xc
 03001   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03002   896   NtUserGetAtomName  (49243, 1241212, ... ) == 0xe
 03003   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03004   896   NtUserGetAtomName  (49245, 1241212, ... ) == 0x8
 03005   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03006   896   NtUserGetAtomName  (49247, 1241212, ... ) == 0xd
 03007   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03008   896   NtUserGetAtomName  (49175, 1241212, ... ) == 0x6
 03009   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03010   896   NtUserGetAtomName  (49177, 1241212, ... ) == 0x6
 03011   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03012   896   NtUserGetAtomName  (49176, 1241212, ... ) == 0x4
 03013   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03014   896   NtUserGetAtomName  (49178, 1241212, ... ) == 0x7
 03015   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03016   896   NtUserGetAtomName  (49180, 1241212, ... ) == 0x8
 03017   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03018   896   NtUserGetAtomName  (49182, 1241212, ... ) == 0x9
 03019   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03020   896   NtUserGetAtomName  (49179, 1241204, ... ) == 0x9
 03021   896   NtUserUnregisterClass  (1241264, 2000486400, 1241252, ... ) == 0x1
 03022   896   NtUserGetAtomName  (49256, 1241212, ... ) == 0x7
 03023   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03024   896   NtUserGetAtomName  (49258, 1241212, ... ) == 0xd
 03025   896   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03026   896   NtUnmapViewOfSection  (-1, 0x1cb0000, ... ) == 0x0
 03027   896   NtDeviceIoControlFile  (88, 92, 0x0, 0x12f1a0, 0x22415c,  (88, 92, 0x0, 0x12f1a0, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#`\0\0\0\0\0\0\0\10 \251\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#`\0\0\0\0\0\0\0\10 \251\1\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (88, 92, 0x0, 0x12f1a0, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#`\0\0\0\0\0\0\0\10 \251\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#`\0\0\0\0\0\0\0\10 \251\1\306\205\337w", ) , ) == 0x0
 03028   896   NtDeviceIoControlFile  (88, 92, 0x0, 0x12f168, 0x228168,  (88, 92, 0x0, 0x12f168, 0x228168, "`\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 03029   896   NtDeviceIoControlFile  (88, 92, 0x0, 0x12f1a0, 0x22415c,  (88, 92, 0x0, 0x12f1a0, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344|\0\0\0\0\0\0\0\10 \251\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344|\0\0\0\0\0\0\0\10 \251\1\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (88, 92, 0x0, 0x12f1a0, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344|\0\0\0\0\0\0\0\10 \251\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344|\0\0\0\0\0\0\0\10 \251\1\306\205\337w", ) , ) == 0x0
 03030   896   NtDeviceIoControlFile  (88, 92, 0x0, 0x12f168, 0x228168,  (88, 92, 0x0, 0x12f168, 0x228168, "|\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 03031   896   NtWaitForSingleObject  (232, 0, 0x0, ... ) == 0x0
 03032   896   NtClearEvent  (232, ... ) == 0x0
 03033   896   NtSetEvent  (232, ... 0x0, ) == 0x0
 03034   896   NtClose  (232, ... ) == 0x0
 03035   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0
 03036   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 03037   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x9,}, 4, ... ) == 0x0
 03038   896   NtClose  (80, ... ) == 0x0
 03039   896   NtQueryVirtualMemory  (-1, 0x357664, Basic, 28, ... {BaseAddress=0x357000,AllocationBase=0x320000,AllocationProtect=0x80,RegionSize=0x3c000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03040   896   NtQueryVirtualMemory  (-1, 0x357f70, Basic, 28, ... {BaseAddress=0x357000,AllocationBase=0x320000,AllocationProtect=0x80,RegionSize=0x3c000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03041   896   NtQueryVirtualMemory  (-1, 0x32d838, Basic, 28, ... {BaseAddress=0x32d000,AllocationBase=0x320000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03042   896   NtGdiDeleteObjectApp  (2097808862, ... ) == 0x1
 03043   896   NtGdiDeleteObjectApp  (-771094889, ... ) == 0x1
 03044   896   NtGdiDeleteObjectApp  (-1022753048, ... ) == 0x1
 03045   896   NtUserDestroyCursor  (4522625, 1, ... ) == 0x1
 03046   896   NtUserDestroyCursor  (4915711, 1, ... ) == 0x1
 03047   896   NtUserDestroyCursor  (1638799, 1, ... ) == 0x1
 03048   896   NtUserDestroyCursor  (2884243, 1, ... ) == 0x1
 03049   896   NtUserDestroyCursor  (3211747, 1, ... ) == 0x1
 03050   896   NtUserDestroyCursor  (2425495, 1, ... ) == 0x1
 03051   896   NtUserDestroyCursor  (22544723, 1, ... ) == 0x1
 03052   896   NtUserFindExistingCursorIcon  (1241092, 1241108, 1241156, ... ) == 0x10011
 03053   896   NtDeleteAtom  (49194, ... ) == 0x0
 03054   896   NtDeleteAtom  (49193, ... ) == 0x0
 03055   896   NtGdiDeleteObjectApp  (1678247318, ... ) == 0x1
 03056   896   NtClose  (76, ... ) == 0x0
 03057   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0
 03058   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 03059   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 03060   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 03061   896   NtQueryVirtualMemory  (-1, 0x41cd5f, Basic, 28, ... {BaseAddress=0x41c000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x61000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03062   896   NtUserGetAtomName  (49211, 1241180, ... ) == 0xf
 03063   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03064   896   NtUserGetAtomName  (49213, 1241180, ... ) == 0xd
 03065   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03066   896   NtUserGetAtomName  (49215, 1241180, ... ) == 0x10
 03067   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03068   896   NtUserGetAtomName  (49217, 1241180, ... ) == 0x12
 03069   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03070   896   NtUserGetAtomName  (49219, 1241180, ... ) == 0xd
 03071   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03072   896   NtUserGetAtomName  (49221, 1241180, ... ) == 0xb
 03073   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03074   896   NtUserGetAtomName  (49223, 1241180, ... ) == 0xf
 03075   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03076   896   NtUserGetAtomName  (49225, 1241180, ... ) == 0xd
 03077   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03078   896   NtUserGetAtomName  (49227, 1241180, ... ) == 0x11
 03079   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03080   896   NtUserGetAtomName  (49229, 1241180, ... ) == 0xf
 03081   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03082   896   NtUserGetAtomName  (49231, 1241180, ... ) == 0x11
 03083   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03084   896   NtUserGetAtomName  (49233, 1241180, ... ) == 0xf
 03085   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03086   896   NtUserGetAtomName  (49235, 1241180, ... ) == 0xc
 03087   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03088   896   NtUserGetAtomName  (49237, 1241172, ... ) == 0xd
 03089   896   NtUserUnregisterClass  (1241232, 1560870912, 1241220, ... ) == 0x1
 03090   896   NtUserGetAtomName  (49239, 1241172, ... ) == 0x11
 03091   896   NtUserUnregisterClass  (1241232, 1560870912, 1241220, ... ) == 0x1
 03092   896   NtUserGetAtomName  (49241, 1241180, ... ) == 0xc
 03093   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03094   896   NtUserGetAtomName  (49243, 1241180, ... ) == 0xe
 03095   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03096   896   NtUserGetAtomName  (49245, 1241180, ... ) == 0x8
 03097   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03098   896   NtUserGetAtomName  (49247, 1241180, ... ) == 0xd
 03099   896   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 03100   896   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03101   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x1,}, 4, ... ) == 0x0
 03102   896   NtFreeVirtualMemory  (-1, (0x3c0000), 0, 32768, ... (0x3c0000), 65536, ) == 0x0
 03103   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 76, ) }, ... 76, ) == 0x0
 03104   896   NtQueryValueKey  (76,  (76, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03105   896   NtClose  (76, ... ) == 0x0
 03106   896   NtClose  (68, ... ) == 0x0
 03107   896   NtClose  (88, ... ) == 0x0
 03108   896   NtFreeVirtualMemory  (-1, (0x1ee0000), 4096, 32768, ... (0x1ee0000), 4096, ) == 0x0
 03109   896   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 1366936, 0, 0}  (24, {20, 48, new_msg, 0, 0, 1366936, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81871, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 1252, 896, 81871, 0}  (24, {20, 48, new_msg, 0, 0, 1366936, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81871, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03110   896   NtTerminateProcess  (-1, 0, ...