Summary:


NtCallbackReturn(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtSetInformationFile(>) 
 7 
NtUserCallOneParam(>) 
 20 

NtEnumerateValueKey(>) 
 1 
NtOpenMutant(>) 
 3 
NtSetValueKey(>) 
 7 
NtQueryInformationFile(>) 
 25 

NtGdiCreatePaletteInternal(>) 
 1 
NtQueryInformationJobObject(>) 
 3 
NtUserDestroyCursor(>) 
 7 
NtUnmapViewOfSection(>) 
 26 

NtGdiInit(>) 
 1 
NtQueryPerformanceCounter(>) 
 3 
NtUserSetCursorIconData(>) 
 7 
NtOpenSection(>) 
 27 

NtGdiQueryFontAssocInfo(>) 
 1 
NtTerminateProcess(>) 
 3 
NtEnumerateKey(>) 
 8 
NtSetInformationProcess(>) 
 27 

NtNotifyChangeKey(>) 
 1 
NtWaitForMultipleObjects(>) 
 3 
NtGdiCreateBitmap(>) 
 8 
NtWriteFile(>) 
 28 

NtOpenEvent(>) 
 1 
NtCreateSemaphore(>) 
 4 
NtQueryDefaultUILanguage(>) 
 8 
NtQuerySystemInformation(>) 
 32 

NtOpenKeyedEvent(>) 
 1 
NtCreateThread(>) 
 4 
NtWaitForSingleObject(>) 
 8 
NtOpenProcessTokenEx(>) 
 34 

NtOpenProcess(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 4 
NtSetInformationThread(>) 
 9 
NtOpenThreadTokenEx(>) 
 34 

NtQueryInformationThread(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 4 
NtCreateKey(>) 
 10 
NtCreateFile(>) 
 40 

NtQueryInstallUILanguage(>) 
 1 
NtResumeThread(>) 
 4 
NtFreeVirtualMemory(>) 
 10 
NtQueryInformationToken(>) 
 45 

NtQueryObject(>) 
 1 
NtSetInformationObject(>) 
 4 
NtGdiCreateCompatibleDC(>) 
 10 
NtQueryInformationProcess(>) 
 47 

NtSecureConnectPort(>) 
 1 
NtUserWaitForInputIdle(>) 
 4 
NtGdiExtGetObjectW(>) 
 10 
NtUserGetAtomName(>) 
 47 

NtUserCallNoParam(>) 
 1 
NtAccessCheck(>) 
 5 
NtReadVirtualMemory(>) 
 10 
NtUserUnregisterClass(>) 
 47 

NtUserEnumDisplayMonitors(>) 
 1 
NtAddAtom(>) 
 5 
NtCreateEvent(>) 
 11 
NtQueryDirectoryFile(>) 
 50 

NtUserGetKeyboardLayoutList(>) 
 1 
NtOpenThreadToken(>) 
 5 
NtOpenProcessToken(>) 
 11 
NtMapViewOfSection(>) 
 56 

NtUserGetThreadDesktop(>) 
 1 
NtSetEvent(>) 
 5 
NtUserGetDC(>) 
 11 
NtQueryAttributesFile(>) 
 56 

NtUserGetThreadState(>) 
 1 
NtUserRegisterWindowMessage(>) 
 5 
NtDeviceIoControlFile(>) 
 12 
NtGdiSelectBitmap(>) 
 57 

NtUserSetWindowsHookEx(>) 
 1 
NtContinue(>) 
 6 
NtQueryDebugFilterState(>) 
 12 
NtUserRegisterClassExWOW(>) 
 61 

NtDeleteAtom(>) 
 2 
NtQueryKey(>) 
 6 
NtQuerySection(>) 
 12 
NtQueryValueKey(>) 
 68 

NtDuplicateObject(>) 
 2 
NtReleaseMutant(>) 
 6 
NtUserSelectPalette(>) 
 14 
NtOpenFile(>) 
 69 

NtDuplicateToken(>) 
 2 
NtGdiBitBlt(>) 
 7 
NtUserSystemParametersInfo(>) 
 14 
NtAllocateVirtualMemory(>) 
 71 

NtFsControlFile(>) 
 2 
NtGdiCreateDIBitmapInternal(>) 
 7 
NtWriteVirtualMemory(>) 
 14 
NtUserFindExistingCursorIcon(>) 
 74 

NtGdiCreateSolidBrush(>) 
 2 
NtGdiGetDCObject(>) 
 7 
NtQueryVirtualMemory(>) 
 15 
NtCreateSection(>) 
 86 

NtOpenDirectoryObject(>) 
 2 
NtGdiGetDCforBitmap(>) 
 7 
NtQueryVolumeInformationFile(>) 
 15 
NtFlushInstructionCache(>) 
 92 

NtRegisterThreadTerminatePort(>) 
 2 
NtGdiGetStockObject(>) 
 7 
NtRequestWaitReplyPort(>) 
 15 
NtOpenKey(>) 
 160 

NtSetEventBoostPriority(>) 
 2 
NtGdiRestoreDC(>) 
 7 
NtGdiDeleteObjectApp(>) 
 18 
NtProtectVirtualMemory(>) 
 188 

NtTestAlert(>) 
 2 
NtGdiSaveDC(>) 
 7 
NtQueryDefaultLocale(>) 
 18 
NtClose(>) 
 381 

NtCreateProcessEx(>) 
 3 
NtGdiSetDIBitsToDeviceInternal(>) 
 7 
NtReadFile(>) 
 20 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482756, {status=0x0, info=1}, ) }, 0, 32, ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482756, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482756, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482756, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482756, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482756, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482756, 0, 0x0, 0x0, 0x90120,  (-2147482756, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00059   896   NtClose  (-2147482104, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482592, ) == 0x0
 00061   896   NtClose  (-2147482592, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482592, ... -2147481624, ) == 0x0
 00063   896   NtClose  (-2147481624, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481624, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147482104, ... ) == 0x0
 00105   896   NtClose  (-2147482592, ... ) == 0x0
 00106   896   NtClose  (-2147481624, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481624, ) == 0x0
 00145   896   NtClose  (-2147481624, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481624, ... -2147482592, ) == 0x0
 00147   896   NtClose  (-2147482592, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482592, ... -2147482104, ) == 0x0
 00149   896   NtClose  (-2147482104, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482104, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481624, ... ) == 0x0
 00178   896   NtClose  (-2147482592, ... ) == 0x0
 00179   896   NtClose  (-2147482104, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482756, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 8, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 8, ... (0x427000), 8192, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4354048, 8192, ... ) == 0x0
 00249   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00250   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00251   896   NtClose  (16, ... ) == 0x0
 00252   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00253   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00254   896   NtClose  (16, ... ) == 0x0
 00255   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00256   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00257   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00258   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00259   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00260   896   NtClose  (16, ... ) == 0x0
 00261   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00262   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00263   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00264   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00265   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00266   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00267   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00268   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00269   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00270   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00271   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00272   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00273   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00274   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00275   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00276   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00277   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00278   896   NtClose  (16, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00283   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00284   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00285   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00286   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00287   896   NtClose  (16, ... ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00289   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00290   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00291   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00292   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00293   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00294   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00295   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00296   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00297   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00298   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00299   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00300   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00301   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00302   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00303   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00304   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00305   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00306   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00307   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00308   896   NtClose  (16, ... ) == 0x0
 00309   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00310   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00311   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00312   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00313   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00314   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00315   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00316   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00317   896   NtClose  (16, ... ) == 0x0
 00318   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00319   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00320   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00321   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00322   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00323   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00324   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00325   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00326   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00327   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00328   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00329   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00330   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00331   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00332   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00333   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00334   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00335   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00336   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00337   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00338   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00339   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00340   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00341   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00342   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00343   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00344   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00345   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00346   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00347   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00348   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00349   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00350   896   NtFlushInstructionCache  (-1, 4354048, 8192, ... ) == 0x0
 00351   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00352   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 00353   896   NtClose  (16, ... ) == 0x0
 00354   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00355   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00356   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00357   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00358   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00359   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00360   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00361   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00362   896   NtClose  (16, ... ) == 0x0
 00363   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00364   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00365   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00366   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00367   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00368   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00369   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00370   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00371   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00372   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00373   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00374   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00375   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00376   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00377   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00378   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00379   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00380   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00381   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00382   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00383   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00384   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00385   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00386   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00387   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00388   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00389   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00390   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00391   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x320000), 0x0, 36864, ) == STATUS_IMAGE_NOT_AT_BASE
 00392   896   NtProtectVirtualMemory  (-1, (0x321000), 18944, 4, ... (0x321000), 20480, 32, ) == 0x0
 00393   896   NtProtectVirtualMemory  (-1, (0x327000), 1024, 4, ... (0x327000), 4096, 2, ) == 0x0
 00394   896   NtProtectVirtualMemory  (-1, (0x328000), 1536, 4, ... (0x328000), 4096, 2, ) == 0x0
 00395   896   NtMapViewOfSection  (16, -1, (0x320000), 0, 0, 0x0, 36864, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00396   896   NtProtectVirtualMemory  (-1, (0x321000), 18944, 16, ... (0x321000), 20480, 4, ) == 0x0
 00397   896   NtProtectVirtualMemory  (-1, (0x327000), 1024, 2, ... (0x327000), 4096, 8, ) == 0x0
 00398   896   NtProtectVirtualMemory  (-1, (0x328000), 1536, 2, ... (0x328000), 4096, 8, ) == 0x0
 00399   896   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00400   896   NtClose  (16, ... ) == 0x0
 00401   896   NtProtectVirtualMemory  (-1, (0x321000), 160, 4, ... (0x321000), 4096, 16, ) == 0x0
 00402   896   NtProtectVirtualMemory  (-1, (0x321000), 4096, 16, ... (0x321000), 4096, 4, ) == 0x0
 00403   896   NtFlushInstructionCache  (-1, 3280896, 160, ... ) == 0x0
 00404   896   NtProtectVirtualMemory  (-1, (0x321000), 160, 4, ... (0x321000), 4096, 16, ) == 0x0
 00405   896   NtProtectVirtualMemory  (-1, (0x321000), 4096, 16, ... (0x321000), 4096, 4, ) == 0x0
 00406   896   NtFlushInstructionCache  (-1, 3280896, 160, ... ) == 0x0
 00407   896   NtProtectVirtualMemory  (-1, (0x321000), 160, 4, ... (0x321000), 4096, 16, ) == 0x0
 00408   896   NtProtectVirtualMemory  (-1, (0x321000), 4096, 16, ... (0x321000), 4096, 4, ) == 0x0
 00409   896   NtFlushInstructionCache  (-1, 3280896, 160, ... ) == 0x0
 00410   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00411   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00412   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00413   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00414   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 00415   896   NtClose  (16, ... ) == 0x0
 00416   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00417   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00418   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00419   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00420   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00421   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00422   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00423   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00424   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00425   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00426   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00427   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00428   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00429   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00430   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00431   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00432   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00433   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00434   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00435   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00436   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00437   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00438   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00439   896   NtFlushInstructionCache  (-1, 4354048, 8192, ... ) == 0x0
 00440   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00441   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00442   896   NtFlushInstructionCache  (-1, 4354048, 8192, ... ) == 0x0
 00443   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00444   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00445   896   NtFlushInstructionCache  (-1, 4354048, 8192, ... ) == 0x0
 00446   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00447   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00448   896   NtFlushInstructionCache  (-1, 4354048, 8192, ... ) == 0x0
 00449   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00450   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00451   896   NtFlushInstructionCache  (-1, 4354048, 8192, ... ) == 0x0
 00452   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "crtdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00453   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00454   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\crtdll.dll"}, 1242572, ... ) }, 1242572, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00455   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00456   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\crtdll.dll"}, 1242572, ... ) }, 1242572, ... ) == 0x0
 00457   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\crtdll.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00458   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00459   896   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00460   896   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00461   896   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00462   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00463   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00464   896   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00465   896   NtClose  (36, ... ) == 0x0
 00466   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00467   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00468   896   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00469   896   NtClose  (36, ... ) == 0x0
 00470   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00471   896   NtClose  (32, ... ) == 0x0
 00472   896   NtClose  (16, ... ) == 0x0
 00473   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x73d90000), 0x0, 159744, ) == 0x0
 00474   896   NtClose  (28, ... ) == 0x0
 00475   896   NtProtectVirtualMemory  (-1, (0x73d9103c), 400, 4, ... (0x73d91000), 4096, 32, ) == 0x0
 00476   896   NtProtectVirtualMemory  (-1, (0x73d91000), 4096, 32, ... (0x73d91000), 4096, 4, ) == 0x0
 00477   896   NtFlushInstructionCache  (-1, 1943605248, 400, ... ) == 0x0
 00478   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00479   896   NtProtectVirtualMemory  (-1, (0x427000), 8192, 4, ... (0x427000), 8192, 4, ) == 0x0
 00480   896   NtFlushInstructionCache  (-1, 4354048, 8192, ... ) == 0x0
 00481   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00482   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00483   896   NtReadFile  (28, 0, 0, 0, 4, {224216, 0}, 0, ... {status=0x0, info=4},  (28, 0, 0, 0, 4, {224216, 0}, 0, ... {status=0x0, info=4}, ";\24_\0", ) , ) == 0x0
 00484   896   NtClose  (28, ... ) == 0x0
 00485   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00486   896   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00487   896   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00488   896   NtClose  (28, ... ) == 0x0
 00489   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00490   896   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00491   896   NtClose  (28, ... ) == 0x0
 00492   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00493   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00495   896   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00496   896   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00497   896   NtClose  (28, ... ) == 0x0
 00498   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00499   896   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00500   896   NtClose  (28, ... ) == 0x0
 00501   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00502   896   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00503   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00504   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00505   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00506   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242028}  (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242028} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242028} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00507   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00508   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00509   896   NtClose  (16, ... ) == 0x0
 00510   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00511   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0
 00512   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00513   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 16, ... 32, ) == 0x0
 00514   896   NtClose  (16, ... ) == 0x0
 00515   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00516   896   NtClose  (32, ... ) == 0x0
 00517   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00518   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0
 00519   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00520   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 32, ... 16, ) == 0x0
 00521   896   NtClose  (32, ... ) == 0x0
 00522   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00523   896   NtClose  (16, ... ) == 0x0
 00524   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00525   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0
 00526   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00527   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 32, ) == 0x0
 00528   896   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00529   896   NtClose  (16, ... ) == 0x0
 00530   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00531   896   NtClose  (32, ... ) == 0x0
 00532   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00533   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00534   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00535   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00536   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00537   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00538   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00539   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00540   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00541   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00542   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00543   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00544   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0
 00545   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00546   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00547   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00548   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00549   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00550   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oleaut32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00551   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00552   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00553   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00554   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininet.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00555   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crtdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00556   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0
 00557   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00558   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0
 00559   896   NtQueryValueKey  (32,  (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00560   896   NtClose  (32, ... ) == 0x0
 00561   896   NtMapViewOfSection  (-2147482756, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x430000), 0x0, 1060864, ) == 0x0
 00562   896   NtClose  (-2147482756, ... ) == 0x0
 00563   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00564   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00565   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482756, ) == 0x0
 00566   896   NtQueryInformationToken  (-2147482756, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00567   896   NtQueryInformationToken  (-2147482756, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00568   896   NtClose  (-2147482756, ... ) == 0x0
 00569   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5505024, 4096, ) == 0x0
 00570   896   NtFreeVirtualMemory  (-1, (0x540000), 4096, 32768, ... (0x540000), 4096, ) == 0x0
 00571   896   NtDuplicateObject  (-1, 16, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00572   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00573   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00574   896   NtClose  (-2147482756, ... ) == 0x0
 00575   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00576   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00577   896   NtClose  (-2147482756, ... ) == 0x0
 00578   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00579   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00580   896   NtUserCallNoParam  (24, ... ) == 0x0
 00581   896   NtGdiCreateCompatibleDC  (0, ...
 00582   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5505024, 4096, ) == 0x0
 00581   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00583   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00584   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00585   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00586   896   NtGdiCreateSolidBrush  (0, 0, ...
 00587   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8716288, 4096, ) == 0x0
 00586   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00588   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00589   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00590   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00591   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x24
 00592   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00593   896   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00594   896   NtClose  (44, ... ) == 0x0
 00595   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00596   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x8177c017
 00597   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00598   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x8177c01c
 00599   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00600   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x8177c01e
 00601   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00602   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x81778002
 00603   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10013
 00604   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x8177c018
 00605   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00606   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x8177c01a
 00607   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00608   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x8177c01d
 00609   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00610   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x8177c026
 00611   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00612   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x8177c019
 00613   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c020
 00614   896   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8177c022
 00615   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c023
 00616   896   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8177c024
 00617   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c025
 00618   896   NtCallbackReturn  (0, 0, 0, ...
 00619   896   NtGdiInit  (... ) == 0x1
 00620   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00621   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00622   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00623   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 8781824, 65536, ) == 0x0
 00624   896   NtAllocateVirtualMemory  (-1, 8781824, 0, 4096, 4096, 4, ... 8781824, 4096, ) == 0x0
 00625   896   NtAllocateVirtualMemory  (-1, 8785920, 0, 8192, 4096, 4, ... 8785920, 8192, ) == 0x0
 00626   896   NtAllocateVirtualMemory  (-1, 8794112, 0, 4096, 4096, 4, ... 8794112, 4096, ) == 0x0
 00627   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00628   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x870000), 0x0, 12288, ) == 0x0
 00629   896   NtClose  (44, ... ) == 0x0
 00630   896   NtAllocateVirtualMemory  (-1, 8798208, 0, 4096, 4096, 4, ... 8798208, 4096, ) == 0x0
 00631   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00632   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00633   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00634   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00635   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00636   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 44, {status=0x0, info=0}, ) }, 7, 16, ... 44, {status=0x0, info=0}, ) == 0x0
 00637   896   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "%\246{o\37\372y7\256\10o\1\242\372\322\323\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00638   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00639   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00640   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00641   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00642   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00643   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00644   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00645   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482756, 2, ) }, 0, 0x0, 0, ... -2147482756, 2, ) == 0x0
 00646   896   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "\256\316%\355k\236\225\212+ni\242\331\242\260\36N\321\363\3624j\2445\307\5\337\315\326\377\271\223\255E\305m\3474\212\3169\207\330\205Y2\317\212\334\351\315B\265\257H\325\220\205\\236\325\27\13=X}Q\262\215\315\376\303\211To\254\374\311.\354", 80, ... ) , 0, 3,  (-2147482756, "Seed", 0, 3, "\256\316%\355k\236\225\212+ni\242\331\242\260\36N\321\363\3624j\2445\307\5\337\315\326\377\271\223\255E\305m\3474\212\3169\207\330\205Y2\317\212\334\351\315B\265\257H\325\220\205\\236\325\27\13=X}Q\262\215\315\376\303\211To\254\374\311.\354", 80, ... ) , 80, ... ) == 0x0
 00647   896   NtClose  (-2147482756, ... ) == 0x0
 00637   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\321\355\xyf\351}\237\251\25,\352\0\254\206>\374,\375\354^6\210\320\3365\223\370vD\256\351]\15\367i\261\360$\327\376\267\324\J\377$x=\322X*c\237\366\310!\362\241NS\300\277\301\200\343R\14\2\212\327\263cgbO\215\264\274\325P\30\374\217 .\265RM\234c\373\265\221\332(\364\20d\357\3179\350\341m\263\327s\256\231\347G\1Fn&\277)\21\22\255#\201\277v#\305NTJ{\235\210\264\316\205\347\362S,\202\3677\265i\373\274$\22\331\263\304\337\11\317V\371\250\254P\225\303_Z\254\12\26\226:\267Y\253,\1\377\345\10\253\266!cD\320^\322\215\313\12Q\270\200\270\240(\362*\343\200\26\22\3\331Y\302>xT\343\252\177\217\224\323k\202\20\344\0US\361\371N$Y\23\305\315\272PN={n\204\235zR\230Q\237\323)\252\222\212)\347\2555\357c\370sI", ) , ) == 0x0
 00648   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00649   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00650   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 48, ) }, ... 48, ) == 0x0
 00651   896   NtQueryValueKey  (48,  (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00652   896   NtClose  (48, ... ) == 0x0
 00653   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 48, ) }, ... 48, ) == 0x0
 00654   896   NtQueryValueKey  (48,  (48, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00655   896   NtClose  (48, ... ) == 0x0
 00656   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00657   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00658   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00659   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00660   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 48, ) }, ... 48, ) == 0x0
 00661   896   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00662   896   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00663   896   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00664   896   NtClose  (48, ... ) == 0x0
 00665   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 48, ) }, ... 48, ) == 0x0
 00666   896   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00667   896   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00668   896   NtClose  (48, ... ) == 0x0
 00669   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 48, ) }, ... 48, ) == 0x0
 00670   896   NtOpenEvent  (0x1f0003, {24, 48, 0x0, 0, 0,  (0x1f0003, {24, 48, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00671   896   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 00672   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00673   896   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00674   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00675   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00676   896   NtCreateSemaphore  (0x1f0003, {24, 48, 0x80, 1333696, 0,  (0x1f0003, {24, 48, 0x80, 1333696, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 52, ) }, 0, 2147483647, ... 52, ) == STATUS_OBJECT_NAME_EXISTS
 00677   896   NtQueryPerformanceCounter  (... {-1450616159, 16}, {3579545, 0}, ) == 0x0
 00678   896   NtQueryPerformanceCounter  (... {-1450615413, 16}, {3579545, 0}, ) == 0x0
 00679   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 8192, 4096, 4, ... 1335296, 8192, ) == 0x0
 00680   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00681   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 8912896, 1048576, ) == 0x0
 00682   896   NtAllocateVirtualMemory  (-1, 8912896, 0, 4096, 4096, 4, ... 8912896, 4096, ) == 0x0
 00683   896   NtAllocateVirtualMemory  (-1, 8916992, 0, 8192, 4096, 4, ... 8916992, 8192, ) == 0x0
 00684   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00685   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242800,  (0xc0100080, {24, 0, 0x40, 0, 1242800, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 60, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 60, {status=0x0, info=0}, ) == 0x0
 00686   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 64, ) == 0x0
 00687   896   NtDeviceIoControlFile  (60, 64, 0x0, 0x12f710, 0x22414c,  (60, 64, 0x0, 0x12f710, 0x22414c, "X\367\22\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00688   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00689   896   NtQueryValueKey  (-2147482756,  (-2147482756, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00690   896   NtQueryValueKey  (-2147482756,  (-2147482756, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00691   896   NtClose  (-2147482756, ... ) == 0x0
 00692   896   NtClose  (892, ... ) == 0x0
 00687   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " \3106\342\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#Seed\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00693   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243016,  (0xc0100080, {24, 0, 0x40, 0, 1243016, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 72, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 72, {status=0x0, info=0}, ) == 0x0
 00694   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00695   896   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 80, ) == 0x0
 00696   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 84, ) == 0x0
 00697   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 88, ) == 0x0
 00698   896   NtAllocateVirtualMemory  (-1, 8925184, 0, 8192, 4096, 4, ... 8925184, 8192, ) == 0x0
 00699   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9961472, 1048576, ) == 0x0
 00700   896   NtAllocateVirtualMemory  (-1, 11001856, 0, 8192, 4096, 4, ... 11001856, 8192, ) == 0x0
 00701   896   NtProtectVirtualMemory  (-1, (0xa7e000), 4096, 260, ... (0xa7e000), 4096, 4, ) == 0x0
 00702   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1242100, 1242044, 1, ... 92, {1252, 2016}, ) == 0x0
 00703   896   NtQueryInformationThread  (92, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 00704   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 8913272}  (24, {28, 56, new_msg, 0, 0, 0, 0, 8913272} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0\\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81835, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0\\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81835, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 8913272} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0\\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81835, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0\\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 00705   896   NtResumeThread  (92, ... 1, ) == 0x0
 00706   896   NtClose  (92, ... ) == 0x0
 00707   896   NtSetEvent  (76, ...
 00708  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 92, ) == 0x0
 00709  2016   NtWaitForSingleObject  (92, 0, 0x0, ...
 00707   896   NtSetEvent  ... 0x0, ) == 0x0
 00710   896   NtSetEvent  (56, ... 0x0, ) == 0x0
 00711   896   NtClose  (56, ... ) == 0x0
 00712   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00713   896   NtAllocateVirtualMemory  (-1, 8933376, 0, 4096, 4096, 4, ... 8933376, 4096, ) == 0x0
 00714   896   NtDeviceIoControlFile  (60, 64, 0x0, 0x12f710, 0x22414c,  (60, 64, 0x0, 0x12f710, 0x22414c, "X\367\22\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00715   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00716   896   NtQueryValueKey  (-2147482756,  (-2147482756, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00717   896   NtQueryValueKey  (-2147482756,  (-2147482756, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00718   896   NtClose  (-2147482756, ... ) == 0x0
 00719   896   NtClose  (892, ... ) == 0x0
 00714   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " \30P\342\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344LinksG\16\0\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00720   896   NtSetEvent  (76, ... 0x0, ) == 0x0
 00721   896   NtSetEvent  (56, ... 0x0, ) == 0x0
 00722   896   NtClose  (56, ... ) == 0x0
 00723   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 00724   896   NtOpenProcessToken  (-1, 0xa, ... 56, ) == 0x0
 00725   896   NtDuplicateToken  (56, 0xc, {24, 0, 0x0, 0, 1243284, 0x0}, 0, 2, ... 100, ) == 0x0
 00726   896   NtClose  (56, ... ) == 0x0
 00727   896   NtAccessCheck  (1332816, 100, 0x1, 1243360, 1243412, 56, 1243392, ... (0x1), ) == 0x0
 00728   896   NtClose  (100, ... ) == 0x0
 00729   896   NtQueryDefaultUILanguage  (1242164, ...
 00730   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00731   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 00732   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00733   896   NtClose  (-2147482756, ... ) == 0x0
 00734   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00735   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00736   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00737   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00738   896   NtClose  (-2147481452, ... ) == 0x0
 00739   896   NtClose  (-2147482756, ... ) == 0x0
 00729   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00740   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00741   896   NtQueryDefaultUILanguage  (2090319928, ...
 00742   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00743   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 00744   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00745   896   NtClose  (-2147482756, ... ) == 0x0
 00746   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00747   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00748   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00749   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00750   896   NtClose  (-2147481452, ... ) == 0x0
 00751   896   NtClose  (-2147482756, ... ) == 0x0
 00741   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00752   896   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00753   896   NtQueryDefaultLocale  (1, 1240260, ... ) == 0x0
 00754   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00755   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020}  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81836, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81836, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81836, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" )  ) == 0x0
 00756   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00757   896   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00758   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00759   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00760   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1239488, ... ) }, 1239488, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00761   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00762   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00763   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00764   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1239552, ... ) }, 1239552, ... ) == 0x0
 00765   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 100, {status=0x0, info=1}, ) }, 3, 33, ... 100, {status=0x0, info=1}, ) == 0x0
 00766   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00767   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00768   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 56, ... 104, ) == 0x0
 00769   896   NtClose  (56, ... ) == 0x0
 00770   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa90000), 0x0, 1056768, ) == 0x0
 00771   896   NtClose  (104, ... ) == 0x0
 00772   896   NtUnmapViewOfSection  (-1, 0xa90000, ... ) == 0x0
 00773   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00774   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 104, ... 56, ) == 0x0
 00775   896   NtQuerySection  (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00776   896   NtClose  (104, ... ) == 0x0
 00777   896   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 00778   896   NtClose  (56, ... ) == 0x0
 00779   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00780   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00781   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00782   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00783   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00784   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00785   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00786   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00787   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00788   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00789   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00790   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00791   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00792   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00793   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00794   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00795   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00796   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00797   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00798   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00799   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00800   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00801   896   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1241032, ... ) , 42, 1241032, ... ) == 0x0
 00802   896   NtQueryDefaultUILanguage  (1239716, ...
 00803   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00804   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 00805   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00806   896   NtClose  (-2147482756, ... ) == 0x0
 00807   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00808   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00809   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00810   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00811   896   NtClose  (-2147481452, ... ) == 0x0
 00812   896   NtClose  (-2147482756, ... ) == 0x0
 00802   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00813   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238556, ... ) }, 1238556, ... ) == 0x0
 00814   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00815   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 56, ... 104, ) == 0x0
 00816   896   NtClose  (56, ... ) == 0x0
 00817   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa90000), 0x0, 4096, ) == 0x0
 00818   896   NtClose  (104, ... ) == 0x0
 00819   896   NtUnmapViewOfSection  (-1, 0xa90000, ... ) == 0x0
 00820   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238152, ... ) }, 1238152, ... ) == 0x0
 00821   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238896,  (0x80100080, {24, 0, 0x40, 0, 1238896, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 104, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 104, {status=0x0, info=1}, ) == 0x0
 00822   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 104, ... 56, ) == 0x0
 00823   896   NtClose  (104, ... ) == 0x0
 00824   896   NtMapViewOfSection  (56, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa90000), {0, 0}, 4096, ) == 0x0
 00825   896   NtClose  (56, ... ) == 0x0
 00826   896   NtUnmapViewOfSection  (-1, 0xa90000, ... ) == 0x0
 00827   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 56, {status=0x0, info=1}, ) }, 1, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00828   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 56, ... 104, ) == 0x0
 00829   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa90000), 0x0, 4096, ) == 0x0
 00830   896   NtQueryInformationFile  (56, 1238548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00831   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00832   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572}  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\18\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81839, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\18\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81839, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\18\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81839, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\18\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" )  ) == 0x0
 00833   896   NtClose  (56, ... ) == 0x0
 00834   896   NtClose  (104, ... ) == 0x0
 00835   896   NtUnmapViewOfSection  (-1, 0xa90000, ... ) == 0x0
 00836   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00837   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00838   896   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 00839   896   NtUserGetDC  (0, ... ) == 0x1010052
 00840   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00841   896   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 00842   896   NtUserSystemParametersInfo  (66, 12, 1240548, 0, ... ) == 0x1
 00843   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00844   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 104, ) == 0x0
 00845   896   NtQueryInformationToken  (104, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00846   896   NtClose  (104, ... ) == 0x0
 00847   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 104, ) }, ... 104, ) == 0x0
 00848   896   NtOpenProcessToken  (-1, 0x8, ... 56, ) == 0x0
 00849   896   NtAccessCheck  (1332816, 56, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00850   896   NtClose  (56, ... ) == 0x0
 00851   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "Control Panel\Desktop"}, ... 56, ) }, ... 56, ) == 0x0
 00852   896   NtQueryValueKey  (56,  (56, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00853   896   NtClose  (56, ... ) == 0x0
 00854   896   NtUserSystemParametersInfo  (41, 500, 1240576, 0, ... ) == 0x1
 00855   896   NtOpenProcessToken  (-1, 0x8, ... 56, ) == 0x0
 00856   896   NtAccessCheck  (1332816, 56, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00857   896   NtClose  (56, ... ) == 0x0
 00858   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 56, ) }, ... 56, ) == 0x0
 00859   896   NtQueryValueKey  (56,  (56, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00860   896   NtClose  (56, ... ) == 0x0
 00861   896   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 00862   896   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 00863   896   NtClose  (104, ... ) == 0x0
 00864   896   NtUserSystemParametersInfo  (4130, 0, 1241080, 0, ... ) == 0x1
 00865   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 104, ) }, ... 104, ) == 0x0
 00866   896   NtEnumerateValueKey  (104, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00867   896   NtClose  (104, ... ) == 0x0
 00868   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00869   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03b
 00870   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03d
 00871   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00872   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c03f
 00873   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00874   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c041
 00875   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00876   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c043
 00877   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c045
 00878   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00879   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c047
 00880   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00881   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c049
 00882   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00883   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04b
 00884   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00885   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04d
 00886   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00887   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c04f
 00888   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c051
 00889   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00890   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c053
 00891   896   NtUserFindExistingCursorIcon  (1240324, 1240340, 1240388, ... ) == 0x10011
 00892   896   NtUserRegisterClassExWOW  (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8177c055
 00893   896   NtUserFindExistingCursorIcon  (1240324, 1240340, 1240388, ... ) == 0x10011
 00894   896   NtUserRegisterClassExWOW  (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8177c057
 00895   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00896   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c059
 00897   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10013
 00898   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05b
 00899   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00900   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05d
 00901   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00902   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c05f
 00903   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00904   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c017
 00905   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00906   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c019
 00907   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10013
 00908   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c018
 00909   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00910   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01a
 00911   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00912   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01c
 00913   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00914   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c01e
 00915   896   NtUserFindExistingCursorIcon  (1240320, 1240336, 1240384, ... ) == 0x10011
 00916   896   NtUserRegisterClassExWOW  (1240320, 1240388, 1240404, 1240420, 0, 384, 0, ... ) == 0x8177c01b
 00917   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00918   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c068
 00919   896   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00920   896   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8177c06a
 00921   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00922   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 104, ) == 0x0
 00923   896   NtQueryInformationToken  (104, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00924   896   NtClose  (104, ... ) == 0x0
 00925   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 104, ) }, ... 104, ) == 0x0
 00926   896   NtSetInformationObject  (104, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00927   896   NtCreateKey  (0x2001f, {24, 104, 0x40, 0, 0,  (0x2001f, {24, 104, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 56, 2, ) }, 0, 0x0, 0, ... 56, 2, ) == 0x0
 00928   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\crtdll.dll"}, 1240964, ... ) }, 1240964, ... ) == 0x0
 00929   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 8192, 4096, 4, ... 1343488, 8192, ) == 0x0
 00930   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 00931   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00932   896   NtRequestWaitReplyPort  (24, {40, 68, new_msg, 0, 6553714, 5505056, 7143529, 101}  (24, {40, 68, new_msg, 0, 6553714, 5505056, 7143529, 101} "\0\0\0\0\0\2\2\0l\20\201|\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\300\0\0\0\0\3\0\0\0\0\0\0\0" ... {40, 68, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\0\2\2\0\10\0\0\300\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\300\0\0\0\0\3\0\0\0\0\0\0\0" )  ... {40, 68, reply, 0, 1252, 896, 81840, 0}  (24, {40, 68, new_msg, 0, 6553714, 5505056, 7143529, 101} "\0\0\0\0\0\2\2\0l\20\201|\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\300\0\0\0\0\3\0\0\0\0\0\0\0" ... {40, 68, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\0\2\2\0\10\0\0\300\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\300\0\0\0\0\3\0\0\0\0\0\0\0" )  ) == 0x0
 00933   896   NtRequestWaitReplyPort  (24, {40, 68, new_msg, 0, 1252, 896, 81840, 0}  (24, {40, 68, new_msg, 0, 1252, 896, 81840, 0} "\0\0\0\0\0\2\2\0\\20\201|\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0@\0\0\0\0\3\0\0\0\0\0\0\0" ... {40, 68, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\0\2\2\0\10\0\0\300\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0@\0\0\0\0\3\0\0\0\0\0\0\0" )  ... {40, 68, reply, 0, 1252, 896, 81841, 0}  (24, {40, 68, new_msg, 0, 1252, 896, 81840, 0} "\0\0\0\0\0\2\2\0\\20\201|\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0@\0\0\0\0\3\0\0\0\0\0\0\0" ... {40, 68, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\0\2\2\0\10\0\0\300\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0@\0\0\0\0\3\0\0\0\0\0\0\0" )  ) == 0x0
 00934   896   NtSetEventBoostPriority  (92, ...
 00709  2016   NtWaitForSingleObject  ... ) == 0x0
 00935  2016   NtTestAlert  (... ) == 0x0
 00936  2016   NtContinue  (11009328, 1, ...
 00937  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00938  2016   NtDeviceIoControlFile  (72, 84, 0x0, 0x77e466a0, 0x228144,  (72, 84, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0P\0\0\0\0\0\0\0`\0\0\0\0\0\0\0D\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00934   896   NtSetEventBoostPriority  ... ) == 0x0
 00939  2016   NtWaitForMultipleObjects  (2, (76, 84, ), 1, 1, {1294967296, -1}, ... ) == 0x0
 00940  2016   NtDeviceIoControlFile  (72, 88, 0x0, 0x77e46680, 0x228144,  (72, 88, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0P\0\0\0\0\0\0\0`\0\0\0\0\0\0\0D\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00941  2016   NtWaitForMultipleObjects  (2, (76, 88, ), 1, 1, {1294967296, -1}, ...
 00942   896   NtTestAlert  (... ) == 0x0
 00943   896   NtContinue  (1244464, 1, ...
 00944   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x42a000,}, 4, ... ) == 0x0
 00945   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 108, ) }, ... 108, ) == 0x0
 00946   896   NtQueryValueKey  (108,  (108, "PINF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00947   896   NtClose  (108, ... ) == 0x0
 00948   896   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00949   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1234112,  (0x80100080, {24, 0, 0x40, 0, 1234112, "\??\u:\work\packed.exe"}, 0x0, 1, 1, 1, 96, 0, 0, ... 108, {status=0x0, info=1}, ) }, 0x0, 1, 1, 1, 96, 0, 0, ... 108, {status=0x0, info=1}, ) == 0x0
 00950   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp"}, 1233816, ... ) }, 1233816, ... ) == 0x0
 00951   896   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\00\247\24\0\302\207\0\0\2\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\302\207\0\0\3\0\0\0" )  ... {20, 48, reply, 0, 1252, 896, 81842, 0}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\00\247\24\0\302\207\0\0\2\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\302\207\0\0\3\0\0\0" )  ) == 0x0
 00952   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233824,  (0x80100080, {24, 0, 0x40, 0, 1233824, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.tmp"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 00953   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00954   896   NtClose  (-2147482756, ... ) == 0x0
 00955   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00956   896   NtClose  (-2147482756, ... ) == 0x0
 00957   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00958   896   NtClose  (-2147482756, ... ) == 0x0
 00952   896   NtCreateFile  ... 112, {status=0x0, info=2}, ) == 0x0
 00959   896   NtClose  (112, ... ) == 0x0
 00960   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234112,  (0xc0100080, {24, 0, 0x40, 0, 1234112, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.tmp"}, 0x0, 128, 1, 5, 96, 0, 0, ... }, 0x0, 128, 1, 5, 96, 0, 0, ...
 00961   896   NtClose  (-2147482756, ... ) == 0x0
 00962   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00963   896   NtClose  (-2147482756, ... ) == 0x0
 00964   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00965   896   NtClose  (-2147482756, ... ) == 0x0
 00966   896   NtQueryDirectoryFile  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1,  (-2147482756, 0, 0, 0, -518787072, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00967   896   NtClose  (-2147482756, ... ) == 0x0
 00960   896   NtCreateFile  ... 112, {status=0x0, info=3}, ) == 0x0
 00968   896   NtSetInformationFile  (108, 1234204, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00969   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "vN\17\09\24_\0?\24P\0\304\353_\0\203\24_\0;\24_\0{\24E\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\26_\0\201\4_\16$\240V\315\32\254^L\3665\317\220o|6s\33d-o\f>m\33y*sO4=e\33f*n\33a1d^f\177WRzl26\36{7;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0;\24_\0", ) , ) == 0x0
 00970   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "MZP\0\2\0\0\0\4\0\17\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\32\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 10240, 0x0, 0, ... , 10240, 0x0, 0, ...
 00971   896   NtContinue  (-135750188, 0, ...
 00970   896   NtWriteFile  ... {status=0x0, info=10240}, ) == 0x0
 00972   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "n\34i\34T(\22ETf&,\233y>\10\13\27\336\7\363\3349\331Y\324\36\304\363W\227<9X-\334\323\3455DQt\16\271?\17#\377\35\326\7}\276\273QD`\274\227\270\263E \300]\237\17\1k\2024gZ\26\37\315G+^\2\205Pr\32\270\326ZR\316!\16\21\261\315le\33\244\365KE|\34,\323\266\215\3058-\267\353eC\203\200<\223\337\302\354\37(C\27\5}\301*\24U^fhQ8v\205\2061f\17I\31\253\204\207\225\200\246\17\12\227\3\324Qt\34;\203\253\20W#\367\306s\210\13\322$\22z\32\276\311\303RwI\337"D\37?\333\257f\353\350\3533=\327\276\15\12\226\2474\345x\35\266kp\257X\5"\215 \377&\30W\363\220\227\257w:.P\322P_(:\310\337\24\270.u\12K\21Z\34P\277\211\12\323D\215<\35d\361\10m`*\310~\222J\212\346\331\263\10\375\248)\270-\247\251\3000\225\232yWfR!T\10\344\253"n\15\260Uk\324\222\275\222\r\1Z-\3670\307\365{\31\15\314k\207\337\221\226\206\261\334\242\305{\370\236i\12u\373\237\2\304\360M\311\357\267\327\367\306\227\244\353Fk\32\276\224\3\334\14\1\245\274h\225\35\300w\217\210\247\232\223\315.x\250\232\24\341mT,\334xcyo\213\217\237\25X\260X\220D\334\177^"\367t\227/\353\240\12\27lc\231\32\14;\360\357\205']\6:\374\261\357q\270\354:\317Sp1\312\254P\w\227\266%V|\350B\374T5R\242\273&\337LP\11\346\311o\29t\37\3\251\\367\211yLd2\37O\270\324\357G\374\17\277\5\355\1\327\13\356\22_\\227\324<\320\5\274^\275\270$0\37Da\275\330\331[\227\344\202\17", ) D\37?\333\257f\353\350\3533=\327\276\15\12\226\2474\345x\35\266kp\257X\5 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "n\34i\34T(\22ETf&,\233y>\10\13\27\336\7\363\3349\331Y\324\36\304\363W\227<9X-\334\323\3455DQt\16\271?\17#\377\35\326\7}\276\273QD`\274\227\270\263E \300]\237\17\1k\2024gZ\26\37\315G+^\2\205Pr\32\270\326ZR\316!\16\21\261\315le\33\244\365KE|\34,\323\266\215\3058-\267\353eC\203\200<\223\337\302\354\37(C\27\5}\301*\24U^fhQ8v\205\2061f\17I\31\253\204\207\225\200\246\17\12\227\3\324Qt\34;\203\253\20W#\367\306s\210\13\322$\22z\32\276\311\303RwI\337"D\37?\333\257f\353\350\3533=\327\276\15\12\226\2474\345x\35\266kp\257X\5"\215 \377&\30W\363\220\227\257w:.P\322P_(:\310\337\24\270.u\12K\21Z\34P\277\211\12\323D\215<\35d\361\10m`*\310~\222J\212\346\331\263\10\375\248)\270-\247\251\3000\225\232yWfR!T\10\344\253"n\15\260Uk\324\222\275\222\r\1Z-\3670\307\365{\31\15\314k\207\337\221\226\206\261\334\242\305{\370\236i\12u\373\237\2\304\360M\311\357\267\327\367\306\227\244\353Fk\32\276\224\3\334\14\1\245\274h\225\35\300w\217\210\247\232\223\315.x\250\232\24\341mT,\334xcyo\213\217\237\25X\260X\220D\334\177^"\367t\227/\353\240\12\27lc\231\32\14;\360\357\205']\6:\374\261\357q\270\354:\317Sp1\312\254P\w\227\266%V|\350B\374T5R\242\273&\337LP\11\346\311o\29t\37\3\251\\367\211yLd2\37O\270\324\357G\374\17\277\5\355\1\327\13\356\22_\\227\324<\320\5\274^\275\270$0\37Da\275\330\331[\227\344\202\17", ) n\15\260Uk\324\222\275\222\r\1Z-\3670\307\365{\31\15\314k\207\337\221\226\206\261\334\242\305{\370\236i\12u\373\237\2\304\360M\311\357\267\327\367\306\227\244\353Fk\32\276\224\3\334\14\1\245\274h\225\35\300w\217\210\247\232\223\315.x\250\232\24\341mT,\334xcyo\213\217\237\25X\260X\220D\334\177^ (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "n\34i\34T(\22ETf&,\233y>\10\13\27\336\7\363\3349\331Y\324\36\304\363W\227<9X-\334\323\3455DQt\16\271?\17#\377\35\326\7}\276\273QD`\274\227\270\263E \300]\237\17\1k\2024gZ\26\37\315G+^\2\205Pr\32\270\326ZR\316!\16\21\261\315le\33\244\365KE|\34,\323\266\215\3058-\267\353eC\203\200<\223\337\302\354\37(C\27\5}\301*\24U^fhQ8v\205\2061f\17I\31\253\204\207\225\200\246\17\12\227\3\324Qt\34;\203\253\20W#\367\306s\210\13\322$\22z\32\276\311\303RwI\337"D\37?\333\257f\353\350\3533=\327\276\15\12\226\2474\345x\35\266kp\257X\5"\215 \377&\30W\363\220\227\257w:.P\322P_(:\310\337\24\270.u\12K\21Z\34P\277\211\12\323D\215<\35d\361\10m`*\310~\222J\212\346\331\263\10\375\248)\270-\247\251\3000\225\232yWfR!T\10\344\253"n\15\260Uk\324\222\275\222\r\1Z-\3670\307\365{\31\15\314k\207\337\221\226\206\261\334\242\305{\370\236i\12u\373\237\2\304\360M\311\357\267\327\367\306\227\244\353Fk\32\276\224\3\334\14\1\245\274h\225\35\300w\217\210\247\232\223\315.x\250\232\24\341mT,\334xcyo\213\217\237\25X\260X\220D\334\177^"\367t\227/\353\240\12\27lc\231\32\14;\360\357\205']\6:\374\261\357q\270\354:\317Sp1\312\254P\w\227\266%V|\350B\374T5R\242\273&\337LP\11\346\311o\29t\37\3\251\\367\211yLd2\37O\270\324\357G\374\17\277\5\355\1\327\13\356\22_\\227\324<\320\5\274^\275\270$0\37Da\275\330\331[\227\344\202\17", ) , ) == 0x0
 00973   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "U\106\34o\301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00974   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\354\326TX\203\6Jw\12\36SH\350Y\234\30q\202\23\340n\261\355H;\277\315\345\213\221\350}#P\37\221\336\204:Z_H\7Y5O\305\0i_?\203\25V\13b\375\310\321\222b\366>\37\337K{L\234\13\251\223\12?0d\234k\2249\264\221\207\360\227\257\17\334^\367::\247\27\337R>lH\2231\31\337\227\14TIa:\1\25\27\327\4T\341n\322\261DID+\26h\304\276j\324w\0%\226\212sW\33\10\307\353\35\267d\24W\215N\33\324|3\23n\300\261\32dJ\307a\350~\232O\321\1\346C\16\315\327\200\237ra\275o`\277\256\371,T{\16:-\247~\346\2618\5\26\320d\200\33PM?O\244\302I\360\332\257T\243\340\202O\273\326\3212uT\212|\236u\201\313F\261\356\332\353\200\177\340\236\7c\257\236\1\12\276O\14oWhA\13-\14\320\366-\253\3556\352\7\32\273\363\2009\360\350\350\0t\5G\33N\370\262\355\15\26\356 \254\377\227?\273\361\200:\215\324\262\355!\377\275\35\261xE\221W\14\35\305\251\353\235\11\303\363\24u\313\233\374:\260+\354\4\273+Z\266f\267X\203\352[^\2674\346\240\255\221\243\25\20A\23\241\261I\37(\154\253\226\3q\310\365\5\7\323\240\321\265\316\240B\336\232f\1", ) , ) == 0x0
 00975   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\327\302\13X\270\22\25w1\12\14H\323M\303\30J\226L\340U\245\262H\0\253\222\345\260\205\267}\30D@\221\345\220eZd\XY\16[\232\0RKcTPd9d\33b\246d`\221\345\220ej!lhQ\226C\226r\14tp,\35\311`\313z|5x@*\201\230C\20|\32\301\177\205\224\235\233`g\20\256p\273\3639\253V%\22\210\149+\204\20\274\7\213\2069\232A\214\14\210o@\323\377\367*\276(\212G\10:\320t9\366F\2733\252I\325\256\230\334W\4\371lE]\267\4F4\363F\37\306\266B\24\270\256\354\24\5\14N\5>\4\227JV0v\242\310\352\206=\366\5\13\200K@X\303\13\222\207U?\13p\303k\257-\353\221\274\344\310\2574\310\1\367\1.\370\27\344Fals\207n\31\344\203STrue\1.\3\210\4o\3651\322\212P\26D\20\27\304\205~\213w;1\311\212HCD\10\374\377B\267_\0\10\215u\17\213|\10\71\300\212\16;J\374u\267~\241[\216\\12\362\34\16\366\303\337\237Iu\342o[\253\361\371\27@$\16\19\370~\335\245g\5-\304;\2008'\17M\4[\373\302r\344\205\257o\267\277\202t\257\211\321\11a\13\212G\212*\201\360R\356\356\341\377\337\177\333\212Xc\224\212^\12\205[Sol|\36\13\26\30\217\36\159\364\355\15\376X\32\200\347\3379\313\374\267\0O\21\30\33u\354\355\3556\2\261 \227\353\310?\200\345\337:\266\300\355\355\32\353\342\35\212l\32\221l\30B\305\222\377\302\11\370\347Ku\360\217\243:\213?\263\4\200?\5\266]\243\7\203\321O\1\267\17\362\377\255\252\267J\20z\7\376\261r\13w\15\17\277\311\3J\334\252\5<\307\377\321\216\332\377B\345\2169\1", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00976   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\255\377\242\265\273\303\363fh\235\332\6-\224\325\265L\322\332\227D\32(\21]\253\353\22n\30:\2112\264\6\6\210\323>\35\13\250C\210\217o\300\240\261\231\312>1\24\353\274\:\30\263J>\2370"M\3044:\323]\316\277\266\0\271\262\203kt3N[\310\246\220\311\244\20\312\256tXO\14\364nF{\361n\34\15"|\224\2315\263\230\32\13s\226\364\200\225\236S&\22\224n\254\6\360\264\12&\37(\266\315\222\242\13t\236\12\373,E\32v\16r\236i\13\225\2731\374H)\214\36ls\21T\335\32\277\37\247B\234\2\337{\16\242O\31\365\212/\353<0\213\350\10\224\311t\270Vx!SM\37{\250\26\322\5/\362\234\377\269\263N]\265\310\360]\263\177\364.\222\377\266\357\36\253\364\353\336O\240\31D\357\326\26\315XC\307Y0\0\0Dc/\275|\207+cc8 f\227\310\7,c8\225y\205\234\363\20\210<\317dw`\32\313\341:\30\377\346\372\211_\2333nY\243 \26q,\376\323\11\272\221%Iz\315\326O\360j\231\315`\270\2K\310\337H\315\246\233\247\20X\313\377C\30g\264\364a\363\247O\35\10\335\13\17\254\236D\0\274\370G\1\371d\206\22\231\32\234^\4\25\255\204`\223t\271n\352\253\15\216\342[\322F\342\32\376LB\207\353\21\5s\3329R\243\26\345il:\7iT`\257\15\25\335\2167O\252P\2\2530}\16:\10\36\340[\203=\364x\236M\20\317N\371\266=\350\21\303\344\363\0#\364[U\25\35v*2\20\370\263D3\253\207\340L\4\360\234x\247y\22uH\323\214\2549\342Z\352j\316\22\257\354\325\177\15\321\350T\247\234\371\26k\0hc!\350Dd4\330\227\4@\322\303A\28", ) M\3044:\323]\316\277\266\0\271\262\203kt3N[\310\246\220\311\244\20\312\256tXO\14\364nF{\361n\34\15 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\255\377\242\265\273\303\363fh\235\332\6-\224\325\265L\322\332\227D\32(\21]\253\353\22n\30:\2112\264\6\6\210\323>\35\13\250C\210\217o\300\240\261\231\312>1\24\353\274\:\30\263J>\2370"M\3044:\323]\316\277\266\0\271\262\203kt3N[\310\246\220\311\244\20\312\256tXO\14\364nF{\361n\34\15"|\224\2315\263\230\32\13s\226\364\200\225\236S&\22\224n\254\6\360\264\12&\37(\266\315\222\242\13t\236\12\373,E\32v\16r\236i\13\225\2731\374H)\214\36ls\21T\335\32\277\37\247B\234\2\337{\16\242O\31\365\212/\353<0\213\350\10\224\311t\270Vx!SM\37{\250\26\322\5/\362\234\377\269\263N]\265\310\360]\263\177\364.\222\377\266\357\36\253\364\353\336O\240\31D\357\326\26\315XC\307Y0\0\0Dc/\275|\207+cc8 f\227\310\7,c8\225y\205\234\363\20\210<\317dw`\32\313\341:\30\377\346\372\211_\2333nY\243 \26q,\376\323\11\272\221%Iz\315\326O\360j\231\315`\270\2K\310\337H\315\246\233\247\20X\313\377C\30g\264\364a\363\247O\35\10\335\13\17\254\236D\0\274\370G\1\371d\206\22\231\32\234^\4\25\255\204`\223t\271n\352\253\15\216\342[\322F\342\32\376LB\207\353\21\5s\3329R\243\26\345il:\7iT`\257\15\25\335\2167O\252P\2\2530}\16:\10\36\340[\203=\364x\236M\20\317N\371\266=\350\21\303\344\363\0#\364[U\25\35v*2\20\370\263D3\253\207\340L\4\360\234x\247y\22uH\323\214\2549\342Z\352j\316\22\257\354\325\177\15\321\350T\247\234\371\26k\0hc!\350Dd4\330\227\4@\322\303A\28", ) , ) == 0x0
 00977   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240 (112, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00978   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "${\235#\32\4\237\11\2038\215\345_\33\366y]\326\336\307{vD\341%6\335|:\34\335.c\2J&\30\277\267{z\246\234\2705\30\347%z\250\216\273\262Lyw\355\231/\30,\254\356\263\374\36\326\34\362\6"\314}\256T 3B\304\301\255\274\205\233V\31\271{\267\24\261Y\341~C\334\347"\335\26qlGd\370\210KK\237N]\373;~\224*>_y\207CobkJo\327\327=;\36\265\4\213.\177m\1}\344\303]\3357*\15\15\212\241\313\233w\30\16\244\364\366\11\314;$\245}RX\14\326xh\267'\204\265 \224\2630\14\335\253\246"\37\3275\221\263i\31\15:.\2653\2O\214\321\3\326\342\27\331\202qS\274\357$\177\241\26\4;\1\327\3671J\17\345\3\2173\362)d\32\344k\254FF\241\230T\254\276t\326\24\355\224\333\35QPk==t|F\340\231\371H\225\253\323\2}\252\264 Sv\310\213\267\25^X\203\226\372I7M\270\362)\364<\2\351\204\273i7z\277\14\311\21Z\333:\16\277\2624\223\302\3301\234dt\11\352\341j1\215\277\340i\270d\205\206c\371\21\2075\357\177\213\335\311\307\202\14|m\266\36\357\273\245\27i(\16H\217l\306\4\370R)I\311\11\314\315\215-\330v\3430^\27\7", ) \314}\256T 3B\304\301\255\274\205\233V\31\271{\267\24\261Y\341~C\334\347301\362\2109\20\230];\252~\264\335\374Nx\1r@a\213\334?\315\317\11\243\252n\206u\262\221\24\12\315E\203g\322\16bz_O\13\10\3075\37]C\36<\3058\320\25\260\305\23171\5\213\335)Y\327yRP\25I\263\271LX'\353\6\245\345\370+`VF\347\141\3033\262x\25\347\12WDD\214\262\242X4\352\347\373T\346\14\10U\212\222G\25\341v\2635\3300\217\332/\302 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "${\235#\32\4\237\11\2038\215\345_\33\366y]\326\336\307{vD\341%6\335|:\34\335.c\2J&\30\277\267{z\246\234\2705\30\347%z\250\216\273\262Lyw\355\231/\30,\254\356\263\374\36\326\34\362\6"\314}\256T 3B\304\301\255\274\205\233V\31\271{\267\24\261Y\341~C\334\347"\335\26qlGd\370\210KK\237N]\373;~\224*>_y\207CobkJo\327\327=;\36\265\4\213.\177m\1}\344\303]\3357*\15\15\212\241\313\233w\30\16\244\364\366\11\314;$\245}RX\14\326xh\267'\204\265 \224\2630\14\335\253\246"\37\3275\221\263i\31\15:.\2653\2O\214\321\3\326\342\27\331\202qS\274\357$\177\241\26\4;\1\327\3671J\17\345\3\2173\362)d\32\344k\254FF\241\230T\254\276t\326\24\355\224\333\35QPk==t|F\340\231\371H\225\253\323\2}\252\264 Sv\310\213\267\25^X\203\226\372I7M\270\362)\364<\2\351\204\273i7z\277\14\311\21Z\333:\16\277\2624\223\302\3301\234dt\11\352\341j1\215\277\340i\270d\205\206c\371\21\2075\357\177\213\335\311\307\202\14|m\266\36\357\273\245\27i(\16H\217l\306\4\370R)I\311\11\314\315\215-\330v\3430^\27\7", ) \37\3275\221\263i\31\15:.\2653\2O\214\321\3\326\342\27\331\202qS\274\357$\177\241\26\4;\1\327\3671J\17\345\3\2173\362)d\32\344k\254FF\241\230T\254\276t\326\24\355\224\333\35QPk==t|F\340\231\371H\225\253\323\2}\252\264 Sv\310\213\267\25^X\203\226\372I7M\270\362)\364<\2\351\204\273i7z\277\14\311\21Z\333:\16\277\2624\223\302\3301\234dt\11\352\341j1\215\277\340i\270d\205\206c\371\21\2075\357\177\213\335\311\307\202\14|m\266\36\357\273\245\27i(\16H\217l\306\4\370R)I\311\11\314\315\215-\330v\3430^\27\7", ) == 0x0
 00979   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\37o\302#!\20\300\11\270,\322\345d\17\251yf\302\201\307@b\33\341\36"\202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00980   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\11\212\17\20\3744\37\12\211\c\350\345\37\11\3439z\14\17\306^\324\3603\253\377\273I\346A\31\232\304\275\344\T\250\3442\255+\374J\15 '\337\241\342y\241\217R\247\12\324\373\253{\264\22`\3Q\332]\353I-?s\342K\324/\264JP\216tUOLhW\1548\2280z\21\310 ~%\224\200\337\341~\304\2N\241\233:\377\3373&\336)f\321\252\276\5+%\15\334>\267\331S\331\312\325v\257\330q\223\258?\17j\275T\262ue\243\305[.\320{\1\276\215\226\325\241\262\346t8\341\225\21\26Z0\11\210\2626\237\343\360\23\223\2x:\206r|D\3\364\24\17\13X\4\177k*\12\301\212\2354\267\13@KE\3qI\336x/\320\5\357\25,!\23n2\376'w\2424'Lp\13\317i\22OSgp\24c\260\11\246J\3?3\260\354\205E\3040\32\215 n!3\244\13\361\32/j\207;h0\367\345\375\265\375]>\203\34\30\265\320\262\200\316X\363#\353\235}\306x\23\332\373\360'\266\1\352\320ue;U\333\12m\2604\337E\353L\211?\322\37,;\27z@V ]\324\25089\210\246|;\242?\305$~\33\364N\360D(\270:a\274%\237\315Q+\3717\317\22\21 \16\223-\17\304!\4T\377s\215\177\357Y\205\351i]\300\20\20L\353\360B\375jn\11A\14O\32[\217\202Yr\27+?\235\263\16c(\4E\22\207\344\363?\225\15\15vs>\260\33\2\20O\11\353\205\253U\345\0\342\254\3373b\373\235\342\305C\36\36\17\2212\200\340/6t"\344SP&&V'\365,\226;\13\224\3\310;\240o\366\32\264,0\210\33\327\4\2079\323\204\14Gg\27\262Dg\221\272\276\316&\211\27K\275", ) \344SP&&V'\365,\226;\13\224\3\310;\240o\366\32\264,0\210\33\327\4\2079\323\204\14Gg\27\262Dg\221\272\276\316&\211\27K\275", ) == 0x0
 00981   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211 (112, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00982   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "9\347\207HN\276\365\277\363U}\210\346\227\322\327hK\357\337,\324\227d)Mw`m\21\353a \6\342\377-\304\274'\203Nf\212w\25\240\200\322\36\321\375\341N\347\48\213\25\215\35pk?<\341\322I{^*\336df\364\14\347{]\25K\30\255L\330\35%\4\374j\376\4\221\267\255d:1(\2\30\350\2352\31V\344\31}\361\215\311W\221W3\6+h\261\367\327N\1q6\325\226\354\14=\1\237`\355\3436\205\370\317\242f\325'\242\211YN\305B;\276\314\335\263\364'\0\313\276\15*6G\253-\2517\355\215F\354\372vQ\225\2050O\327\327\0A\35S\254\330\223\241 \33\266N\3\331\311\201\201!\365,\36\321\212\220\223:\267\}O`1\243u"{]Wj\15\16\357\343\347"$I\27\3543\366\35n0\246^\12\321\335QI\14"\234\39\234\226\26\313\12\3476g\304f0G\340i\213\207/\300\220\261\15\14\32\177Y\242\372\237\340\314\307\264\6MD)Y|<\273GKC:\256\317j\253s\314&\262\307\36"E\7\252C3tSt 9\240\257?\2260\272)\225\34\4\261D\30\351r:\234\35\320eP\270\303\223c\344\253\354\247C?\354\227\0I1\247\370^\324\274M\303f\346k\37\21\332\344\35\204\354\247](3\227\15\362>\26x\350'\236\0Rz\244\346hOb\227\246\271\325\327m\253\2557\214\375>\36\24s\307\314T\313\321\2670P\26_\311(\335x\3579, ) {]Wj\15\16\357\343\347 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "9\347\207HN\276\365\277\363U}\210\346\227\322\327hK\357\337,\324\227d)Mw`m\21\353a \6\342\377-\304\274'\203Nf\212w\25\240\200\322\36\321\375\341N\347\48\213\25\215\35pk?<\341\322I{^*\336df\364\14\347{]\25K\30\255L\330\35%\4\374j\376\4\221\267\255d:1(\2\30\350\2352\31V\344\31}\361\215\311W\221W3\6+h\261\367\327N\1q6\325\226\354\14=\1\237`\355\3436\205\370\317\242f\325'\242\211YN\305B;\276\314\335\263\364'\0\313\276\15*6G\253-\2517\355\215F\354\372vQ\225\2050O\327\327\0A\35S\254\330\223\241 \33\266N\3\331\311\201\201!\365,\36\321\212\220\223:\267\}O`1\243u"{]Wj\15\16\357\343\347"$I\27\3543\366\35n0\246^\12\321\335QI\14"\234\39\234\226\26\313\12\3476g\304f0G\340i\213\207/\300\220\261\15\14\32\177Y\242\372\237\340\314\307\264\6MD)Y|<\273GKC:\256\317j\253s\314&\262\307\36"E\7\252C3tSt 9\240\257?\2260\272)\225\34\4\261D\30\351r:\234\35\320eP\270\303\223c\344\253\354\247C?\354\227\0I1\247\370^\324\274M\303f\346k\37\21\332\344\35\204\354\247](3\227\15\362>\26x\350'\236\0Rz\244\346hOb\227\246\271\325\327m\253\2557\214\375>\36\24s\307\314T\313\321\2670P\26_\311(\335x\3579, ) \234\39\234\226\26\313\12\3476g\304f0G\340i\213\207/\300\220\261\15\14\32\177Y\242\372\237\340\314\307\264\6MD)Y|<\273GKC:\256\317j\253s\314&\262\307\36 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "9\347\207HN\276\365\277\363U}\210\346\227\322\327hK\357\337,\324\227d)Mw`m\21\353a \6\342\377-\304\274'\203Nf\212w\25\240\200\322\36\321\375\341N\347\48\213\25\215\35pk?<\341\322I{^*\336df\364\14\347{]\25K\30\255L\330\35%\4\374j\376\4\221\267\255d:1(\2\30\350\2352\31V\344\31}\361\215\311W\221W3\6+h\261\367\327N\1q6\325\226\354\14=\1\237`\355\3436\205\370\317\242f\325'\242\211YN\305B;\276\314\335\263\364'\0\313\276\15*6G\253-\2517\355\215F\354\372vQ\225\2050O\327\327\0A\35S\254\330\223\241 \33\266N\3\331\311\201\201!\365,\36\321\212\220\223:\267\}O`1\243u"{]Wj\15\16\357\343\347"$I\27\3543\366\35n0\246^\12\321\335QI\14"\234\39\234\226\26\313\12\3476g\304f0G\340i\213\207/\300\220\261\15\14\32\177Y\242\372\237\340\314\307\264\6MD)Y|<\273GKC:\256\317j\253s\314&\262\307\36"E\7\252C3tSt 9\240\257?\2260\272)\225\34\4\261D\30\351r:\234\35\320eP\270\303\223c\344\253\354\247C?\354\227\0I1\247\370^\324\274M\303f\346k\37\21\332\344\35\204\354\247](3\227\15\362>\26x\350'\236\0Rz\244\346hOb\227\246\271\325\327m\253\2557\214\375>\36\24s\307\314T\313\321\2670P\26_\311(\335x\3579, ) , ) == 0x0
 00983   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022 (112, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \332\370\364\2669\325\34\266\326Yu\321\35;, (112, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A (112, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00984   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "Ctq\230pZ0\374,\346p{p\7\27SKx6tm\270\276,\32K\22\4RD\246bDM\330SjX\10a\23w[\205\273\221Z\323\2173]\366+Y_\227?\23k Z\257\223\327`\34h\260`\343\304\0\14vtz8\7l\25\2110h\12\240Y\357\178;|\340;C\324\326r\0c\0Sk\27SrP^\3406l\206\220\271\366\262\353+5\224I\201\354\7\305:\366<\262\10\34\306\260\11h\34\214/\326\1}\266G^\271:W\36\202\261\7}|N\24d\200"\226\21`\341\1\327\2678\364W*>\265V\12\3\21f\327\221$\335\216M{P\271\26q`\242\231\240b\215-\235\366(+\250B \250\25\313<\216\25\233u\304\224K\6.)\337X+\363f\242n*]\201'\248\307\31\264X\25\331\32wh\362\247\363\2214ET\5\373\7%rT\17\375\362\317/'\4\27\353\\24\0BWIo\7\325|\360\23C\325\227v\352\252?\300\323\325>\16+\364\253;\367\11D\357\247\207Q\35\16-#\236\327;\223\27\310\200\257M\335'\177{\217\4\266Y\247\346\273t\236\11\3235W\313\30\33\364\252,o\313q\243\37}X?]P\244\230\224Q\10\16\16\32\22\31#\351\24o\247<\33F\375Kq\367\254]\0\247\4P\377\367\4\342\2\5Y\27u6A\332"\315\351\68\320)\341\16\377(\354 ;\320\264&\223\205@*S\1\252\205?\204_|~cu\12Q\26\350\252\214\271\375G\347\352*G\374N^\39v;\236\27\337\355l>\30S\20+\0\355,\360\246K\30#4\177\313\2118\224$\37, ) \226\21`\341\1\327\2678\364W*>\265V\12\3\21f\327\221$\335\216M{P\271\26q`\242\231\240b\215-\235\366(+\250B \250\25\313<\216\25\233u\304\224K\6.)\337X+\363f\242n*]\201'\248\307\31\264X\25\331\32wh\362\247\363\2214ET\5\373\7%rT\17\375\362\317/'\4\27\353\\24\0BWIo\7\325|\360\23C\325\227v\352\252?\300\323\325>\16+\364\253;\367\11D\357\247\207Q\35\16-#\236\327;\223\27\310\200\257M\335'\177{\217\4\266Y\247\346\273t\236\11\3235W\313\30\33\364\252,o\313q\243\37}X?]P\244\230\224Q\10\16\16\32\22\31#\351\24o\247<\33F\375Kq\367\254]\0\247\4P\377\367\4\342\2\5Y\27u6A\332 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "Ctq\230pZ0\374,\346p{p\7\27SKx6tm\270\276,\32K\22\4RD\246bDM\330SjX\10a\23w[\205\273\221Z\323\2173]\366+Y_\227?\23k Z\257\223\327`\34h\260`\343\304\0\14vtz8\7l\25\2110h\12\240Y\357\178;|\340;C\324\326r\0c\0Sk\27SrP^\3406l\206\220\271\366\262\353+5\224I\201\354\7\305:\366<\262\10\34\306\260\11h\34\214/\326\1}\266G^\271:W\36\202\261\7}|N\24d\200"\226\21`\341\1\327\2678\364W*>\265V\12\3\21f\327\221$\335\216M{P\271\26q`\242\231\240b\215-\235\366(+\250B \250\25\313<\216\25\233u\304\224K\6.)\337X+\363f\242n*]\201'\248\307\31\264X\25\331\32wh\362\247\363\2214ET\5\373\7%rT\17\375\362\317/'\4\27\353\\24\0BWIo\7\325|\360\23C\325\227v\352\252?\300\323\325>\16+\364\253;\367\11D\357\247\207Q\35\16-#\236\327;\223\27\310\200\257M\335'\177{\217\4\266Y\247\346\273t\236\11\3235W\313\30\33\364\252,o\313q\243\37}X?]P\244\230\224Q\10\16\16\32\22\31#\351\24o\247<\33F\375Kq\367\254]\0\247\4P\377\367\4\342\2\5Y\27u6A\332"\315\351\68\320)\341\16\377(\354 ;\320\264&\223\205@*S\1\252\205?\204_|~cu\12Q\26\350\252\214\271\375G\347\352*G\374N^\39v;\236\27\337\355l>\30S\20+\0\355,\360\246K\30#4\177\313\2118\224$\37, ) , ) == 0x0
 00985   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) |u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307 (112, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) X\4I\17\244\243\200\16\105\32E\22 (112, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00986   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ".\363\220o\2766N1\340\377_\314'@L\32Tb>'\3509\373P'\274\257\354\24n\13\36\364L\6>N\312M\234\331\353\1?\253\23 \215@S\360\12\23\245\17qX\365~\33\17\304lbl\266Pp\10Q\212\344\336\26\25\307\210ePjg\210\16*\25]\216\264]J\4\2307'\203.\24\370\322\247<\0\30wT|'\222P8\365\23O\213~\344\337\0\27\21246+i\213HE\321B n\344\205\25\252&\345d@TA\325]\306\253Y3\26\317C5-\\4>_\365`I'\237\303]\370D\311\356y\357h\237\30J<\251A\201\222\331\4GI\340\332)\11\273\325u\336V\266\372_\213\14\177\2067\\33\3\263\335T\211m-\211\23xn\151\253\235\22\354\360l\263\205\353\207\327\\355\16\30`\177\373^1 \206\15\350\257$\263EU\317\177\1\20o\37\3174\177\200\307\26\210\25s\325\275\262\351V\13\275\4Khn=\37\0\360"\252$-\272\324\1\351\344\253z\372\17T\200|\20\3729)\34\277%\26\344\273\200O\5\373\344\354\10{1Z\231t\364\374f\376\322\213\272u{"\25\16E)F\322Hj8\246\332\343\37d\203n\27$.|\367(\24\255\34G`\344s\212#2l\325\206\374\313\2164W\303\207\22\304\307\25\333c\27T\372\23Q\245\232\232\13\360\300\32b\355\33\37W$\25X'\24L\16F\177\375LS\11\370\371\250\336\235\274\333\\343P\3605j8\304\220\311\1G5\277:\215\251\201\242\221?\277?CEF\5\35P\326R(u\316\23d\271\205\26\35\2422\276\337\200\207@\260\2:|H\13\22N\256=\303\311\355\375\261E\331\246\274\201\307\14", ) \20o\37\3174\177\200\307\26\210\25s\325\275\262\351V\13\275\4Khn=\37\0\360 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ".\363\220o\2766N1\340\377_\314'@L\32Tb>'\3509\373P'\274\257\354\24n\13\36\364L\6>N\312M\234\331\353\1?\253\23 \215@S\360\12\23\245\17qX\365~\33\17\304lbl\266Pp\10Q\212\344\336\26\25\307\210ePjg\210\16*\25]\216\264]J\4\2307'\203.\24\370\322\247<\0\30wT|'\222P8\365\23O\213~\344\337\0\27\21246+i\213HE\321B n\344\205\25\252&\345d@TA\325]\306\253Y3\26\317C5-\\4>_\365`I'\237\303]\370D\311\356y\357h\237\30J<\251A\201\222\331\4GI\340\332)\11\273\325u\336V\266\372_\213\14\177\2067\\33\3\263\335T\211m-\211\23xn\151\253\235\22\354\360l\263\205\353\207\327\\355\16\30`\177\373^1 \206\15\350\257$\263EU\317\177\1\20o\37\3174\177\200\307\26\210\25s\325\275\262\351V\13\275\4Khn=\37\0\360"\252$-\272\324\1\351\344\253z\372\17T\200|\20\3729)\34\277%\26\344\273\200O\5\373\344\354\10{1Z\231t\364\374f\376\322\213\272u{"\25\16E)F\322Hj8\246\332\343\37d\203n\27$.|\367(\24\255\34G`\344s\212#2l\325\206\374\313\2164W\303\207\22\304\307\25\333c\27T\372\23Q\245\232\232\13\360\300\32b\355\33\37W$\25X'\24L\16F\177\375LS\11\370\371\250\336\235\274\333\\343P\3605j8\304\220\311\1G5\277:\215\251\201\242\221?\277?CEF\5\35P\326R(u\316\23d\271\205\26\35\2422\276\337\200\207@\260\2:|H\13\22N\256=\303\311\355\375\261E\331\246\274\201\307\14", ) \25\16E)F\322Hj8\246\332\343\37d\203n\27$.|\367(\24\255\34G`\344s\212#2l\325\206\374\313\2164W\303\207\22\304\307\25\333c\27T\372\23Q\245\232\232\13\360\300\32b\355\33\37W$\25X'\24L\16F\177\375LS\11\370\371\250\336\235\274\333\\343P\3605j8\304\220\311\1G5\277:\215\251\201\242\221?\277?CEF\5\35P\326R(u\316\23d\271\205\26\35\2422\276\337\200\207@\260\2:|H\13\22N\256=\303\311\355\375\261E\331\246\274\201\307\14", ) == 0x0
 00987   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\25\347\317o\205"\211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00988   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ":\265\240N\237\301W\22d\11;\262\347\220tq\20UF\367\263#Z4\231\231\335:\264Z\355CUx\6\205E4l\31\36^s\13\220\22\337\1\242T\341&\34\25]\20kz>\315\377g\206\263\223W\370\320\22e\7\200\341\17\201V\27\276\367\1\26\304\315oe*\32R\246\315\254iNC\254z\223\210/\2578/x\272\311H\367i\11q\14\211P\353\254w\22l\204\212~\26\23\363\332\4\251\345\274y\330\325\234\34\20\315,\256EK\221\220\300S\355\325\276\215\25u \262\37CF8\254\242\11LT\230F\177\12\277?\247\210\252m\325'\177&3\21\7s7n\324\3003,G*\331J;V\240\12\216\352\371*\34\270&t\264F\25\330J\32\11\14S\320\27\224\23\204\32\2532\2\327\224\23\37zh\363\360 \37\24 \31V\307\33O8\304[\3y\377 \365\21K\24\333Q\233\262#\14,K\34\337\211\2577\30S\309\0<\7\320\202du1\34\322_/\363I\212\266a\362\211\\350\30\327|\276\251\276[#;\353,\336L\30%\14\335\220\246`S\301\313\220\305\20.]\263O{\254\311\252\224\1\324D#\236\5\31c\271*\346`#\227\213z\30Q\331h\204YH\243\35\2q\14L\10\233D\350Q\2118\204\22P5K\14#\14"\266\343fS\30\26\257\27P3Psa\367\31\337[\314A\222\22\30N\24\270B.\261\12!V\350\232\371ku[\0\242\~r\350Z\370\20vM|A\364\256\261,6\253\307;\6T\222\313\314\177\237Ven\316y\26*9;U\223\326\222@t\204\10\27\3641\213\364\321\341;E\230Zz(\247\200\206\340?\366\21\232\37 \11\33\320\370\304\0\252\2225\324\233\3I\14d\306\373x\310m"\312w86\304\226N", ) \266\343fS\30\26\257\27P3Psa\367\31\337[\314A\222\22\30N\24\270B.\261\12!V\350\232\371ku[\0\242\~r\350Z\370\20vM|A\364\256\261,6\253\307;\6T\222\313\314\177\237Ven\316y\26*9;U\223\326\222@t\204\10\27\3641\213\364\321\341;E\230Zz(\247\200\206\340?\366\21\232\37 \11\33\320\370\304\0\252\2225\324\233\3I\14d\306\373x\310m (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ":\265\240N\237\301W\22d\11;\262\347\220tq\20UF\367\263#Z4\231\231\335:\264Z\355CUx\6\205E4l\31\36^s\13\220\22\337\1\242T\341&\34\25]\20kz>\315\377g\206\263\223W\370\320\22e\7\200\341\17\201V\27\276\367\1\26\304\315oe*\32R\246\315\254iNC\254z\223\210/\2578/x\272\311H\367i\11q\14\211P\353\254w\22l\204\212~\26\23\363\332\4\251\345\274y\330\325\234\34\20\315,\256EK\221\220\300S\355\325\276\215\25u \262\37CF8\254\242\11LT\230F\177\12\277?\247\210\252m\325'\177&3\21\7s7n\324\3003,G*\331J;V\240\12\216\352\371*\34\270&t\264F\25\330J\32\11\14S\320\27\224\23\204\32\2532\2\327\224\23\37zh\363\360 \37\24 \31V\307\33O8\304[\3y\377 \365\21K\24\333Q\233\262#\14,K\34\337\211\2577\30S\309\0<\7\320\202du1\34\322_/\363I\212\266a\362\211\\350\30\327|\276\251\276[#;\353,\336L\30%\14\335\220\246`S\301\313\220\305\20.]\263O{\254\311\252\224\1\324D#\236\5\31c\271*\346`#\227\213z\30Q\331h\204YH\243\35\2q\14L\10\233D\350Q\2118\204\22P5K\14#\14"\266\343fS\30\26\257\27P3Psa\367\31\337[\314A\222\22\30N\24\270B.\261\12!V\350\232\371ku[\0\242\~r\350Z\370\20vM|A\364\256\261,6\253\307;\6T\222\313\314\177\237Ven\316y\26*9;U\223\326\222@t\204\10\27\3641\213\364\321\341;E\230Zz(\247\200\206\340?\366\21\232\37 \11\33\320\370\304\0\252\2225\324\233\3I\14d\306\373x\310m"\312w86\304\226N", ) , ) == 0x0
 00989   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27 (112, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00990   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "Q\20\255\30E\372\334\332z\264\213|\263\33\354\237\365v:\204\323\364\234{\260\30\32\332Q\214\2240\275\305f\35*\203\277D(\233\223]\273\303;D\23\203!"\233o*\15I\25!\34m\212\26\217\235\271\247\226.9\330ff\330\233\353K\16\306\14+\35T\25\367\21\3538$\325;\333u\314 \3605\26\13\5\370\231p\370\26\303\\11\221],\267\221\331\13\23$2\34\271\375\224\5Q\313\2<\275\252h\335\233\262\360e\234wf\33373\374\323\341v\226\317\343\6\357\3363/%\4\244\362\236]\216\205\204k\262\25\234\347\1\371\225\244W1\32\0\343E\35\230\203\377\21409,\336m\217\1\271\216\25\346\316\217\2749]~>\237Z\340\215H\316\311\327\202\356\30p\2\313\13\307\340\337\3)\311t\336O\307v\221\255@ZD\31\354n!\273\225D\234*\301\27\26T\20\344\235\272\32\316\35\342p\327K\255h\263\250C\5VE\252\344C\330\300\206-\263\347w\250\31vM\12\211\307\343u*\305\276~\3\306\210\236L/u\274|4\20[\373\253\334P\267\362\6\327!\217\366l\5\331\306Y\32\20>@b$\10\4\302A\2\364\262d"\254\261\221"\10]\225\225\265\371O\337\16\375YK\243\231\36=j\33\37Ss5\330\214\210\207\347D:3~\353", ) \233o*\15I\25!\34m\212\26\217\235\271\247\226.9\330ff\330\233\353K\16\306\14+\35T\25\367\21\3538$\325;\333u\314 \3605\26\13\5\370\231p\370\26\303\\11\221],\267\221\331\13\23$2\34\271\375\224\5Q\313\2<\275\252h\335\233\262\360e\234wf\33373\374\323\341v\226\317\343\6\357\3363/%\4\244\362\236]\216\205\204k\262\25\234\347\1\371\225\244W1\32\0\343E\35\230\203\377\21409,\336m\217\1\271\216\25\346\316\217\2749]~>\237Z\340\215H\316\311\327\202\356\30p\2\313\13\307\340\337\3)\311t\336O\307v\221\255@ZD\31\354n!\273\225D\234*\301\27\26T\20\344\235\272\32\316\35\342p\327K\255h\263\250C\5VE\252\344C\330\300\206-\263\347w\250\31vM\12\211\307\343u*\305\276~\3\306\210\236L/u\274|4\20[\373\253\334P\267\362\6\327!\217\366l\5\331\306Y\32\20>@b$\10\4\302A\2\364\262d (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "Q\20\255\30E\372\334\332z\264\213|\263\33\354\237\365v:\204\323\364\234{\260\30\32\332Q\214\2240\275\305f\35*\203\277D(\233\223]\273\303;D\23\203!"\233o*\15I\25!\34m\212\26\217\235\271\247\226.9\330ff\330\233\353K\16\306\14+\35T\25\367\21\3538$\325;\333u\314 \3605\26\13\5\370\231p\370\26\303\\11\221],\267\221\331\13\23$2\34\271\375\224\5Q\313\2<\275\252h\335\233\262\360e\234wf\33373\374\323\341v\226\317\343\6\357\3363/%\4\244\362\236]\216\205\204k\262\25\234\347\1\371\225\244W1\32\0\343E\35\230\203\377\21409,\336m\217\1\271\216\25\346\316\217\2749]~>\237Z\340\215H\316\311\327\202\356\30p\2\313\13\307\340\337\3)\311t\336O\307v\221\255@ZD\31\354n!\273\225D\234*\301\27\26T\20\344\235\272\32\316\35\342p\327K\255h\263\250C\5VE\252\344C\330\300\206-\263\347w\250\31vM\12\211\307\343u*\305\276~\3\306\210\236L/u\274|4\20[\373\253\334P\267\362\6\327!\217\366l\5\331\306Y\32\20>@b$\10\4\302A\2\364\262d"\254\261\221"\10]\225\225\265\371O\337\16\375YK\243\231\36=j\33\37Ss5\330\214\210\207\347D:3~\353", ) \10]\225\225\265\371O\337\16\375YK\243\23125\323i\2d\37v\25\365\313RwD@\242\302\353\14\223\2108\3\235'\344\337\336)yF0g\364\277Q\15\24\217\3\345\222\33\224\364\4\363v\34`\312\300\241\0e\36\33\211\331\204j\375?213D\304$\14\31\25\253\256-\273Vs3?\250a\370F\3428,/\221\302\312\15\\307\312@K\217{8^s7\22\377\350\32\225\234f\243\310\3\276\306\35+\14]\353\226\4\320\4\326P0\25Y\3k>\36=j\33\37Ss5\330\214\210\207\347D:3~\353", ) == 0x0
 00991   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D (112, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00992   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "(3L\223@=\3\15\301\374 \34U\372\240Vy\237+\20\203?r\256r\335\225\344=\215f:\235\10\300\34*\323\17\331(\367\3663|\363\324W\2144v\12E$\33G\177w\315\327\31O\231\300\3\273\320\331\351\306/\354\4\373p.\253\212\35\224\243+E\20ru\347&\273\271\246\242\211.\223U\310j\355\223\232\216w\16^h\236)\214\375n\324-`\2\240[\320\234\374\303\304j\327\12\375\17#\14b\310\240M\343j4\245\301a\251\3536\353R\261\370\360!\22\320U\215c \202wC%\37\24\21\333jn}\211\12\377\212\217\374\271=\276*\353%\211U\27\32O\205\25k\367P\262\363\346\323MQ\4\12.\205\34lF\222@\27\322!\334y\303mGD\371\27x\262O\224\276Y\343\327\r\10\215\353I\16 \261z\3649)Yu\31r\250\240\361A\230F=\212N\35O\3659\226>jR\3{}\231C\2058/\267\327\375\32@\340:\355?R\324OM\275\237]\336>\325\247\20F\375\252\227\3239\200\370\342\365\2251s\315\243\333\26\2375\13\344\262/\330\342\217\202\202\240G\255\350\344v"AO\35\205\273\325\354\200u\335\231$\3\304\371@\202\37\217\325D.\361\203\300\323\20\337\3444rZ\360\326\243\2050\13\365>\353\11\324\365\213\337\27"\10B\265\271\340f\346\335;F\30d\4\303j\244\27A\6,'\15/\5I1\231D=\24\20x6\352\276n\304\363X\22\2c\262\353$r\230\245\12\24>\13T\244\350^\204\206{\31\33\264\256\333\0\2647\360 \3549\301\321~\326\7+\364\247\3\263G]\303z\335]\340\226\26f\3100\336"\201`\205K\373B\23)\367\343\227\205\12\273\271o\12]\37\22|\303\342dz?h@\2775Ur!", ) AO\35\205\273\325\354\200u\335\231$\3\304\371@\202\37\217\325D.\361\203\300\323\20\337\3444rZ\360\326\243\2050\13\365>\353\11\324\365\213\337\27 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "(3L\223@=\3\15\301\374 \34U\372\240Vy\237+\20\203?r\256r\335\225\344=\215f:\235\10\300\34*\323\17\331(\367\3663|\363\324W\2144v\12E$\33G\177w\315\327\31O\231\300\3\273\320\331\351\306/\354\4\373p.\253\212\35\224\243+E\20ru\347&\273\271\246\242\211.\223U\310j\355\223\232\216w\16^h\236)\214\375n\324-`\2\240[\320\234\374\303\304j\327\12\375\17#\14b\310\240M\343j4\245\301a\251\3536\353R\261\370\360!\22\320U\215c \202wC%\37\24\21\333jn}\211\12\377\212\217\374\271=\276*\353%\211U\27\32O\205\25k\367P\262\363\346\323MQ\4\12.\205\34lF\222@\27\322!\334y\303mGD\371\27x\262O\224\276Y\343\327\r\10\215\353I\16 \261z\3649)Yu\31r\250\240\361A\230F=\212N\35O\3659\226>jR\3{}\231C\2058/\267\327\375\32@\340:\355?R\324OM\275\237]\336>\325\247\20F\375\252\227\3239\200\370\342\365\2251s\315\243\333\26\2375\13\344\262/\330\342\217\202\202\240G\255\350\344v"AO\35\205\273\325\354\200u\335\231$\3\304\371@\202\37\217\325D.\361\203\300\323\20\337\3444rZ\360\326\243\2050\13\365>\353\11\324\365\213\337\27"\10B\265\271\340f\346\335;F\30d\4\303j\244\27A\6,'\15/\5I1\231D=\24\20x6\352\276n\304\363X\22\2c\262\353$r\230\245\12\24>\13T\244\350^\204\206{\31\33\264\256\333\0\2647\360 \3549\301\321~\326\7+\364\247\3\263G]\303z\335]\340\226\26f\3100\336"\201`\205K\373B\23)\367\343\227\205\12\273\271o\12]\37\22|\303\342dz?h@\2775Ur!", ) \201`\205K\373B\23)\367\343\227\205\12\273\271o\12]\37\22|\303\342dz?h@\2775Ur!", ) == 0x0
 00993   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\23'\23\223{)\\15\372\350\177\3\17A\245\240mm\300+9$\334?I\272-\335\256\360b\215].\302\10\373\10u\3234\315w\367\315'#\363\357C\3234M\36\32$ S w\366\303FO\242\324\\273\353\315\266\306\24\370[\373K:\364\212&\200\374+~\4-u\3342\344\271\235\266\326.\250AF0Q\371\314\232\265cQ^S\212v\214\306z\213-[\26\377[\353\210\243\303\377~\210\12\306\33|\14Y\334\377M\330~k\245\372u\366\353\15\377\15\261\303\344~\22\353A\322c\33\226(C\36\13K\21\340~1}\262\36\240\212\264\13k\271\6\252u\353\36\235\12\27![\332\25P\343\17\262\310\362\214Mj\20U.\276\103F\251TH\322\32\310&\303VS\33\371,l\355O\257\252\6\343\354H-\10\266\377\26\16\33\245%\364\2=\6u"f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00994   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\135w\336\255\30\264'-\27\11\15\275\352\310\2546\10H\213\344/\264u\371\201I\13\21\252\232\237\3272k71M\237Z`\304\244\213T\340t\240\11\217-lu\27\25\4@'^\4\4\177\222we\5\346\255\177A\7\273:j\207\31{\244Z)\203P;\20J\367i\353\255\36\324\3778\332\36\304M?m\27\0\333\242)-\24\346\266\2462KA\201a\216(\231\221\221\213\320\224\11\24)\274\2134m>g\331\277\377SnhT\357F\307\17d\373N\221\213\221\222B\360Y\30I\326\30\246*\202\236==\336\306\17\225\271<\2\24E\1\13\13GU\372\6\16Vw\365\10Q\6\354\326;,\307\347G\5vd\254\367wL$\273-\\350;\372\376\272s\343\244_:\212\321_n\374\274`Qb\237\276\212\20\20h0A\15u$lZ\315\35S[$b\26\263\24Lb\2040\342\224}\243\327\234WR\177\20d\270\332\230\2\350\325\27\232\211\316\237BT,\16!N\320E\255s\264\372(\14\3479s\2008bd\31L/dc\223n\307\333\275\235Z\247bdb\270\251stmf\332\12\374\301>\234\201\21\32\250\243\33\200\251\331\320\360\252ca\370Q\2Q0k\372\261\340\315\35_\360:PO\344-\25b\3343\31\361[\204\204\377\10`\304\324\352\272\2261[\352\361_\3768\30\336\302\16\217$\2336\225\275\16\375-\33(\327t\0T\252\321\32\213\16\332\326\216\31tc\316E\250\351\335Qw\244\217M\36\202;@\34\346/4\3\203\213>\353)\36l\4t\373l\245Bv\205G\237B\236\377V6\36\35\325\3175\255\343\210\311\15i&\20\241\254\241\272\362\226\20\337"k\235\320\27\20\310\362u\202F\315?YA\277,\211mT+C$H\27\324\4\0\373,\214", ) k\235\320\27\20\310\362u\202F\315?YA\277,\211mT+C$H\27\324\4\0\373,\214", ) == 0x0
 00995   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216 (112, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00996   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "(9\324\274\270.a\334\306!\22\151\235^\241=\310\231\05m#\364]\337u\263\204\233\10\2\354\21\312\32\374\35\233\231\2415W\17\277\207x\353\20Q\273\35k?[\202\302\216B\257k\375"\2173DN0\251\15)\113\232\313cd7\177 \204\333\13p\243\246\221\207H\202;\177\255h\223-\263H\351;\277\361A\0\372\\12|\220,[\270\314Wr\17_@\35\0\33\327\260T\12\2@\20\357\7\361\265q\22\370~1\33\4\25wu@t\6}\10P\373\28\34t\261\364\255\251\350\363D" '\353iC\14\246va+_l\24K\360#,\341\240\13\231/\30\314\260\14\300{U\232\261\341dR\2111\226\264."\206\24+\207\204\367\2222-\25\320\223M^d_\204\367\33\247-o5(\323<\227k\0\237\3\240O\12P\221\224]\22\234\222\344\220C\12o\310_cT\230\302\264\326\312jy\7L\372\336\311\3201\23\350S\226\26\257Z3\257 \331\33\274\312\202?\25\206\233z\311l\213\361\203\300#\20\224\240\260\32/\241r\32`r\375"\26'\255\263q7\327y2\261%(\243\261\307\33\31\257X(\310\177r\233\10\212\313\244|\340\200\4\17\212\333\343\235\374vI9\253\303\2430\231\266XH\374=S]\213<\325\265\3)q\204\332V\23T\4q\313Z\103\30\311eb\202x\20/\12G\34b\202:Y.4{\14\23_Z\277~\36 0qa\227\350z\349\255\206\3501m1\23\206[\230\373P\13\263\23\241\312\211t\33\27\304\11\257N\247\324\205]\33\210\363]\277\300\2c\342F\357\245&\237$\307\204\240\374\311\272\322w\304\237"\14\20\355\330\367\23\344\22\21W\365\32\2508ar\213\346B\222\17\16\227\1;\225\1\340\214\331\275\200", ) \2173DN0\251\15)\113\232\313cd7\177 \204\333\13p\243\246\221\207H\202;\177\255h\223-\263H\351;\277\361A\0\372\\12|\220,[\270\314Wr\17_@\35\0\33\327\260T\12\2@\20\357\7\361\265q\22\370~1\33\4\25wu@t\6}\10P\373\28\34t\261\364\255\251\350\363D (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "(9\324\274\270.a\334\306!\22\151\235^\241=\310\231\05m#\364]\337u\263\204\233\10\2\354\21\312\32\374\35\233\231\2415W\17\277\207x\353\20Q\273\35k?[\202\302\216B\257k\375"\2173DN0\251\15)\113\232\313cd7\177 \204\333\13p\243\246\221\207H\202;\177\255h\223-\263H\351;\277\361A\0\372\\12|\220,[\270\314Wr\17_@\35\0\33\327\260T\12\2@\20\357\7\361\265q\22\370~1\33\4\25wu@t\6}\10P\373\28\34t\261\364\255\251\350\363D" '\353iC\14\246va+_l\24K\360#,\341\240\13\231/\30\314\260\14\300{U\232\261\341dR\2111\226\264."\206\24+\207\204\367\2222-\25\320\223M^d_\204\367\33\247-o5(\323<\227k\0\237\3\240O\12P\221\224]\22\234\222\344\220C\12o\310_cT\230\302\264\326\312jy\7L\372\336\311\3201\23\350S\226\26\257Z3\257 \331\33\274\312\202?\25\206\233z\311l\213\361\203\300#\20\224\240\260\32/\241r\32`r\375"\26'\255\263q7\327y2\261%(\243\261\307\33\31\257X(\310\177r\233\10\212\313\244|\340\200\4\17\212\333\343\235\374vI9\253\303\2430\231\266XH\374=S]\213<\325\265\3)q\204\332V\23T\4q\313Z\103\30\311eb\202x\20/\12G\34b\202:Y.4{\14\23_Z\277~\36 0qa\227\350z\349\255\206\3501m1\23\206[\230\373P\13\263\23\241\312\211t\33\27\304\11\257N\247\324\205]\33\210\363]\277\300\2c\342F\357\245&\237$\307\204\240\374\311\272\322w\304\237"\14\20\355\330\367\23\344\22\21W\365\32\2508ar\213\346B\222\17\16\227\1;\225\1\340\214\331\275\200", ) \206\24+\207\204\367\2222-\25\320\223M^d_\204\367\33\247-o5(\323<\227k\0\237\3\240O\12P\221\224]\22\234\222\344\220C\12o\310_cT\230\302\264\326\312jy\7L\372\336\311\3201\23\350S\226\26\257Z3\257 \331\33\274\312\202?\25\206\233z\311l\213\361\203\300#\20\224\240\260\32/\241r\32`r\375 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "(9\324\274\270.a\334\306!\22\151\235^\241=\310\231\05m#\364]\337u\263\204\233\10\2\354\21\312\32\374\35\233\231\2415W\17\277\207x\353\20Q\273\35k?[\202\302\216B\257k\375"\2173DN0\251\15)\113\232\313cd7\177 \204\333\13p\243\246\221\207H\202;\177\255h\223-\263H\351;\277\361A\0\372\\12|\220,[\270\314Wr\17_@\35\0\33\327\260T\12\2@\20\357\7\361\265q\22\370~1\33\4\25wu@t\6}\10P\373\28\34t\261\364\255\251\350\363D" '\353iC\14\246va+_l\24K\360#,\341\240\13\231/\30\314\260\14\300{U\232\261\341dR\2111\226\264."\206\24+\207\204\367\2222-\25\320\223M^d_\204\367\33\247-o5(\323<\227k\0\237\3\240O\12P\221\224]\22\234\222\344\220C\12o\310_cT\230\302\264\326\312jy\7L\372\336\311\3201\23\350S\226\26\257Z3\257 \331\33\274\312\202?\25\206\233z\311l\213\361\203\300#\20\224\240\260\32/\241r\32`r\375"\26'\255\263q7\327y2\261%(\243\261\307\33\31\257X(\310\177r\233\10\212\313\244|\340\200\4\17\212\333\343\235\374vI9\253\303\2430\231\266XH\374=S]\213<\325\265\3)q\204\332V\23T\4q\313Z\103\30\311eb\202x\20/\12G\34b\202:Y.4{\14\23_Z\277~\36 0qa\227\350z\349\255\206\3501m1\23\206[\230\373P\13\263\23\241\312\211t\33\27\304\11\257N\247\324\205]\33\210\363]\277\300\2c\342F\357\245&\237$\307\204\240\374\311\272\322w\304\237"\14\20\355\330\367\23\344\22\21W\365\32\2508ar\213\346B\222\17\16\227\1;\225\1\340\214\331\275\200", ) \14\20\355\330\367\23\344\22\21W\365\32\2508ar\213\346B\222\17\16\227\1;\225\1\340\214\331\275\200", ) == 0x0
 00997   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\23-\213\274\203:>\334\3755M\15\12\211\1\241\6\334\306\0\16y|\364f\313*\263\277\217W\2\327\5\225\32\307\11\304\231\232!\10\17\204\223'\353+E\344\35P+\4\202\371\232\35\257P\351}\217\10P\210\222\31v\11\10\216\224c_#  \277\317Tp\230\262\316\207s\226d\177\226|\314-\210\\266;\204\345\36\0\301HU|\2538\4\270\367C-\17dTB\0 \303\357T1\26\37\20\324\23\256\265J\6\247~\12\17[\25La\37t=iWP\300\26g\34O\245\253\255\222\374\254D\314x\353RWS\246Mut_W\0\24\360\308\276\2400\215p\30\367\244S\300@A\305\261\332p\15\211\12\202\353.\31\222K+\274\220\250\222\119J\320\250Y\1dd\220\250\33\234905\23\307c\227P\24\300\3\233[UP\252\200\2\22\247\206\273\220x\360\310dw\13\230\371\240\211\312QmXL\301\312\226\320\12\7\267S\255\2\360Z\10\273\177\331 \250\225\202\4\1\331\233A\3353\213\312\227\237#+\200\377\260!;\376r!t-\375\31\2x\255-'.7\354mm\261\36<\374\261\374\17F\257c<\227\177I\217W\212\360\260#\340\273\20P\212\340\367\302\374M]f\253\370\267o\231\215L\27\374\6G\2\213\7\301\352\3\22e\333\332m\7\13\4J\337\5\10\10\14\226eY\226'\20\24\36\30\34Y\226eY\25 $\14(K\5\277E\12\1770Ju\310\350A\10f\255\275\374nm\12\7\331[\243\357\17\13\210\7\376\312\262`D\27\377\25n\257u\263\213\205f\17\327\363f\253\237\2X\366\31\357\2362\300$\374\220\377\374\362\256\215w\377\213}\14+\371\207\367(\360M\21l\341E\250\3u-\213\335V\315\1\14\32\310\1\0\201^\340\267\315\342\200", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00998   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\30\341J\205]R\243\6 `\324\22>\317Ws\24\317\301\242U eC\245\26\275\6*\373_2\217f\261/\226\356d\373L\266"\31\213\5B\353\300b\260\377W\353X\16\33\266\312\12\0Y\247\177\253\27g\0;\245*\213\217F\244x\362L\2220\347s\36`\320\345\201\53\243r\227\337\222\303\231\236\374\217\16\377\14\351\375\303\23\267\13O"u\32\361AG\24\362\15\347?\11/h|\321{\360\330\334\225\337\14\343\4\277\202[\305\315\330\300~Y\3047\240\271o\332y\310\267\270\353\262hziZ\5\203NY\15\301M\372\32\303\375M\17\260'\1N\177\226\306\350b\345\247\226\252\224\353\36\213\360\357\17\21\224(\30(\227#\223\364B<\201yk\266t}\24B\247\23\224\336\21\230\301T\14@9\204\213#E\10\341\5Q@\237m\323\214\364\4%\364w\214\205\10\3\37\353R~\356\321G_\10?\13\224\207)a\301\255\33\334%\207v\301\360\35\220\36\13:^\306\3)\24\2266/\354\16n\234\274\316\12q{\242\336|\247]\316(\251R\22+\14e\237\2059|\367N\337\260\363\236^0\370s\256\312\34\230\33\256k&\266Nm\247\340\16\303T\26Z\346'D\14at\344\337nK\351v\376\231\355O\1\361F\36\301\305\330\366"[\5\247\273\277u_,\263\207\\370N%\255\243fD\16\351\220t\234\202(pg\213\361\256GO3\14^\346bL\132\273\275\221\370o\246\217\262)\254\215\22, H(,?\257\323\337M\237cm\20<\17='\310D\370\240T\260\223\222\7xh\1\17\376\340\25\336{\254\231C\224~\23^\1F\2\302|\378\267\0O\237m]Q\10\31\354*\340u\361\340W\230k\324b\\", ) \31\213\5B\353\300b\260\377W\353X\16\33\266\312\12\0Y\247\177\253\27g\0;\245*\213\217F\244x\362L\2220\347s\36`\320\345\201\53\243r\227\337\222\303\231\236\374\217\16\377\14\351\375\303\23\267\13O364\200,P\322_?Z\345\24\333 (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\30\341J\205]R\243\6 `\324\22>\317Ws\24\317\301\242U eC\245\26\275\6*\373_2\217f\261/\226\356d\373L\266"\31\213\5B\353\300b\260\377W\353X\16\33\266\312\12\0Y\247\177\253\27g\0;\245*\213\217F\244x\362L\2220\347s\36`\320\345\201\53\243r\227\337\222\303\231\236\374\217\16\377\14\351\375\303\23\267\13O"u\32\361AG\24\362\15\347?\11/h|\321{\360\330\334\225\337\14\343\4\277\202[\305\315\330\300~Y\3047\240\271o\332y\310\267\270\353\262hziZ\5\203NY\15\301M\372\32\303\375M\17\260'\1N\177\226\306\350b\345\247\226\252\224\353\36\213\360\357\17\21\224(\30(\227#\223\364B<\201yk\266t}\24B\247\23\224\336\21\230\301T\14@9\204\213#E\10\341\5Q@\237m\323\214\364\4%\364w\214\205\10\3\37\353R~\356\321G_\10?\13\224\207)a\301\255\33\334%\207v\301\360\35\220\36\13:^\306\3)\24\2266/\354\16n\234\274\316\12q{\242\336|\247]\316(\251R\22+\14e\237\2059|\367N\337\260\363\236^0\370s\256\312\34\230\33\256k&\266Nm\247\340\16\303T\26Z\346'D\14at\344\337nK\351v\376\231\355O\1\361F\36\301\305\330\366"[\5\247\273\277u_,\263\207\\370N%\255\243fD\16\351\220t\234\202(pg\213\361\256GO3\14^\346bL\132\273\275\221\370o\246\217\262)\254\215\22, H(,?\257\323\337M\237cm\20<\17='\310D\370\240T\260\223\222\7xh\1\17\376\340\25\336{\254\231C\224~\23^\1F\2\302|\378\267\0O\237m]Q\10\31\354*\340u\361\340W\230k\324b\\", ) [\5\247\273\277u_,\263\207\\370N%\255\243fD\16\351\220t\234\202(pg\213\361\256GO3\14^\346bL\132\273\275\221\370o\246\217\262)\254\215\22, H(,?\257\323\337M\237cm\20<\17='\310D\370\240T\260\223\222\7xh\1\17\376\340\25\336{\254\231C\224~\23^\1F\2\302|\378\267\0O\237m]Q\10\31\354*\340u\361\340W\230k\324b\\", ) == 0x0
 00999   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "#\365\25\205fF\374\6\33t\213\22\5\333\10s/\333\236\242n4:C\236\2\342\6\21\357\02\264r\356/\255\372;\373w\242}\31\260\21\35\353\373v\357\377l\377\7\16 \242\225\12;M\370\177\220\38\0\0\261u\213\264R\373x\311X\3150\334gA`\353\361\336\5\10\267-\227\344\206\234\231\245\350\320\16\304\30\266\375\370\7\350\13t(\31W\25]\253\200\27D\215_\4N\272\24\3406*\32\312U\30\24\311\31\270?2;7|\352o\257\330\347\201\200\14\330\20\340\202`\321\222\330\373j\6\304\14\264\346o\341m\227\267\203\377\355hA}\5\5\270Z\6\15\372Y\245\32\370\351\22\17\2133^ND\202\231\350Y\361\370\226\221\200\264\36\260\344\260\17*\200w\30\23\203|\223\317Vc\201B\177\351tF\0\35\247(\200\201\21\243\325\13\14{-\333\213\30QW\341>E\37\237V\307\323\364?1\253w\267\221W\3$\377\15~\325\305\30_3+T\224\274=>\301\226\17\203%\274b\236\360&\204A\13\1J\231\3\22\0\3116\24\370Qn\247\250\221\12Jo\375\336G\263\2\316\23\275\15\22\20\30:\237\276-#\367u\313\357\363\245Jo\370H\272\225\34\243\17\361k\35\242\21m\234\364Q\303o\2\5\346\34PSaO\360\200np\375)\376\242\371\20\1\312RA\301\376\314\251"`\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) `\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 01000   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "XZG!\27/|\264\241\27)Bz@TD/\25WG\316<\335\224H:\27:\30;*{\313\231>\207\7\353\306\325A\21\224\317\204\177\356[\231\273\337V:\33Q\11\7\342\377qM\27c[\3060\360\23\201xTh\3\315\334\5+x\230T|ST\21\232/\25\303\254\253\203\256J<[\371\357jI\211*@;\16\274\310\203\%\213x_O\204[~\233[\313\33\24\177 WK=\370:\13\177\4|8\210\3\226\215\277WM\24\177\360\214\14C\20MS~\34\344\11\2\201\303S\16Qg\35\371D\207S'{'37\203b\204\257K\224E\223K\13a\207\334)/n\34\254E\343{\216\267\367`\12\303\264\33kt\24-\316_~\350\31\30T\200\25\232\26\205|H\203\223\337\220 x\w\325\256\22p\240C\30\308sX\246[4\346\1\2713^\271S\27\246 \302\24L4;Cg\217\306\22\273\0j\364]i\211D-\3np9T/\333/T;4\335*\203\315\361\27i,O\344LB\226&<\14IP*c\11\1\216\332N\27\300g\237\354\227\36b\347\4G?\20+\206^E\13\200\17T\333\352`S\363\50\351\201\370\333\3460@\15\2\344H\224\30\33\245\311\334\340\27\321p:\6\264\2\360S\343\367\21\355#\4;S\207H/7\25.x]\3478b\334Y\2441\14\3\242?\357S\2vaO\257s\27;\2\231\262\7hP\3618p \15\273\3\2248\226\360\2\343[\4(\204]\3\351\31[\2667\24_\10'\27\225\226\17\27\37 (\251\332M", ) , ) == 0x0
 01001   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "cN\30!,;#\264\232\3vBAT\13D\24\1ct@Ndt\24gA\14\310e\315\4\248#\220\254K\227<\203$\\310?H\351^a\234\210\233BX#\364C\311e(|I\14\240\250^T\5s\37\310\3\1\253JD\5C\30\316\7\311\313H\1\3e\30\0>$\313\242*\330\7\320\322\212A*\200\220\204D\372\4\231\200\313\11: EV\7\331\353.M,w\4\306\13\344L\201C@7\3\366\310Z+C\214\13|h@N\232\24\1\234\254\220\227\361J\7O\246\357Q]\326*{/Q\274\363\227\3%\260l\0O\277O!\233`\337D\24D4\10K\6\354e\13D\20#8\263\27\311\215\204C\22\24D\344\323\14x\4\22SE\10\273\119\225\234S5E8\35\302P\330S\34ox3\14\227=\204\224_\313E\250_Ta\274\310v/U\10\363E\330o\321\267\314tU\303\217\174t/9\221_E\374F\30o\224J\232-\221#H\270\207\200\220\33l\3w\356\272Mp\233WG\30\3g\7\246` \271\1\202'\1\271h\3\371 \371\0\234\0W8\217\375\6\344\0Q\340\2i\262Pr\3UdfT\24\317pT\0 \202*\270\331\256\27R8\20\344wV\311&\7\30\26P\21wV\1\265\316\21\27\373s\300\354\254\12=\347?S`\20\20\222\1E0\224PT\340\376?S\310\21o\351\272\354\204\346\13TR\2\337\\313\30 \261\226\334\333\3\216p\1\22\353\2\313G\274\367*\371|\4\0G\330H\24#J.CI\2708Y\310\6\244\12\30\\242\4\373\14\2Mu\20\257H\3d\2\242\246Xhk\345gp\33\31\344\3\257,\311\3609\367\4\4\23\220\2\3\322\15\4\266\14\0\0\10\34\3\312\2264\3@ \23\275\205M", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 01002   896   NtReadFile  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (108, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\241TO\2149\10O\205\260ED\27\373/\238j5\272RV\263\11\210\313\252\|\361x\301\11\33J\317\346 \324\232h\315\33r\330+%\357F\320\350\23\15_\37$\3017\24\207\17\7\36\31\21\377\2\3k\30149A&\25\213ks\207U\345\330\362\327aT\314T+0x\351\214\31\252O\2019\266\264\301\204\259@\207\315tv\265\32\207\262\33TP\21\213$\307\315q&\22\263\3271\304@C\32\331\14\362\331M\226\23\Q\13\37T\234@+Q\325\261b\17\336|_\36V\221\14\217Z\20\234\5\14\360\206\327\355\11r\37\3B\374\27A\357\214\30\231\217\305V\17\261\277>\3\203Z\325\35\20\261\357y\3643\226\365\211\1\2453\26\237\232M\14\35gn\353\254\26\304\11U0Os\372:%\266\2IqY\267&8\20\340`\17\5\210\36v\370\211\35\224\352,\240\220:70DBk\36\13\203\2[M=Es\2?\320 d>\177K\6}\260\317\11-\37\335\242P2A#b\11]=\323\330\307\5\332\201\2748+\17F\263>[+\242\321\6\311\260(=j\26\0\14Y\234mqd;\377v\23\20\267\7\374\10[\247g$\2273NIs\2144\45$/\232\26oNn6\374?\300\270uo\211\248\206\214\342dK\2\307\32|\250#\326\7\337g\335\301-4a=\236~B\16\21?\12P\22y\30\31@DF\355C\361\36\355\14\346\252W\322\213\266\14\344V\203Y\370\277\31\16\271\15\354%\246\33\375\336\10`\224F\352xW67t\300)\31\351\345A7L\237\340Z(\36\315\27\203\342\2YEcs/\20\256N\303F\251hp\216\7\237*-\255\1\23v\342\11\334#\314\226\366\310S\2242I\207\222\372\246;\20\314\4\5x\215\356I\4", ) , ) == 0x0
 01003   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237) (112, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 01004   896   NtReadFile  (108, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048},  (108, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "{__\0k__\0_O_\0OO_\0\337}_\0\317}_\0?~_\07~_\0/~_\0'~_\0\37~_\0\27~_\0\17~_\0\7~_\0\177~_\0w~_\0\233~_\0\217~_\0\343~_\0'\177_\0k\177_\0\223\177_\0\353\177_\0+x_\0\253x_\0\323x_\0\277z_\0\313{_\0\13d_\0/e_\0\233e_\0Og_\0Ga_\0\177c_\0\23l_\0\363l_\0sm_\0\263m_\0Gn_\0\247n_\0\373n_\0\313n_\0\243WZ\0\333WZ\0\354=X\0\320=X\09>X\0!>X\0\17>X\0u>X\0R>X\0\277>X\0\233>X\0\202>X\0\357>X\0\323>X\0\305>X\0)?X\0\23?X\0z?X\0k?X\0F?X\0\255?X\0\214?X\0\352?X\0\303?X\0 8X\0q8X\0T8X\0\2518X\0\3728X\0\3328X\0?9X\0\29X\0\9X\0G9X\0\2519X\0\2219X\0\3739X\0\3559X\0\3279X\0::X\0!:X\0\24:X\0\177:X\0e:X\0B:X\0\277:X\0\261:X\0\250:X\0\244:X\0'\24I\0,\24F\0/\24G\0.\24E\0?\24\\03\24X\0=\24Z\0\20\24D\0&\24A\0\37\24\177\0\23\24u\0\22\24~\0\30\24}\0$\24z\0\35\24x\0(\24N\0)\24S\0+\24Q\04\24R\00\24U\02\24s\0;\24]\0:\24q\0\26\24_\0;\24_\0;\24_\0;\24_@\37l/$\12&\21mNp/@oZ\22U\177D_@\37l/$\12!\21m", ) , ) == 0x0
 01005   896   NtWriteFile  (112, 0, 0, 0,  (112, 0, 0, 0, "@K\0\0PK\0\0d[\0\0t[\0\0\344i\0\0\364i\0\0\4j\0\0\14j\0\0\24j\0\0\34j\0\0$j\0\0,j\0\04j\0\0\0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) \0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) == 0x0
 01006   896   NtClose  (112, ... ) == 0x0
 01007   896   NtClose  (108, ... ) == 0x0
 01008   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.tmp"}, 1242360, ... ) }, 1242360, ... ) == 0x0
 01009   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.tmp"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 01010   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 112, ) == 0x0
 01011   896   NtClose  (108, ... ) == 0x0
 01012   896   NtMapViewOfSection  (112, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xab0000), 0x0, 176128, ) == 0x0
 01013   896   NtClose  (112, ... ) == 0x0
 01014   896   NtUnmapViewOfSection  (-1, 0xab0000, ... ) == 0x0
 01015   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 01016   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 01017   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.tmp"}, 5, 96, ... 112, {status=0x0, info=1}, ) }, 5, 96, ... 112, {status=0x0, info=1}, ) == 0x0
 01018   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 112, ... 108, ) == 0x0
 01019   896   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01020   896   NtClose  (112, ... ) == 0x0
 01021   896   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0xab0000), 0x0, 471040, ) == STATUS_IMAGE_NOT_AT_BASE
 01022   896   NtMapViewOfSection  (108, -1, (0xab0000), 0, 0, 0x0, 471040, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 01023   896   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 01024   896   NtClose  (108, ... ) == 0x0
 01025   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 8, ) == 0x0
 01026   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 8, ... (0xb22000), 4096, 4, ) == 0x0
 01027   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01028   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01029   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01030   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01031   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.DLL"}, ... 108, ) }, ... 108, ) == 0x0
 01032   896   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 01033   896   NtClose  (108, ... ) == 0x0
 01034   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01035   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01036   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01037   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01038   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01039   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01040   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01041   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01042   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01043   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01044   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01045   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01046   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01047   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01048   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01049   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01050   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01051   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01052   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01053   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01054   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01055   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.DLL"}, ... 108, ) }, ... 108, ) == 0x0
 01056   896   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 73728, ) == 0x0
 01057   896   NtClose  (108, ... ) == 0x0
 01058   896   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 01059   896   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 01060   896   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 01061   896   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 01062   896   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 01063   896   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 01064   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01065   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01066   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01067   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01068   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01069   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01070   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01071   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01072   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01073   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01074   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01075   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01076   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01077   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01078   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == 0x0
 01079   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 01080   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 112, ) == 0x0
 01081   896   NtQuerySection  (112, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01082   896   NtClose  (108, ... ) == 0x0
 01083   896   NtMapViewOfSection  (112, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0
 01084   896   NtClose  (112, ... ) == 0x0
 01085   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01086   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1241056, ... ) }, 1241056, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01087   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1241056, ... ) }, 1241056, ... ) == 0x0
 01088   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 112, {status=0x0, info=1}, ) }, 5, 96, ... 112, {status=0x0, info=1}, ) == 0x0
 01089   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 112, ... 108, ) == 0x0
 01090   896   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01091   896   NtClose  (112, ... ) == 0x0
 01092   896   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 01093   896   NtClose  (108, ... ) == 0x0
 01094   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 01095   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 01096   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 01097   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01098   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1240240, ... ) }, 1240240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01099   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1240240, ... ) }, 1240240, ... ) == 0x0
 01100   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 01101   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 112, ) == 0x0
 01102   896   NtQuerySection  (112, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01103   896   NtClose  (108, ... ) == 0x0
 01104   896   NtMapViewOfSection  (112, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 01105   896   NtClose  (112, ... ) == 0x0
 01106   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 01107   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 01108   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 01109   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 01110   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 01111   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 01112   896   NtProtectVirtualMemory  (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0
 01113   896   NtProtectVirtualMemory  (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0
 01114   896   NtFlushInstructionCache  (-1, 1907167232, 52, ... ) == 0x0
 01115   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01116   896   NtProtectVirtualMemory  (-1, (0xb22000), 4096, 4, ... (0xb22000), 4096, 4, ) == 0x0
 01117   896   NtFlushInstructionCache  (-1, 11673600, 4096, ... ) == 0x0
 01118   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMCTL32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01119   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01120   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11075584, 65536, ) == 0x0
 01121   896   NtAllocateVirtualMemory  (-1, 11075584, 0, 4096, 4096, 4, ... 11075584, 4096, ) == 0x0
 01122   896   NtAllocateVirtualMemory  (-1, 11079680, 0, 8192, 4096, 4, ... 11079680, 8192, ) == 0x0
 01123   896   NtAllocateVirtualMemory  (-1, 11087872, 0, 4096, 4096, 4, ... 11087872, 4096, ) == 0x0
 01124   896   NtAllocateVirtualMemory  (-1, 11091968, 0, 4096, 4096, 4, ... 11091968, 4096, ) == 0x0
 01125   896   NtQueryDefaultUILanguage  (1240988, ...
 01126   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01127   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482756, ) == 0x0
 01128   896   NtQueryInformationToken  (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01129   896   NtClose  (-2147482756, ... ) == 0x0
 01130   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 01131   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x240, 0, 0,  (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01132   896   NtOpenKey  (0x80000000, {24, -2147482756, 0x640, 0, 0,  (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01133   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01134   896   NtClose  (-2147481452, ... ) == 0x0
 01135   896   NtClose  (-2147482756, ... ) == 0x0
 01125   896   NtQueryDefaultUILanguage  ... ) == 0x0
 01136   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL"}, 1, 96, ... 112, {status=0x0, info=1}, ) }, 1, 96, ... 112, {status=0x0, info=1}, ) == 0x0
 01137   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 112, ... 108, ) == 0x0
 01138   896   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xb30000), 0x0, 618496, ) == 0x0
 01139   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01140   896   NtQueryDefaultLocale  (1, 1239084, ... ) == 0x0
 01141   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01142   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844}  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1p\0\0\0\377\377\377\377\0\0\0\0\340q\272\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81843, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1p\0\0\0\377\377\377\377\0\0\0\0\340q\272\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81843, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1p\0\0\0\377\377\377\377\0\0\0\0\340q\272\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81843, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1p\0\0\0\377\377\377\377\0\0\0\0\340q\272\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" )  ) == 0x0
 01143   896   NtClose  (112, ... ) == 0x0
 01144   896   NtClose  (108, ... ) == 0x0
 01145   896   NtUnmapViewOfSection  (-1, 0xb30000, ... ) == 0x0
 01146   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01147   896   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 108, ) == 0x0
 01148   896   NtQueryInformationProcess  (108, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01149   896   NtClose  (108, ... ) == 0x0
 01150   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01151   896   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 01152   896   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 01153   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01154   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 01155   896   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01156   896   NtClose  (108, ... ) == 0x0
 01157   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 108, ) }, ... 108, ) == 0x0
 01158   896   NtOpenProcessToken  (-1, 0x8, ... 112, ) == 0x0
 01159   896   NtAccessCheck  (1354432, 112, 0x1, 1242180, 1242232, 56, 1242212, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01160   896   NtClose  (112, ... ) == 0x0
 01161   896   NtOpenKey  (0x20019, {24, 108, 0x40, 0, 0,  (0x20019, {24, 108, 0x40, 0, 0, "Control Panel\Desktop"}, ... 112, ) }, ... 112, ) == 0x0
 01162   896   NtQueryValueKey  (112,  (112, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01163   896   NtClose  (112, ... ) == 0x0
 01164   896   NtUserSystemParametersInfo  (41, 500, 1242360, 0, ... ) == 0x1
 01165   896   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 01166   896   NtClose  (108, ... ) == 0x0
 01167   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01168   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01169   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c03b
 01170   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c03d
 01171   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01172   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c03f
 01173   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01174   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c041
 01175   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01176   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c043
 01177   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c045
 01178   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01179   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c047
 01180   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01181   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c049
 01182   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01183   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c04b
 01184   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01185   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c04d
 01186   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01187   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c04f
 01188   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c051
 01189   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01190   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c053
 01191   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 01192   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c055
 01193   896   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 01194   896   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8177c057
 01195   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01196   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c059
 01197   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10013
 01198   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c05b
 01199   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01200   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c05d
 01201   896   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 01202   896   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8177c05f
 01203   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPR.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01204   896   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 108, ) == 0x0
 01205   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 112, ) == 0x0
 01206   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 116, ) }, ... 116, ) == 0x0
 01207   896   NtNotifyChangeKey  (116, 112, 0, 0, 2011455960, 4, 0, 0, 0, 1, ... ) == 0x103
 01208   896   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 01209   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 120, ) == 0x0
 01210   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 124, ) == 0x0
 01211   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01213   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01214   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01215   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01216   896   NtQueryPerformanceCounter  (... {-1448789738, 16}, {3579545, 0}, ) == 0x0
 01217   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jbe3.tmp"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   896   NtUserCallOneParam  (0, 41, ... ) == 0x4
 01219   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 8192, 4096, 4, ... 1359872, 8192, ) == 0x0
 01220   896   NtQueryVirtualMemory  (-1, 0x12f630, Basic, 28, ... {BaseAddress=0x12f000,AllocationBase=0x30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01221   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 12451840, 1048576, ) == 0x0
 01222   896   NtAllocateVirtualMemory  (-1, 12451840, 0, 16384, 4096, 4, ... 12451840, 16384, ) == 0x0
 01223   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 01224   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 01225   896   NtOpenKey  (0xf003f, {24, 104, 0x40, 0, 0,  (0xf003f, {24, 104, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01226   896   NtOpenKey  (0xf003f, {24, 104, 0x40, 0, 0,  (0xf003f, {24, 104, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01227   896   NtOpenProcessToken  (-1, 0x8, ... 128, ) == 0x0
 01228   896   NtQueryInformationToken  (128, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 01229   896   NtClose  (128, ... ) == 0x0
 01230   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.ENU"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01231   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.ENU"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01232   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.ENU.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01233   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.EN"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01234   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.EN"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01235   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\jbe3.EN.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01236   896   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 128, ) == 0x0
 01237   896   NtUserGetDC  (0, ... ) == 0x1010052
 01238   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01239   896   NtUserGetDC  (0, ... ) == 0x1010052
 01240   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01241   896   NtGdiCreatePaletteInternal  (1241804, 16, ... ) == 0x64080596
 01242   896   NtGdiGetStockObject  (7, ... ) == 0x1b00017
 01243   896   NtGdiGetStockObject  (5, ... ) == 0x1900015
 01244   896   NtUserFindExistingCursorIcon  (1242168, 1242184, 1242232, ... ) == 0x10003
 01245   896   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 01246   896   NtAddAtom  ( ("D\0e\0l\0p\0h\0i\00\00\00\00\00\04\0E\04\0", 28, 1242732, ... ) , 28, 1242732, ... ) == 0x0
 01247   896   NtAddAtom  ( ("C\0o\0n\0t\0r\0o\0l\0O\0f\0s\00\00\0A\0B\00\00\00\00\00\00\00\00\00\03\08\00\0", 52, 1242732, ... ) , 52, 1242732, ... ) == 0x0
 01248   896   NtUserSystemParametersInfo  (104, 0, 12459588, 0, ... ) == 0x1
 01249   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01250   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10023
 01251   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01252   896   NtUserGetDC  (0, ... ) == 0x1010052
 01253   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xc9050697
 01254   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01255   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0x185000f
 01256   896   NtGdiGetDCforBitmap  (-922417513, ... ) == 0x860107ab
 01257   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01258   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0xc9050697
 01259   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01260   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01261   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11613708, 1367560, 0, 256, 48, 1, 0, ... ) == 0x40
 01262   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01263   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0xc9050697
 01264   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01265   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc9050697
 01266   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xba0106e8
 01267   896   NtGdiExtGetObjectW  (-922417513, 24, 1241212, ... ) == 0x18
 01268   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x710504dc
 01269   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0x185000f
 01270   896   NtGdiSelectBitmap  (-1174337816, 1896154332, ... ) == 0x185000f
 01271   896   NtGdiBitBlt  (-1174337816, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01272   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc9050697
 01273   896   NtGdiSelectBitmap  (-1174337816, 25493519, ... ) == 0x710504dc
 01274   896   NtGdiDeleteObjectApp  (-922417513, ... ) == 0x1
 01275   896   NtGdiDeleteObjectApp  (-1174337816, ... ) == 0x1
 01276   896   NtUserCallOneParam  (0, 33, ... ) == 0x2007009d
 01277   896   NtUserSetCursorIconData  (537329821, 1241316, 1241332, 1241396, ... ) == 0x1
 01278   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10029
 01279   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10027
 01280   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10025
 01281   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01282   896   NtUserGetDC  (0, ... ) == 0x1010052
 01283   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x750505de
 01284   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01285   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x185000f
 01286   896   NtGdiGetDCforBitmap  (1963263454, ... ) == 0x860107ab
 01287   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01288   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x750505de
 01289   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01290   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01291   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11614016, 1367560, 0, 256, 48, 1, 0, ... ) == 0x40
 01292   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01293   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x750505de
 01294   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01295   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x750505de
 01296   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xcb010697
 01297   896   NtGdiExtGetObjectW  (1963263454, 24, 1241212, ... ) == 0x18
 01298   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x160506c8
 01299   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x185000f
 01300   896   NtGdiSelectBitmap  (-889125225, 369428168, ... ) == 0x185000f
 01301   896   NtGdiBitBlt  (-889125225, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01302   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x750505de
 01303   896   NtGdiSelectBitmap  (-889125225, 25493519, ... ) == 0x160506c8
 01304   896   NtGdiDeleteObjectApp  (1963263454, ... ) == 0x1
 01305   896   NtGdiDeleteObjectApp  (-889125225, ... ) == 0x1
 01306   896   NtUserCallOneParam  (0, 33, ... ) == 0x1580153
 01307   896   NtUserSetCursorIconData  (22544723, 1241316, 1241332, 1241396, ... ) == 0x1
 01308   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01309   896   NtUserGetDC  (0, ... ) == 0x1010052
 01310   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xbc0506e8
 01311   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01312   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0x185000f
 01313   896   NtGdiGetDCforBitmap  (-1140521240, ... ) == 0x860107ab
 01314   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01315   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0xbc0506e8
 01316   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01317   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01318   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11614324, 1367560, 0, 256, 48, 1, 0, ... ) == 0x40
 01319   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01320   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0xbc0506e8
 01321   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01322   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xbc0506e8
 01323   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0x770105de
 01324   896   NtGdiExtGetObjectW  (-1140521240, 24, 1241212, ... ) == 0x18
 01325   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x2a050554
 01326   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0x185000f
 01327   896   NtGdiSelectBitmap  (1996555742, 704972116, ... ) == 0x185000f
 01328   896   NtGdiBitBlt  (1996555742, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01329   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xbc0506e8
 01330   896   NtGdiSelectBitmap  (1996555742, 25493519, ... ) == 0x2a050554
 01331   896   NtGdiDeleteObjectApp  (-1140521240, ... ) == 0x1
 01332   896   NtGdiDeleteObjectApp  (1996555742, ... ) == 0x1
 01333   896   NtUserCallOneParam  (0, 33, ... ) == 0x250297
 01334   896   NtUserSetCursorIconData  (2425495, 1241316, 1241332, 1241396, ... ) == 0x1
 01335   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01336   896   NtUserGetDC  (0, ... ) == 0x1010052
 01337   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xcd050697
 01338   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01339   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0x185000f
 01340   896   NtGdiGetDCforBitmap  (-855308649, ... ) == 0x860107ab
 01341   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01342   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0xcd050697
 01343   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01344   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01345   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11614632, 1367560, 0, 256, 48, 1, 0, ... ) == 0x40
 01346   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01347   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0xcd050697
 01348   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01349   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xcd050697
 01350   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xbe0106e8
 01351   896   NtGdiExtGetObjectW  (-855308649, 24, 1241212, ... ) == 0x18
 01352   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x6905057d
 01353   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0x185000f
 01354   896   NtGdiSelectBitmap  (-1107228952, 1761936765, ... ) == 0x185000f
 01355   896   NtGdiBitBlt  (-1107228952, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01356   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xcd050697
 01357   896   NtGdiSelectBitmap  (-1107228952, 25493519, ... ) == 0x6905057d
 01358   896   NtGdiDeleteObjectApp  (-855308649, ... ) == 0x1
 01359   896   NtGdiDeleteObjectApp  (-1107228952, ... ) == 0x1
 01360   896   NtUserCallOneParam  (0, 33, ... ) == 0x2c0293
 01361   896   NtUserSetCursorIconData  (2884243, 1241316, 1241332, 1241396, ... ) == 0x1
 01362   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01363   896   NtUserGetDC  (0, ... ) == 0x1010052
 01364   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x790505de
 01365   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01366   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x185000f
 01367   896   NtGdiGetDCforBitmap  (2030372318, ... ) == 0x860107ab
 01368   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01369   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x790505de
 01370   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01371   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01372   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11614940, 1367560, 0, 256, 48, 1, 0, ... ) == 0x40
 01373   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01374   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x790505de
 01375   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01376   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x790505de
 01377   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xcf010697
 01378   896   NtGdiExtGetObjectW  (2030372318, 24, 1241212, ... ) == 0x18
 01379   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xcf0506b6
 01380   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x185000f
 01381   896   NtGdiSelectBitmap  (-822016361, -821754186, ... ) == 0x185000f
 01382   896   NtGdiBitBlt  (-822016361, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01383   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x790505de
 01384   896   NtGdiSelectBitmap  (-822016361, 25493519, ... ) == 0xcf0506b6
 01385   896   NtGdiDeleteObjectApp  (2030372318, ... ) == 0x1
 01386   896   NtGdiDeleteObjectApp  (-822016361, ... ) == 0x1
 01387   896   NtUserCallOneParam  (0, 33, ... ) == 0x19018f
 01388   896   NtUserSetCursorIconData  (1638799, 1241316, 1241332, 1241396, ... ) == 0x1
 01389   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01390   896   NtUserGetDC  (0, ... ) == 0x1010052
 01391   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xc00506e8
 01392   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01393   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0x185000f
 01394   896   NtGdiGetDCforBitmap  (-1073412376, ... ) == 0x860107ab
 01395   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01396   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0xc00506e8
 01397   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01398   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01399   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11615556, 1367560, 0, 256, 48, 1, 0, ... ) == 0x40
 01400   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01401   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0xc00506e8
 01402   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01403   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc00506e8
 01404   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0x7b0105de
 01405   896   NtGdiExtGetObjectW  (-1073412376, 24, 1241212, ... ) == 0x18
 01406   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x220505f7
 01407   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0x185000f
 01408   896   NtGdiSelectBitmap  (2063664606, 570754551, ... ) == 0x185000f
 01409   896   NtGdiBitBlt  (2063664606, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01410   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc00506e8
 01411   896   NtGdiSelectBitmap  (2063664606, 25493519, ... ) == 0x220505f7
 01412   896   NtGdiDeleteObjectApp  (-1073412376, ... ) == 0x1
 01413   896   NtGdiDeleteObjectApp  (2063664606, ... ) == 0x1
 01414   896   NtUserCallOneParam  (0, 33, ... ) == 0x4b01ff
 01415   896   NtUserSetCursorIconData  (4915711, 1241316, 1241332, 1241396, ... ) == 0x1
 01416   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01417   896   NtUserGetDC  (0, ... ) == 0x1010052
 01418   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xd1050697
 01419   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01420   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0x185000f
 01421   896   NtGdiGetDCforBitmap  (-788199785, ... ) == 0x860107ab
 01422   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01423   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0xd1050697
 01424   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01425   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01426   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11615248, 1367560, 0, 256, 48, 1, 0, ... ) == 0x40
 01427   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01428   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0xd1050697
 01429   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01430   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xd1050697
 01431   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xc20106e8
 01432   896   NtGdiExtGetObjectW  (-788199785, 24, 1241212, ... ) == 0x18
 01433   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xce0506aa
 01434   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0x185000f
 01435   896   NtGdiSelectBitmap  (-1040120088, -838531414, ... ) == 0x185000f
 01436   896   NtGdiBitBlt  (-1040120088, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01437   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xd1050697
 01438   896   NtGdiSelectBitmap  (-1040120088, 25493519, ... ) == 0xce0506aa
 01439   896   NtGdiDeleteObjectApp  (-788199785, ... ) == 0x1
 01440   896   NtGdiDeleteObjectApp  (-1040120088, ... ) == 0x1
 01441   896   NtUserCallOneParam  (0, 33, ... ) == 0x450281
 01442   896   NtUserSetCursorIconData  (4522625, 1241316, 1241332, 1241396, ... ) == 0x1
 01443   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10015
 01444   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10019
 01445   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001f
 01446   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001b
 01447   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10021
 01448   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001d
 01449   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10013
 01450   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10017
 01451   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01452   896   NtUserCallOneParam  (0, 40, ... ) == 0x4090409
 01453   896   NtUserGetDC  (0, ... ) == 0x1010052
 01454   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01455   896   NtUserEnumDisplayMonitors  (0, 0, 11338340, 12460168, ... ) == 0x1
 01456   896   NtUserSystemParametersInfo  (31, 60, 1241032, 0, ... ) == 0x1
 01457   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1354504, ... ) == 0xc30a06e8
 01458   896   NtGdiExtGetObjectW  (-1022753048, 420, 1241736, ... ) == 0x164
 01459   896   NtUserSystemParametersInfo  (41, 0, 1241232, 0, ... ) == 0x1
 01460   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1354496, ... ) == 0x7d0a05de
 01461   896   NtGdiExtGetObjectW  (2097808862, 420, 1241736, ... ) == 0x164
 01462   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1354488, ... ) == 0xd20a0697
 01463   896   NtGdiExtGetObjectW  (-771094889, 420, 1241736, ... ) == 0x164
 01464   896   NtUserFindExistingCursorIcon  (1241812, 1241828, 1241876, ... ) == 0x0
 01465   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 11730944, 4096, ) == 0x0
 01466   896   NtUserGetKeyboardLayoutList  (64, 1242400, ... ) == 0x1
 01467   896   NtUserRegisterWindowMessage  ( ("Delphi Picture", ... ) , ... ) == 0xc13a
 01468   896   NtUserRegisterWindowMessage  ( ("Delphi Component", ... ) , ... ) == 0xc13b
 01469   896   NtOpenMutant  (0x1f0001, {24, 48, 0x0, 0, 0,  (0x1f0001, {24, 48, 0x0, 0, 0, "Residented"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01470   896   NtUserSetWindowsHookEx  (11206656, 1243784, 0, 4, 11214524, 2, ... ) == 0x5a01d7
 01471   896   NtAllocateVirtualMemory  (-1, 0, 0, 6144, 4096, 4, ... 11796480, 8192, ) == 0x0
 01472   896   NtAllocateVirtualMemory  (-1, 0, 0, 28566, 4096, 4, ... 11862016, 28672, ) == 0x0
 01473   896   NtFreeVirtualMemory  (-1, (0xb50000), 0, 32768, ... (0xb50000), 28672, ) == 0x0
 01474   896   NtAllocateVirtualMemory  (-1, 0, 0, 46502, 4096, 4, ... 11862016, 49152, ) == 0x0
 01475   896   NtFreeVirtualMemory  (-1, (0xb50000), 0, 32768, ... (0xb50000), 49152, ) == 0x0
 01476   896   NtAllocateVirtualMemory  (-1, 0, 0, 4358, 4096, 4, ... 11862016, 8192, ) == 0x0
 01477   896   NtFreeVirtualMemory  (-1, (0xb50000), 0, 32768, ... (0xb50000), 8192, ) == 0x0
 01478   896   NtFreeVirtualMemory  (-1, (0xb40000), 0, 32768, ... (0xb40000), 8192, ) == 0x0
 01479   896   NtOpenMutant  (0x1f0001, {24, 48, 0x0, 0, 0,  (0x1f0001, {24, 48, 0x0, 0, 0, "KKQHOOK_28"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01480   896   NtCreateFile  (0x80100081, {24, 0, 0x40, 0, 1242996,  (0x80100081, {24, 0, 0x40, 0, 1242996, "\??\C:\WINDOWS\system32\drivers\ndisrd.sys"}, 0x0, 0, 0, 1, 96, 0, 0, ... ) }, 0x0, 0, 0, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01481   896   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1242440,  (0x40100080, {24, 0, 0x40, 0, 1242440, "\??\c:\boot.sys"}, 0x0, 0, 0, 5, 96, 0, 0, ... }, 0x0, 0, 0, 5, 96, 0, 0, ...
 01482   896   NtClose  (-2147482756, ... ) == 0x0
 01481   896   NtCreateFile  ... 132, {status=0x0, info=2}, ) == 0x0
 01483   896   NtWriteFile  (132, 0, 0, 0,  (132, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\310\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0\362\210\312A\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0@\0\0\0\20\0\0\0P\0\0 \230\0\0\0`\0\0\0\240\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\240\0\0\330\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0\340UPX1\0\0\0\0\0@\0\0", 16385, 0x0, 0, ... , 16385, 0x0, 0, ...
 01484   896   NtContinue  (-135750188, 0, ...
 01483   896   NtWriteFile  ... {status=0x0, info=16385}, ) == 0x0
 01485   896   NtCreateFile  (0x80100081, {24, 0, 0x40, 0, 1241876,  (0x80100081, {24, 0, 0x40, 0, 1241876, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 0, 0, 1, 96, 0, 0, ... 136, {status=0x0, info=1}, ) }, 0x0, 0, 0, 1, 96, 0, 0, ... 136, {status=0x0, info=1}, ) == 0x0
 01486   896   NtQueryInformationFile  (136, 1241928, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01487   896   NtSetInformationFile  (132, 1241928, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01488   896   NtClose  (136, ... ) == 0x0
 01489   896   NtClose  (132, ... ) == 0x0
 01490   896   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.pif"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01491   896   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 01492   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1238732, ... ) }, 1238732, ... ) == 0x0
 01493   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1239468, ... ) }, 1239468, ... ) == 0x0
 01494   896   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01495   896   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 132, ... 136, ) == 0x0
 01496   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01497   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 140, ) }, ... 140, ) == 0x0
 01498   896   NtQueryValueKey  (140,  (140, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01499   896   NtClose  (140, ... ) == 0x0
 01500   896   NtQueryVolumeInformationFile  (132, 1238744, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01501   896   NtOpenMutant  (0x120001, {24, 48, 0x0, 0, 0,  (0x120001, {24, 48, 0x0, 0, 0, "ShimCacheMutex"}, ... 140, ) }, ... 140, ) == 0x0
 01502   896   NtWaitForSingleObject  (140, 0, {-1000000, -1}, ... ) == 0x0
 01503   896   NtOpenSection  (0x2, {24, 48, 0x0, 0, 0,  (0x2, {24, 48, 0x0, 0, 0, "ShimSharedMemory"}, ... 144, ) }, ... 144, ) == 0x0
 01504   896   NtMapViewOfSection  (144, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xb40000), {0, 0}, 57344, ) == 0x0
 01505   896   NtReleaseMutant  (140, ... 0x0, ) == 0x0
 01506   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1236676, ... ) }, 1236676, ... ) == 0x0
 01507   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 01508   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 148, ... 152, ) == 0x0
 01509   896   NtClose  (148, ... ) == 0x0
 01510   896   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb50000), 0x0, 126976, ) == 0x0
 01511   896   NtClose  (152, ... ) == 0x0
 01512   896   NtUnmapViewOfSection  (-1, 0xb50000, ... ) == 0x0
 01513   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1236984, ... ) }, 1236984, ... ) == 0x0
 01514   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 01515   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 152, ... 148, ) == 0x0
 01516   896   NtQuerySection  (148, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01517   896   NtClose  (152, ... ) == 0x0
 01518   896   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 01519   896   NtClose  (148, ... ) == 0x0
 01520   896   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 01521   896   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 01522   896   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 01523   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01524   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 01525   896   NtQueryInformationFile  (148, 1237000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01526   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 148, ... 152, ) == 0x0
 01527   896   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xce0000), 0x0, 1191936, ) == 0x0
 01528   896   NtQueryInformationFile  (148, 1237100, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01529   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01530   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01531   896   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 01532   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01533   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 156, ) }, ... 156, ) == 0x0
 01534   896   NtQueryValueKey  (156,  (156, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (156, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01535   896   NtClose  (156, ... ) == 0x0
 01536   896   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01537   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01538   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1234696, 616, BothDirectory, 1,  (156, 0, 0, 0, 1234696, 616, BothDirectory, 1, "cmd.exe", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01539   896   NtClose  (156, ... ) == 0x0
 01540   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01541   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01542   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1235072, ... ) }, 1235072, ... ) == 0x0
 01543   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01544   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1234500, 616, BothDirectory, 1,  (156, 0, 0, 0, 1234500, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01545   896   NtClose  (156, ... ) == 0x0
 01546   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01547   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1234500, 616, BothDirectory, 1,  (156, 0, 0, 0, 1234500, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01548   896   NtClose  (156, ... ) == 0x0
 01549   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01550   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1234500, 616, BothDirectory, 1,  (156, 0, 0, 0, 1234500, 616, BothDirectory, 1, "cmd.exe", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01551   896   NtClose  (156, ... ) == 0x0
 01552   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01553   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01554   896   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01555   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01556   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01557   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01558   896   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01559   896   NtClose  (156, ... ) == 0x0
 01560   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01561   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\cmd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01562   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1235908, ... ) }, 1235908, ... ) == 0x0
 01563   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "VERSION.dll"}, ... 156, ) }, ... 156, ) == 0x0
 01564   896   NtMapViewOfSection  (156, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 32768, ) == 0x0
 01565   896   NtClose  (156, ... ) == 0x0
 01566   896   NtProtectVirtualMemory  (-1, (0x77c01000), 304, 4, ... (0x77c01000), 4096, 32, ) == 0x0
 01567   896   NtProtectVirtualMemory  (-1, (0x77c01000), 4096, 32, ... (0x77c01000), 4096, 4, ) == 0x0
 01568   896   NtFlushInstructionCache  (-1, 2009075712, 304, ... ) == 0x0
 01569   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01570   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01571   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01572   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1234772, ... ) }, 1234772, ... ) == 0x0
 01573   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 5, 96, ... 156, {status=0x0, info=1}, ) }, 5, 96, ... 156, {status=0x0, info=1}, ) == 0x0
 01574   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 156, ... 160, ) == 0x0
 01575   896   NtClose  (156, ... ) == 0x0
 01576   896   NtMapViewOfSection  (160, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb50000), 0x0, 389120, ) == 0x0
 01577   896   NtClose  (160, ... ) == 0x0
 01578   896   NtUnmapViewOfSection  (-1, 0xb50000, ... ) == 0x0
 01579   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1234368, ... ) }, 1234368, ... ) == 0x0
 01580   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1235112,  (0x80100080, {24, 0, 0x40, 0, 1235112, "\??\C:\WINDOWS\system32\cmd.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 160, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 160, {status=0x0, info=1}, ) == 0x0
 01581   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 160, ... 156, ) == 0x0
 01582   896   NtClose  (160, ... ) == 0x0
 01583   896   NtMapViewOfSection  (156, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xb50000), {0, 0}, 389120, ) == 0x0
 01584   896   NtClose  (156, ... ) == 0x0
 01585   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01586   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01587   896   NtQueryDefaultLocale  (1, 1235732, ... ) == 0x0
 01588   896   NtQueryVirtualMemory  (-1, 0xb50000, Basic, 28, ... {BaseAddress=0xb50000,AllocationBase=0xb50000,AllocationProtect=0x2,RegionSize=0x5f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 01589   896   NtQueryVirtualMemory  (-1, 0xb50000, Basic, 28, ... {BaseAddress=0xb50000,AllocationBase=0xb50000,AllocationProtect=0x2,RegionSize=0x5f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 01590   896   NtUnmapViewOfSection  (-1, 0xb50000, ... ) == 0x0
 01591   896   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ... 1372160, 4096, ) == 0x0
 01592   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01593   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01594   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1234764, ... ) }, 1234764, ... ) == 0x0
 01595   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 5, 96, ... 156, {status=0x0, info=1}, ) }, 5, 96, ... 156, {status=0x0, info=1}, ) == 0x0
 01596   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 156, ... 160, ) == 0x0
 01597   896   NtClose  (156, ... ) == 0x0
 01598   896   NtMapViewOfSection  (160, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb50000), 0x0, 389120, ) == 0x0
 01599   896   NtClose  (160, ... ) == 0x0
 01600   896   NtUnmapViewOfSection  (-1, 0xb50000, ... ) == 0x0
 01601   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1234360, ... ) }, 1234360, ... ) == 0x0
 01602   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1235104,  (0x80100080, {24, 0, 0x40, 0, 1235104, "\??\C:\WINDOWS\system32\cmd.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 160, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 160, {status=0x0, info=1}, ) == 0x0
 01603   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 160, ... 156, ) == 0x0
 01604   896   NtClose  (160, ... ) == 0x0
 01605   896   NtMapViewOfSection  (156, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xb50000), {0, 0}, 389120, ) == 0x0
 01606   896   NtClose  (156, ... ) == 0x0
 01607   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01608   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01609   896   NtQueryDefaultLocale  (1, 1235724, ... ) == 0x0
 01610   896   NtQueryVirtualMemory  (-1, 0xb50000, Basic, 28, ... {BaseAddress=0xb50000,AllocationBase=0xb50000,AllocationProtect=0x2,RegionSize=0x5f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 01611   896   NtUnmapViewOfSection  (-1, 0xb50000, ... ) == 0x0
 01612   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01613   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01614   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01615   896   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01616   896   NtClose  (156, ... ) == 0x0
 01617   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01618   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01619   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01620   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1236324, ... ) }, 1236324, ... ) == 0x0
 01621   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01622   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235752, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235752, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01623   896   NtClose  (156, ... ) == 0x0
 01624   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01625   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235752, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235752, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01626   896   NtClose  (156, ... ) == 0x0
 01627   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01628   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235752, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235752, 616, BothDirectory, 1, "cmd.exe", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01629   896   NtClose  (156, ... ) == 0x0
 01630   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01631   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01632   896   NtWaitForSingleObject  (140, 0, {-1000000, -1}, ... ) == 0x0
 01633   896   NtReleaseMutant  (140, ... 0x0, ) == 0x0
 01634   896   NtUnmapViewOfSection  (-1, 0xce0000, ... ) == 0x0
 01635   896   NtClose  (152, ... ) == 0x0
 01636   896   NtClose  (148, ... ) == 0x0
 01637   896   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 01638   896   NtOpenProcessToken  (-1, 0xa, ... 148, ) == 0x0
 01639   896   NtQueryInformationToken  (148, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 01640   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01641   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 152, ) }, ... 152, ) == 0x0
 01642   896   NtQueryValueKey  (152,  (152, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (152, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01643   896   NtQueryValueKey  (152,  (152, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (152, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01644   896   NtClose  (152, ... ) == 0x0
 01645   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01646   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 152, ) }, ... 152, ) == 0x0
 01647   896   NtQueryValueKey  (152,  (152, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01648   896   NtClose  (152, ... ) == 0x0
 01649   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01650   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01651   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01652   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01653   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01654   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01655   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01656   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01657   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01658   896   NtQueryDefaultLocale  (1, 1238172, ... ) == 0x0
 01659   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 152, ) }, ... 152, ) == 0x0
 01660   896   NtEnumerateKey  (152, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (152, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 01661   896   NtOpenKey  (0x20019, {24, 152, 0x40, 0, 0,  (0x20019, {24, 152, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 156, ) }, ... 156, ) == 0x0
 01662   896   NtQueryValueKey  (156,  (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 01663   896   NtQueryValueKey  (156,  (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01664   896   NtClose  (156, ... ) == 0x0
 01665   896   NtEnumerateKey  (152, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01666   896   NtClose  (152, ... ) == 0x0
 01667   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 152, ) }, ... 152, ) == 0x0
 01668   896   NtEnumerateKey  (152, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (152, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 01669   896   NtOpenKey  (0x20019, {24, 152, 0x40, 0, 0,  (0x20019, {24, 152, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 156, ) }, ... 156, ) == 0x0
 01670   896   NtQueryValueKey  (156,  (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 01671   896   NtQueryValueKey  (156,  (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01672   896   NtQueryValueKey  (156,  (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01673   896   NtQueryValueKey  (156,  (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01674   896   NtClose  (156, ... ) == 0x0
 01675   896   NtEnumerateKey  (152, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (152, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 01676   896   NtOpenKey  (0x20019, {24, 152, 0x40, 0, 0,  (0x20019, {24, 152, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 156, ) }, ... 156, ) == 0x0
 01677   896   NtQueryValueKey  (156,  (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 01678   896   NtQueryValueKey  (156,  (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01679   896   NtQueryValueKey  (156,  (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01680   896   NtQueryValueKey  (156,  (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01681   896   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0
 01682   896   NtClose  (156, ... ) == 0x0
 01683   896   NtEnumerateKey  (152, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (152, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 01684   896   NtOpenKey  (0x20019, {24, 152, 0x40, 0, 0,  (0x20019, {24, 152, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 156, ) }, ... 156, ) == 0x0
 01685   896   NtQueryValueKey  (156,  (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 01686   896   NtQueryValueKey  (156,  (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01687   896   NtQueryValueKey  (156,  (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01688   896   NtQueryValueKey  (156,  (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01689   896   NtClose  (156, ... ) == 0x0
 01690   896   NtEnumerateKey  (152, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (152, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 01691   896   NtOpenKey  (0x20019, {24, 152, 0x40, 0, 0,  (0x20019, {24, 152, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 156, ) }, ... 156, ) == 0x0
 01692   896   NtQueryValueKey  (156,  (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 01693   896   NtQueryValueKey  (156,  (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01694   896   NtQueryValueKey  (156,  (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01695   896   NtQueryValueKey  (156,  (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01696   896   NtClose  (156, ... ) == 0x0
 01697   896   NtEnumerateKey  (152, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (152, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 01698   896   NtOpenKey  (0x20019, {24, 152, 0x40, 0, 0,  (0x20019, {24, 152, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 156, ) }, ... 156, ) == 0x0
 01699   896   NtQueryValueKey  (156,  (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (156, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 01700   896   NtQueryValueKey  (156,  (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01701   896   NtQueryValueKey  (156,  (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (156, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01702   896   NtQueryValueKey  (156,  (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (156, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01703   896   NtClose  (156, ... ) == 0x0
 01704   896   NtEnumerateKey  (152, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01705   896   NtClose  (152, ... ) == 0x0
 01706   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01707   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01708   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01709   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01710   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01711   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01712   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01713   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01714   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01715   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01716   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01717   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01718   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01719   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01720   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01721   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01722   896   NtClose  (152, ... ) == 0x0
 01723   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01724   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01725   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01726   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01727   896   NtClose  (152, ... ) == 0x0
 01728   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01729   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01730   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01731   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01732   896   NtClose  (152, ... ) == 0x0
 01733   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01734   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01735   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01736   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01737   896   NtClose  (152, ... ) == 0x0
 01738   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01739   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01740   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01741   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01742   896   NtClose  (152, ... ) == 0x0
 01743   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01744   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01745   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01746   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01747   896   NtClose  (152, ... ) == 0x0
 01748   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01749   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01750   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01751   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01752   896   NtClose  (152, ... ) == 0x0
 01753   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01754   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01755   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01756   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01757   896   NtClose  (152, ... ) == 0x0
 01758   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01759   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01760   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01761   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01762   896   NtClose  (152, ... ) == 0x0
 01763   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01764   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01765   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01766   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01767   896   NtClose  (152, ... ) == 0x0
 01768   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01769   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01770   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01771   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01772   896   NtClose  (152, ... ) == 0x0
 01773   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01774   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01775   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01776   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01777   896   NtClose  (152, ... ) == 0x0
 01778   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01779   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01780   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01781   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01782   896   NtClose  (152, ... ) == 0x0
 01783   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01784   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01785   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01786   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01787   896   NtClose  (152, ... ) == 0x0
 01788   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01789   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01790   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01791   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01792   896   NtClose  (152, ... ) == 0x0
 01793   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01794   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 152, ) }, ... 152, ) == 0x0
 01795   896   NtQueryValueKey  (152,  (152, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (152, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (152, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 01796   896   NtClose  (152, ... ) == 0x0
 01797   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01798   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01799   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01800   896   NtClose  (152, ... ) == 0x0
 01801   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01802   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 01803   896   NtOpenProcessToken  (-1, 0xa, ... 152, ) == 0x0
 01804   896   NtDuplicateToken  (152, 0xc, {24, 0, 0x0, 0, 1238604, 0x0}, 0, 2, ... 156, ) == 0x0
 01805   896   NtClose  (152, ... ) == 0x0
 01806   896   NtAccessCheck  (1373992, 156, 0x1, 1238680, 1238732, 56, 1238712, ... (0x1), ) == 0x0
 01807   896   NtClose  (156, ... ) == 0x0
 01808   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01809   896   NtQueryValueKey  (156,  (156, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (156, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01810   896   NtClose  (156, ... ) == 0x0
 01811   896   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 156, ) }, ... 156, ) == 0x0
 01812   896   NtQuerySymbolicLinkObject  (156, ...  (156, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 01813   896   NtClose  (156, ... ) == 0x0
 01814   896   NtQueryVolumeInformationFile  (132, 1236436, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01815   896   NtQueryInformationFile  (132, 1236552, 528, Name, ... {status=0x0, info=54}, ) == 0x0
 01816   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01817   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01818   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1235724, ... ) }, 1235724, ... ) == 0x0
 01819   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01820   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235152, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235152, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01821   896   NtClose  (156, ... ) == 0x0
 01822   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01823   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235152, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235152, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01824   896   NtClose  (156, ... ) == 0x0
 01825   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 01826   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235152, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235152, 616, BothDirectory, 1, "cmd.exe", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01827   896   NtClose  (156, ... ) == 0x0
 01828   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01829   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01830   896   NtQueryInformationFile  (132, 1238592, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01831   896   NtCreateSection  (0xf0005, 0x0, {388608, 0}, 2, 134217728, 132, ... 156, ) == 0x0
 01832   896   NtMapViewOfSection  (156, -1, (0x0), 0, 0, {0, 0}, 388608, 1, 0, 2, ... (0xb50000), {0, 0}, 389120, ) == 0x0
 01833   896   NtClose  (156, ... ) == 0x0
 01834   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01835   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01836   896   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01837   896   NtClose  (156, ... ) == 0x0
 01838   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 156, ) }, ... 156, ) == 0x0
 01839   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 152, ) }, ... 152, ) == 0x0
 01840   896   NtClose  (156, ... ) == 0x0
 01841   896   NtQueryValueKey  (152,  (152, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01842   896   NtQueryValueKey  (152,  (152, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (152, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 01843   896   NtClose  (152, ... ) == 0x0
 01844   896   NtUnmapViewOfSection  (-1, 0xb50000, ... ) == 0x0
 01845   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 11862016, 4096, ) == 0x0
 01846   896   NtAllocateVirtualMemory  (-1, 11862016, 0, 4096, 4096, 4, ... 11862016, 4096, ) == 0x0
 01847   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 152, ) }, ... 152, ) == 0x0
 01848   896   NtQueryValueKey  (152,  (152, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01849   896   NtClose  (152, ... ) == 0x0
 01850   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01851   896   NtQueryInformationToken  (148, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 01852   896   NtQueryInformationToken  (148, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 01853   896   NtClose  (148, ... ) == 0x0
 01854   896   NtQuerySection  (136, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01855   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01856   896   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 01857   896   NtCreateProcessEx  (1240516, 2035711, 0, -1, 0, 136, 0, 0, 0, ... ) == 0x0
 01858   896   NtQueryInformationProcess  (148, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=596,ParentPid=1252,}, 0x0, ) == 0x0
 01859   896   NtReadVirtualMemory  (148, 0x7ffd6008, 4, ...  (148, 0x7ffd6008, 4, ... "\0\0\320J", 0x0, ) , 0x0, ) == 0x0
 01860   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01861   896   NtAllocateVirtualMemory  (-1, 1380352, 0, 8192, 4096, 4, ... 1380352, 8192, ) == 0x0
 01862   896   NtReadVirtualMemory  (148, 0x4ad00000, 4096, ...  (148, 0x4ad00000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\35\355\325\352Y\214\273\271Y\214\273\271Y\214\273\271\232\203\264\271_\214\273\271Y\214\272\271\200\214\273\271\232\203\346\271^\214\273\271\346\203\333\271[\214\273\271\232\203\345\271X\214\273\271\232\203\344\271m\214\273\271\232\203\341\271X\214\273\271RichY\214\273\271\0\0\0\0\0\0\0\0PE\0\0L\1\3\0\276~\20A\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0\366\1\0\0\366\3\0\0\0\0\0VP\0\0\0\20\0\0\0\360\1\0\0\0\320J\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\20\6\0\0\4\0\0\224$\6\0\3\0\0\200\0\0\20\0\0\0\20\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\366\1\0P\0\0\0\0\340\3\0\260(\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\5\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\223\1\0H\0\0\0H\2\0\0X\0\0\0\0\20\0\0\0\3\0\0\340\362\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\340\365\1\0\0\20\0\0\0\366\1\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 01863   896   NtReadVirtualMemory  (148, 0x4ad3e000, 256, ...  (148, 0x4ad3e000, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\3\0\0\00\0\0\200\13\0\0\0\200\0\0\200\16\0\0\0\230\0\0\200\20\0\0\0\260\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\1\0\0\0\310\0\0\200\2\0\0\0\340\0\0\200\3\0\0\0\370\0\0\200\4\0\0\0\20\1\0\200\5\0\0\0(\1\0\200\6\0\0\0@\1\0\200\7\0\0\0X\1\0\200\10\0\0\0p\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\1\0\0\0\210\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\200\2\0\200\240\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\1\0\0\0\270\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\4\0\0\320\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\4\0\0\340\1\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 01864   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01865   896   NtQueryInformationProcess  (148, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=596,ParentPid=1252,}, 0x0, ) == 0x0
 01866   896   NtAllocateVirtualMemory  (-1, 0, 0, 2440, 4096, 4, ... 11927552, 4096, ) == 0x0
 01867   896   NtAllocateVirtualMemory  (148, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 01868   896   NtWriteVirtualMemory  (148, 0x10000,  (148, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 01869   896   NtAllocateVirtualMemory  (148, 0, 0, 2440, 4096, 4, ... 131072, 4096, ) == 0x0
 01870   896   NtWriteVirtualMemory  (148, 0x20000,  (148, 0x20000, "\0\20\0\0\210\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0\26\0\10\2\220\2\0\0\0\0\0\0\364\3\366\3\230\4\0\06\08\0\220\10\0\0`\0b\0\310\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\06\08\0,\11\0\0\36\0 \0d\11\0\0\0\0\2\0\204\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2440, ... 0x0, ) , 2440, ... 0x0, ) == 0x0
 01871   896   NtWriteVirtualMemory  (148, 0x7ffd6010,  (148, 0x7ffd6010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01872   896   NtAllocateVirtualMemory  (148, 0, 0, 388, 4096, 4, ... 196608, 4096, ) == 0x0
 01873   896   NtWriteVirtualMemory  (148, 0x30000,  (148, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\1\0\0\253\355\15\254\262=\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 388, ... 0x0, ) , 388, ... 0x0, ) == 0x0
 01874   896   NtWriteVirtualMemory  (148, 0x7ffd61e8,  (148, 0x7ffd61e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01875   896   NtFreeVirtualMemory  (-1, (0xb60000), 0, 32768, ... (0xb60000), 4096, ) == 0x0
 01876   896   NtReadVirtualMemory  (148, 0x7ffd6010, 4, ...  (148, 0x7ffd6010, 4, ... "\0\0\2\0", 0x0, ) , 0x0, ) == 0x0
 01877   896   NtAllocateVirtualMemory  (148, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0
 01878   896   NtAllocateVirtualMemory  (148, 262144, 0, 1048576, 4096, 4, ... 262144, 1048576, ) == 0x0
 01879   896   NtCreateThread  (0x1f03ff, 0x0, 148, 1240524, 1240188, 1, ... 152, {596, 376}, ) == 0x0
 01880   896   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 6619252, 3342445, 6029362, 6619243}  (24, {168, 196, new_msg, 0, 6619252, 3342445, 6029362, 6619243} "\0\0\0\0\0\0\1\03\02\0.\0d\0\224\0\0\0\230\0\0\0T\2\0\0x\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\0\0\0\0\0\0" ... {168, 196, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\0\0\1\0\0\0\0\0.\0d\0\224\0\0\0\230\0\0\0T\2\0\0x\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {168, 196, reply, 0, 1252, 896, 81844, 0}  (24, {168, 196, new_msg, 0, 6619252, 3342445, 6029362, 6619243} "\0\0\0\0\0\0\1\03\02\0.\0d\0\224\0\0\0\230\0\0\0T\2\0\0x\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\0\0\0\0\0\0" ... {168, 196, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\0\0\1\0\0\0\0\0.\0d\0\224\0\0\0\230\0\0\0T\2\0\0x\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01881   896   NtResumeThread  (152, ... 1, ) == 0x0
 01882   896   NtClose  (132, ... ) == 0x0
 01883   896   NtClose  (136, ... ) == 0x0
 01884   896   NtQueryInformationProcess  (148, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=596,ParentPid=1252,}, 0x0, ) == 0x0
 01885   896   NtUserWaitForInputIdle  (596, 30000, 0, ... ) == 0xffffffff
 01886   896   NtClose  (148, ... ) == 0x0
 01887   896   NtClose  (152, ... ) == 0x0
 01888   896   NtAddAtom  ( ("e\0n\0a\0b\0l\0e\0d\0s\0f\0", 18, 1243060, ... ) , 18, 1243060, ... ) == 0x0
 01889   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "Software\Microsoft\Windows"}, ... 152, ) }, ... 152, ) == 0x0
 01890   896   NtQueryValueKey  (152,  (152, "KKQHOOK", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01891   896   NtClose  (152, ... ) == 0x0
 01892   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241884,  (0x80100080, {24, 0, 0x40, 0, 1241884, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 152, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 152, {status=0x0, info=1}, ) == 0x0
 01893   896   NtQueryInformationFile  (152, 1242320, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01894   896   NtQueryInformationFile  (152, 1242236, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01895   896   NtQueryInformationFile  (152, 1242052, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01896   896   NtQueryInformationFile  (152, 1377536, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01897   896   NtQueryInformationFile  (152, 1240500, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01898   896   NtQueryInformationFile  (152, 1240776, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01899   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240652,  (0x40110080, {24, 0, 0x40, 0, 1240652, "\??\C:\WINDOWS\system32\Ienqhe32.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01900   896   NtClose  (-2147481452, ... ) == 0x0
 01899   896   NtCreateFile  ... 148, {status=0x0, info=2}, ) == 0x0
 01901   896   NtQueryVolumeInformationFile  (148, 1240804, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01902   896   NtQueryInformationFile  (148, 1240388, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01903   896   NtQueryVolumeInformationFile  (152, 1240804, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01904   896   NtQueryVolumeInformationFile  (152, 1240148, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01905   896   NtSetInformationFile  (148, 1240704, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01906   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 152, ... 136, ) == 0x0
 01907   896   NtMapViewOfSection  (136, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xb60000), {0, 0}, 225280, ) == 0x0
 01908   896   NtClose  (136, ... ) == 0x0
 01909   896   NtWriteFile  (148, 0, 0, 0,  (148, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0PE\0\0L\1\7\0\34\265|B\0\0\0\0\0\0\0\0\340\0\16\1\13\1\27\0p\0\0\0\306\0\0\0\24\1\0\0\240\2\0\0\20\0\0\0\200\0\0\0\0@\0\0\20\0\0\0\2\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\300\177\2\0\270\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X~\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0.text\0\0\0\0p\0\0\0\20\0\0\00\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.bss\0\0\0\0x\23\1\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.data\0\0\0\0\300\0\0\0\240\1\0\0h\0\0\04\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.ida", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01910   896   NtWriteFile  (148, 0, 0, 0,  (148, 0, 0, 0, "QdY\310aQ\265W\301\263\270XS\257\15\330\373`81\372\251\317\221'\145cC6\271\2133\35\375\3270j\3761\3271;.9^\364\215k0\324\210\237\225\20\305t\300\317\260\240\327\322bmT\340\232\370Dhs\334f\13M\355\11}:V{\314\15WO"^I\335\34OQ\361\363j\327\226\4\341s\270.\27PP\27n\245\334\374kk\34[7\37h\210\334\5\243\24"\357#\34;\333\209\310\35\236?F+s\340\344D\31\352\342\26\213\371\237\216\273I\340\330\340u\276o\271B\34\32*\215\317\36"3^Cq\337ux\341F3\204\16\243?\234l\222\206\2\33\2443\2608f\6\231\213#\276\264\364\200/ \323\357\353m5\335\311\220{\33\307\210\273+\316\5|\221[\257\267\304_\0\266\206\240\371\253\34\\307\217\24\330 ;\24\317h\241\362\351\233V3\222@8\330\263\250\213\226\247\337Z\13\327t0@\27iU`\36c\216\37\206\347N\233X\20\213\221\217\13\325\2\25\362\316pLnH\25\350X\213\25\230v\301\232\253\222`4\274M?-T\266\277\27>\205\312\322\31P;\24\3149\33\27\235n\6O\347n\177BG\237\22\2541\234\320\316V\220\305\171\244+C\335\\356\313\327\3024\314\335\2201\2711g^X\204[\372y\211k\4\325OIVuPI|\325\344\24al[\363w\324\1\310\34\1770\30T`T\225*\2221T8Hn\207>\264\6xK<-z", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) ^I\335\34OQ\361\363j\327\226\4\341s\270.\27PP\27n\245\334\374kk\34[7\37h\210\334\5\243\24206\333\6\257e_\230Hy_<\266g\227\254_j\3034Qy\21\243x=Q\261\243 \240253\317[\327+4M\265\33\5\4?%\340\277\247\372'\252\6b[\235`\320T\211}\20J2Nq\12\331\13\322\274\254\205 (148, 0, 0, 0, "QdY\310aQ\265W\301\263\270XS\257\15\330\373`81\372\251\317\221'\145cC6\271\2133\35\375\3270j\3761\3271;.9^\364\215k0\324\210\237\225\20\305t\300\317\260\240\327\322bmT\340\232\370Dhs\334f\13M\355\11}:V{\314\15WO"^I\335\34OQ\361\363j\327\226\4\341s\270.\27PP\27n\245\334\374kk\34[7\37h\210\334\5\243\24"\357#\34;\333\209\310\35\236?F+s\340\344D\31\352\342\26\213\371\237\216\273I\340\330\340u\276o\271B\34\32*\215\317\36"3^Cq\337ux\341F3\204\16\243?\234l\222\206\2\33\2443\2608f\6\231\213#\276\264\364\200/ \323\357\353m5\335\311\220{\33\307\210\273+\316\5|\221[\257\267\304_\0\266\206\240\371\253\34\\307\217\24\330 ;\24\317h\241\362\351\233V3\222@8\330\263\250\213\226\247\337Z\13\327t0@\27iU`\36c\216\37\206\347N\233X\20\213\221\217\13\325\2\25\362\316pLnH\25\350X\213\25\230v\301\232\253\222`4\274M?-T\266\277\27>\205\312\322\31P;\24\3149\33\27\235n\6O\347n\177BG\237\22\2541\234\320\316V\220\305\171\244+C\335\\356\313\327\3024\314\335\2201\2711g^X\204[\372y\211k\4\325OIVuPI|\325\344\24al[\363w\324\1\310\34\1770\30T`T\225*\2221T8Hn\207>\264\6xK<-z", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) 3^Cq\337ux\341F3\204\16\243?\234l\222\206\2\33\2443\2608f\6\231\213#\276\264\364\200/ \323\357\353m5\335\311\220{\33\307\210\273+\316\5|\221[\257\267\304_\0\266\206\240\371\253\34\\307\217\24\330 ;\24\317h\241\362\351\233V3\222@8\330\263\250\213\226\247\337Z\13\327t0@\27iU`\36c\216\37\206\347N\233X\20\213\221\217\13\325\2\25\362\316pLnH\25\350X\213\25\230v\301\232\253\222`4\274M?-T\266\277\27>\205\312\322\31P;\24\3149\33\27\235n\6O\347n\177BG\237\22\2541\234\320\316V\220\305\171\244+C\335\\356\313\327\3024\314\335\2201\2711g^X\204[\372y\211k\4\325OIVuPI|\325\344\24al[\363w\324\1\310\34\1770\30T`T\225*\2221T8Hn\207>\264\6xK<-z", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01911   896   NtWriteFile  (148, 0, 0, 0,  (148, 0, 0, 0, "\177E\236\354\273\245\311\244\1\370\321\242\36\262\332\364N\213{\22.\330Q\313\245\261C@\375R\344\364\254zr@-\1\206jU\273\260}\240\253\266n\346;O9\203\22%N\35O\20\371\275\270 j\225D]\2546]\7,L\362\266\267a\20\374\363\375hF.H:\370\363U\177X\273\214r\373\356\231\365L?h\340\226+9FT\213\204\313`\375@/\252\271\270y\20\332\12\276\5\263\274_r\373\252\3074\325\31)\10\13\224\223\7\270\177\234\212\263\214Xi\262\335\341HJ`x\311$\307\313\261\2159\375\310\245D\`r&Uh\265\216\302\16\14\231?\12C/,X\257\23\326\345\13\224\367\13\340L\327\336K\220D\37\213\240\310\11\272_\13R8\352v\306<\225\357\306q\1{\317\362B\363!7\0K\251\23\332r7OT\231\334y\346\342v"\335(\344uVZ\17v\360#\232\324\220\265S\177w\31\20\310\226\367\203\35d\311\20*T\202\260<\5\1{&\200\307\4\221\261\16\34\262~\264\250[|u??V~\252\245\226J\7+\17\221\0\13SA\245SQ\302\1~I\273\12\343\365}$#\31\303q\316\325&\13\235\26\304\10w\323=[#DX\230\315\25\11@\256\0\330 ;\335\327\213Du^p\3001, \23\27v\0\34]Z\25\2\217(*", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \357\306q\1{\317\362B\363!7\0K\251\23\332r7OT\231\334y\346\342v236#3-+\34\27\360\315\315\30\30S\37\11\6\16\223!\10\240SdR\36\265#\1p\2T\350& (148, 0, 0, 0, "\177E\236\354\273\245\311\244\1\370\321\242\36\262\332\364N\213{\22.\330Q\313\245\261C@\375R\344\364\254zr@-\1\206jU\273\260}\240\253\266n\346;O9\203\22%N\35O\20\371\275\270 j\225D]\2546]\7,L\362\266\267a\20\374\363\375hF.H:\370\363U\177X\273\214r\373\356\231\365L?h\340\226+9FT\213\204\313`\375@/\252\271\270y\20\332\12\276\5\263\274_r\373\252\3074\325\31)\10\13\224\223\7\270\177\234\212\263\214Xi\262\335\341HJ`x\311$\307\313\261\2159\375\310\245D\`r&Uh\265\216\302\16\14\231?\12C/,X\257\23\326\345\13\224\367\13\340L\327\336K\220D\37\213\240\310\11\272_\13R8\352v\306<\225\357\306q\1{\317\362B\363!7\0K\251\23\332r7OT\231\334y\346\342v"\335(\344uVZ\17v\360#\232\324\220\265S\177w\31\20\310\226\367\203\35d\311\20*T\202\260<\5\1{&\200\307\4\221\261\16\34\262~\264\250[|u??V~\252\245\226J\7+\17\221\0\13SA\245SQ\302\1~I\273\12\343\365}$#\31\303q\316\325&\13\235\26\304\10w\323=[#DX\230\315\25\11@\256\0\330 ;\335\327\213Du^p\3001, \23\27v\0\34]Z\25\2\217(*", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01912   896   NtWriteFile  (148, 0, 0, 0,  (148, 0, 0, 0, "\5A\237P&Z\246@E\263\377\360\223\300\207?\202dN\332[\\7\326\36(\301\25\3241$\20k>\366\226OLr\343"\25\370s\203$\213 \347\30\300u\342\37\131:\301v\22\352\221Y\240\310J\140p\0\341\13\261\31\266\13\270Ma\205\304be`h\217P\316U\264\217\372"C2@\217\204\306p\31\247\262\213\\264S\363\1\3263\262?\323\276\211\237$C+\25F\10UD\222jbk\100\315\362\205[\242`\304Y`\3+;W\3\267~\3037\300\260\24M#"\247\34d\215h\25TP\333\0d\23\375j\24x\320v4\3350\27\310Sd\7l\366V\3%\251\317gS\3\233Rv\3ml\207K\346\327\326\3k\356\14\26i\344d\360\317^\212\326\252WL\310\277\362\330\241\203D\221\377\15\353\377xG\326\z\252\203\347\355\260)\244@*\203h\213F9?\221\252\225\263\360d\37Z\342\337\361\330E\343\333\334\307\362a\237\305\1VZ)\330\360\0dM\271\34\3004"%\25b\364\330\374\341q\214\234g\367\210D\247\16\335`\223t-\230\251\1\263\325\331\344M\203\235\36l\17 \34PTbOd\6\270\4\330F\266(\245\262]h\231\326e\361K\15\15\212\236\3469\263\305\235?\371\374,\374\237\306\240\344K3L_M\220m\321#I;\376\332\15N.3\331\202\223\325\326\267,\373xC\204\304@\326\333\20|0\260\31zX\213\226\352\213V\323\0zC\213\204h9\310\351>\236\20\6*\15\30s[s\34fjTb\317Q\367%\273\342Ay{\343m\243v\272\332|TZ\17\2421){\233\354'.Mv|\324\23*B\0\312\331j\27\315K\205\22\350\326\14h\20\334H\21\36\3\275\327\244x\373!^[EF\21\177\336eS\20\357", 39900, 0x0, 0, ... {status=0x0, info=39900}, ) \25\370s\203$\213 \347\30\300u\342\37\131:\301v\22\352\221Y\240\310J\140p\0\341\13\261\31\266\13\270Ma\205\304be`h\217P\316U\264\217\372 (148, 0, 0, 0, "\5A\237P&Z\246@E\263\377\360\223\300\207?\202dN\332[\\7\326\36(\301\25\3241$\20k>\366\226OLr\343"\25\370s\203$\213 \347\30\300u\342\37\131:\301v\22\352\221Y\240\310J\140p\0\341\13\261\31\266\13\270Ma\205\304be`h\217P\316U\264\217\372"C2@\217\204\306p\31\247\262\213\\264S\363\1\3263\262?\323\276\211\237$C+\25F\10UD\222jbk\100\315\362\205[\242`\304Y`\3+;W\3\267~\3037\300\260\24M#"\247\34d\215h\25TP\333\0d\23\375j\24x\320v4\3350\27\310Sd\7l\366V\3%\251\317gS\3\233Rv\3ml\207K\346\327\326\3k\356\14\26i\344d\360\317^\212\326\252WL\310\277\362\330\241\203D\221\377\15\353\377xG\326\z\252\203\347\355\260)\244@*\203h\213F9?\221\252\225\263\360d\37Z\342\337\361\330E\343\333\334\307\362a\237\305\1VZ)\330\360\0dM\271\34\3004"%\25b\364\330\374\341q\214\234g\367\210D\247\16\335`\223t-\230\251\1\263\325\331\344M\203\235\36l\17 \34PTbOd\6\270\4\330F\266(\245\262]h\231\326e\361K\15\15\212\236\3469\263\305\235?\371\374,\374\237\306\240\344K3L_M\220m\321#I;\376\332\15N.3\331\202\223\325\326\267,\373xC\204\304@\326\333\20|0\260\31zX\213\226\352\213V\323\0zC\213\204h9\310\351>\236\20\6*\15\30s[s\34fjTb\317Q\367%\273\342Ay{\343m\243v\272\332|TZ\17\2421){\233\354'.Mv|\324\23*B\0\312\331j\27\315K\205\22\350\326\14h\20\334H\21\36\3\275\327\244x\373!^[EF\21\177\336eS\20\357", 39900, 0x0, 0, ... {status=0x0, info=39900}, ) \247\34d\215h\25TP\333\0d\23\375j\24x\320v4\3350\27\310Sd\7l\366V\3%\251\317gS\3\233Rv\3ml\207K\346\327\326\3k\356\14\26i\344d\360\317^\212\326\252WL\310\277\362\330\241\203D\221\377\15\353\377xG\326\z\252\203\347\355\260)\244@*\203h\213F9?\221\252\225\263\360d\37Z\342\337\361\330E\343\333\334\307\362a\237\305\1VZ)\330\360\0dM\271\34\3004 (148, 0, 0, 0, "\5A\237P&Z\246@E\263\377\360\223\300\207?\202dN\332[\\7\326\36(\301\25\3241$\20k>\366\226OLr\343"\25\370s\203$\213 \347\30\300u\342\37\131:\301v\22\352\221Y\240\310J\140p\0\341\13\261\31\266\13\270Ma\205\304be`h\217P\316U\264\217\372"C2@\217\204\306p\31\247\262\213\\264S\363\1\3263\262?\323\276\211\237$C+\25F\10UD\222jbk\100\315\362\205[\242`\304Y`\3+;W\3\267~\3037\300\260\24M#"\247\34d\215h\25TP\333\0d\23\375j\24x\320v4\3350\27\310Sd\7l\366V\3%\251\317gS\3\233Rv\3ml\207K\346\327\326\3k\356\14\26i\344d\360\317^\212\326\252WL\310\277\362\330\241\203D\221\377\15\353\377xG\326\z\252\203\347\355\260)\244@*\203h\213F9?\221\252\225\263\360d\37Z\342\337\361\330E\343\333\334\307\362a\237\305\1VZ)\330\360\0dM\271\34\3004"%\25b\364\330\374\341q\214\234g\367\210D\247\16\335`\223t-\230\251\1\263\325\331\344M\203\235\36l\17 \34PTbOd\6\270\4\330F\266(\245\262]h\231\326e\361K\15\15\212\236\3469\263\305\235?\371\374,\374\237\306\240\344K3L_M\220m\321#I;\376\332\15N.3\331\202\223\325\326\267,\373xC\204\304@\326\333\20|0\260\31zX\213\226\352\213V\323\0zC\213\204h9\310\351>\236\20\6*\15\30s[s\34fjTb\317Q\367%\273\342Ay{\343m\243v\272\332|TZ\17\2421){\233\354'.Mv|\324\23*B\0\312\331j\27\315K\205\22\350\326\14h\20\334H\21\36\3\275\327\244x\373!^[EF\21\177\336eS\20\357", 39900, 0x0, 0, ... {status=0x0, info=39900}, ) , 39900, 0x0, 0, ... {status=0x0, info=39900}, ) == 0x0
 01913   896   NtUnmapViewOfSection  (-1, 0xb60000, ... ) == 0x0
 01914   896   NtSetInformationFile  (148, 1242052, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01915   896   NtClose  (152, ... ) == 0x0
 01916   896   NtClose  (148, ... ) == 0x0
 01917   896   NtAllocateVirtualMemory  (-1, 1388544, 0, 12288, 4096, 4, ... 1388544, 12288, ) == 0x0
 01918   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 148, {status=0x0, info=1}, ) }, 3, 16417, ... 148, {status=0x0, info=1}, ) == 0x0
 01919   896   NtQueryInformationFile  (148, 1237324, 528, Name, ... {status=0x0, info=6}, ) == 0x0
 01920   896   NtAllocateVirtualMemory  (-1, 1400832, 0, 12288, 4096, 4, ... 1400832, 12288, ) == 0x0
 01921   896   NtQueryVolumeInformationFile  (148, 1393936, 8214, Volume, ... {status=0x0, info=18}, ) == 0x0
 01922   896   NtQueryVolumeInformationFile  (148, 1402160, 8206, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01923   896   NtClose  (148, ... ) == 0x0
 01924   896   NtAddAtom  ( ("I\0l\0i\0l\0e\0f\03\02\0.\0d\0l\0l\0:\0F\0", 28, 1241980, ... ) , 28, 1241980, ... ) == 0x0
 01925   896   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1242184,  (0x40100080, {24, 0, 0x40, 0, 1242184, "\??\C:\WINDOWS\system32\Ililef32.dll"}, 0x0, 0, 0, 5, 96, 0, 0, ... }, 0x0, 0, 0, 5, 96, 0, 0, ...
 01926   896   NtClose  (-2147482712, ... ) == 0x0
 01925   896   NtCreateFile  ... 148, {status=0x0, info=2}, ) == 0x0
 01927   896   NtWriteFile  (148, 0, 0, 0,  (148, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0PE\0\0L\1\7\0\12\265|B\0\0\0\0\0\0\0\0\340\0\16!\13\1\27\0\10\0\0\0\14\0\0\0\20\0\0\220\21\0\0\0\20\0\0\0 \0\0\0\0\0\20\0\20\0\0\0\2\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\200\0\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0p\0\0H\0\0\0\0P\0\0|\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\334\0\0\0\00\0\0T\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\274\7\0\0\0\20\0\0\274\7\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0`.bss\0\0\0\0\340\17\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0\300.rdata\0\0T\0\0\0\00\0\0T\0\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0@.dat", 6657, 0x0, 0, ... , 6657, 0x0, 0, ...
 01928   896   NtContinue  (-135750188, 0, ...
 01927   896   NtWriteFile  ... {status=0x0, info=6657}, ) == 0x0
 01929   896   NtClose  (148, ... ) == 0x0
 01930   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01931   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 148, ) == 0x0
 01932   896   NtQueryInformationToken  (148, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01933   896   NtClose  (148, ... ) == 0x0
 01934   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_Classes"}, ... 148, ) }, ... 148, ) == 0x0
 01935   896   NtSetInformationObject  (150, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 01936   896   NtQueryKey  (150, Name, 382, ... {Name= (150, Name, 382, ... {Name="\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_CLASSES"}, 140, ) }, 140, ) == 0x0
 01937   896   NtOpenKey  (0x2000000, {24, 150, 0x40, 0, 0,  (0x2000000, {24, 150, 0x40, 0, 0, "CLSID\{62862D22-103A-6D9A-1331-343A7AE64C00}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01938   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes"}, ... 152, ) }, ... 152, ) == 0x0
 01939   896   NtCreateKey  (0xf003f, {24, 152, 0x40, 0, 0,  (0xf003f, {24, 152, 0x40, 0, 0, "CLSID\{62862D22-103A-6D9A-1331-343A7AE64C00}\InProcServer32"}, 0, 0x0, 0, ... ) }, 0, 0x0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01940   896   NtCreateKey  (0x2000000, {24, 152, 0x40, 0, 0,  (0x2000000, {24, 152, 0x40, 0, 0, "CLSID"}, 0, 0x0, 0, ... 136, 2, ) }, 0, 0x0, 0, ... 136, 2, ) == 0x0
 01941   896   NtCreateKey  (0x2000000, {24, 136, 0x40, 0, 0,  (0x2000000, {24, 136, 0x40, 0, 0, "{62862D22-103A-6D9A-1331-343A7AE64C00}"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01942   896   NtSetInformationFile  (-2147482448, -135748688, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01941   896   NtCreateKey  ... 132, 1, ) == 0x0
 01943   896   NtClose  (136, ... ) == 0x0
 01944   896   NtCreateKey  (0xf003f, {24, 132, 0x40, 0, 0,  (0xf003f, {24, 132, 0x40, 0, 0, "InProcServer32"}, 0, 0x0, 0, ... 136, 1, ) }, 0, 0x0, 0, ... 136, 1, ) == 0x0
 01945   896   NtClose  (132, ... ) == 0x0
 01946   896   NtClose  (152, ... ) == 0x0
 01947   896   NtQueryKey  (138, Name, 392, ... {Name= (138, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62862D22-103A-6D9A-1331-343A7AE64C00}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01948   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01949   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 152, ) == 0x0
 01950   896   NtQueryInformationToken  (152, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01951   896   NtClose  (152, ... ) == 0x0
 01952   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_Classes\CLSID\{62862D22-103A-6D9A-1331-343A7AE64C00}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01953   896   NtSetValueKey  (138, " (138, "", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0I\0l\0i\0l\0e\0f\03\02\0.\0d\0l\0l\0\0\0", 66, ... ) C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0I\0l\0i\0l\0e\0f\03\02\0.\0d\0l\0l\0\0\0", 66, ... ) == 0x0
 01954   896   NtClose  (138, ... ) == 0x0
 01955   896   NtQueryKey  (150, Name, 382, ... {Name= (150, Name, 382, ... {Name="\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_CLASSES"}, 140, ) }, 140, ) == 0x0
 01956   896   NtOpenKey  (0x2000000, {24, 150, 0x40, 0, 0,  (0x2000000, {24, 150, 0x40, 0, 0, "CLSID\{62862D22-103A-6D9A-1331-343A7AE64C00}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01957   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes"}, ... 136, ) }, ... 136, ) == 0x0
 01958   896   NtCreateKey  (0xf003f, {24, 136, 0x40, 0, 0,  (0xf003f, {24, 136, 0x40, 0, 0, "CLSID\{62862D22-103A-6D9A-1331-343A7AE64C00}\InProcServer32"}, 0, 0x0, 0, ... 152, 2, ) }, 0, 0x0, 0, ... 152, 2, ) == 0x0
 01959   896   NtClose  (136, ... ) == 0x0
 01960   896   NtQueryKey  (154, Name, 392, ... {Name= (154, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62862D22-103A-6D9A-1331-343A7AE64C00}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01961   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01962   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 136, ) == 0x0
 01963   896   NtQueryInformationToken  (136, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01964   896   NtClose  (136, ... ) == 0x0
 01965   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_Classes\CLSID\{62862D22-103A-6D9A-1331-343A7AE64C00}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01966   896   NtSetValueKey  (154,  (154, "ThreadingModel", 0, 1, "A\0p\0a\0r\0t\0m\0e\0n\0t\0\0\0", 20, ... , 0, 1,  (154, "ThreadingModel", 0, 1, "A\0p\0a\0r\0t\0m\0e\0n\0t\0\0\0", 20, ... , 20, ...
 01967   896   NtSetInformationFile  (-2147482448, -135748240, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01966   896   NtSetValueKey  ... ) == 0x0
 01968   896   NtClose  (154, ... ) == 0x0
 01969   896   NtCreateKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad"}, 0, 0x0, 0, ... 152, 2, ) }, 0, 0x0, 0, ... 152, 2, ) == 0x0
 01970   896   NtSetValueKey  (152,  (152, "AEICEBIE", 0, 1, "{\06\02\08\06\02\0D\02\02\0-\01\00\03\0A\0-\06\0D\09\0A\0-\01\03\03\01\0-\03\04\03\0A\07\0A\0E\06\04\0C\00\00\0}\0\0\0", 78, ... ) , 0, 1,  (152, "AEICEBIE", 0, 1, "{\06\02\08\06\02\0D\02\02\0-\01\00\03\0A\0-\06\0D\09\0A\0-\01\03\03\01\0-\03\04\03\0A\07\0A\0E\06\04\0C\00\00\0}\0\0\0", 78, ... ) , 78, ... ) == 0x0
 01971   896   NtClose  (152, ... ) == 0x0
 01972   896   NtCreateKey  (0xf003f, {24, 104, 0x40, 0, 0,  (0xf003f, {24, 104, 0x40, 0, 0, "Software\Microsoft\Windows"}, 0, 0x0, 0, ... 152, 2, ) }, 0, 0x0, 0, ... 152, 2, ) == 0x0
 01973   896   NtSetValueKey  (152,  (152, "KKQHOOK", 0, 4, "\34\0\0\0", 4, ... , 0, 4,  (152, "KKQHOOK", 0, 4, "\34\0\0\0", 4, ... , 4, ...
 01974   896   NtSetInformationFile  (-2147482192, -135748232, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01973   896   NtSetValueKey  ... ) == 0x0
 01975   896   NtClose  (152, ... ) == 0x0
 01976   896   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 01977   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Ienqhe32.exe"}, 1239288, ... ) }, 1239288, ... ) == 0x0
 01978   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Ienqhe32.exe"}, 1240024, ... ) }, 1240024, ... ) == 0x0
 01979   896   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Ienqhe32.exe"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 01980   896   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 152, ... 136, ) == 0x0
 01981   896   NtQueryVolumeInformationFile  (152, 1239300, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01982   896   NtWaitForSingleObject  (140, 0, {-1000000, -1}, ... ) == 0x0
 01983   896   NtReleaseMutant  (140, ... 0x0, ) == 0x0
 01984   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0
 01985   896   NtQueryInformationFile  (132, 1237556, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01986   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 132, ... 156, ) == 0x0
 01987   896   NtMapViewOfSection  (156, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xce0000), 0x0, 1191936, ) == 0x0
 01988   896   NtQueryInformationFile  (132, 1237656, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01989   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01990   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01991   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 160, ) }, ... 160, ) == 0x0
 01992   896   NtQueryValueKey  (160,  (160, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (160, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01993   896   NtClose  (160, ... ) == 0x0
 01994   896   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01995   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01996   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1235252, 616, BothDirectory, 1,  (160, 0, 0, 0, 1235252, 616, BothDirectory, 1, "Ienqhe32.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 01997   896   NtClose  (160, ... ) == 0x0
 01998   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01999   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02000   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Ienqhe32.exe"}, 1235628, ... ) }, 1235628, ... ) == 0x0
 02001   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02002   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1235056, 616, BothDirectory, 1,  (160, 0, 0, 0, 1235056, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02003   896   NtClose  (160, ... ) == 0x0
 02004   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02005   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1235056, 616, BothDirectory, 1,  (160, 0, 0, 0, 1235056, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02006   896   NtClose  (160, ... ) == 0x0
 02007   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02008   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1235056, 616, BothDirectory, 1,  (160, 0, 0, 0, 1235056, 616, BothDirectory, 1, "Ienqhe32.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 02009   896   NtClose  (160, ... ) == 0x0
 02010   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02011   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02012   896   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02013   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02014   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02015   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 160, ) == 0x0
 02016   896   NtQueryInformationToken  (160, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02017   896   NtClose  (160, ... ) == 0x0
 02018   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02019   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\Ienqhe32.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02020   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02021   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02022   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Ienqhe32.exe"}, 1236880, ... ) }, 1236880, ... ) == 0x0
 02023   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02024   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1236308, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236308, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02025   896   NtClose  (160, ... ) == 0x0
 02026   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02027   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1236308, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236308, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02028   896   NtClose  (160, ... ) == 0x0
 02029   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02030   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1236308, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236308, 616, BothDirectory, 1, "Ienqhe32.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 02031   896   NtClose  (160, ... ) == 0x0
 02032   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02033   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02034   896   NtWaitForSingleObject  (140, 0, {-1000000, -1}, ... ) == 0x0
 02035   896   NtQueryVolumeInformationFile  (152, 1237536, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02036   896   NtQueryInformationFile  (152, 1237516, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02037   896   NtQueryInformationFile  (152, 1237556, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02038   896   NtReleaseMutant  (140, ... 0x0, ) == 0x0
 02039   896   NtUnmapViewOfSection  (-1, 0xce0000, ... ) == 0x0
 02040   896   NtClose  (156, ... ) == 0x0
 02041   896   NtClose  (132, ... ) == 0x0
 02042   896   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 02043   896   NtOpenProcessToken  (-1, 0xa, ... 132, ) == 0x0
 02044   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 02045   896   NtQueryKey  (156, Basic, 520, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (156, Basic, 520, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="CodeIdentifierso"}, 46, ) }, 46, ) == 0x0
 02046   896   NtClose  (156, ... ) == 0x0
 02047   896   NtOpenKey  (0x2000000, {24, 104, 0x40, 0, 0,  (0x2000000, {24, 104, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02048   896   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 156, ) }, ... 156, ) == 0x0
 02049   896   NtQuerySymbolicLinkObject  (156, ...  (156, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 02050   896   NtClose  (156, ... ) == 0x0
 02051   896   NtQueryVolumeInformationFile  (152, 1236992, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02052   896   NtQueryInformationFile  (152, 1237108, 528, Name, ... {status=0x0, info=64}, ) == 0x0
 02053   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02054   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02055   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Ienqhe32.exe"}, 1236280, ... ) }, 1236280, ... ) == 0x0
 02056   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 02057   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235708, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235708, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02058   896   NtClose  (156, ... ) == 0x0
 02059   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 02060   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235708, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235708, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02061   896   NtClose  (156, ... ) == 0x0
 02062   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 156, {status=0x0, info=1}, ) }, 3, 16417, ... 156, {status=0x0, info=1}, ) == 0x0
 02063   896   NtQueryDirectoryFile  (156, 0, 0, 0, 1235708, 616, BothDirectory, 1,  (156, 0, 0, 0, 1235708, 616, BothDirectory, 1, "Ienqhe32.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 02064   896   NtClose  (156, ... ) == 0x0
 02065   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02066   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02067   896   NtQueryInformationFile  (152, 1239148, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02068   896   NtCreateSection  (0xf0005, 0x0, {224220, 0}, 2, 134217728, 152, ... 156, ) == 0x0
 02069   896   NtMapViewOfSection  (156, -1, (0x0), 0, 0, {0, 0}, 224220, 1, 0, 2, ... (0xb60000), {0, 0}, 225280, ) == 0x0
 02070   896   NtClose  (156, ... ) == 0x0
 02071   896   NtUnmapViewOfSection  (-1, 0xb60000, ... ) == 0x0
 02072   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 02073   896   NtQueryValueKey  (156,  (156, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02074   896   NtClose  (156, ... ) == 0x0
 02075   896   NtQueryInformationToken  (132, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 02076   896   NtQueryInformationToken  (132, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 02077   896   NtClose  (132, ... ) == 0x0
 02078   896   NtQuerySection  (136, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02079   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ienqhe32.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02080   896   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 02081   896   NtCreateProcessEx  (1241072, 2035711, 0, -1, 0, 136, 0, 0, 0, ... ) == 0x0
 02082   896   NtQueryInformationProcess  (132, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=840,ParentPid=1252,}, 0x0, ) == 0x0
 02083   896   NtReadVirtualMemory  (132, 0x7ffd6008, 4, ...  (132, 0x7ffd6008, 4, ... "\0\0@\0", 0x0, ) , 0x0, ) == 0x0
 02084   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Ienqhe32.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02085   896   NtReadVirtualMemory  (132, 0x400000, 4096, ...  (132, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0PE\0\0L\1\7\0\34\265|B\0\0\0\0\0\0\0\0\340\0\16\1\13\1\27\0p\0\0\0\306\0\0\0\24\1\0\0\240\2\0\0\20\0\0\0\200\0\0\0\0@\0\0\20\0\0\0\2\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\300\177\2\0\270\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X~\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0.text\0\0\0\0p\0\0\0\20\0\0\00\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.bss\0\0\0\0x\23\1\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.data\0\0\0\0\300\0\0\0\240\1\0\0h\0\0\04\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.ida", 4096, ) , 4096, ) == 0x0
 02086   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02087   896   NtQueryInformationProcess  (132, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=840,ParentPid=1252,}, 0x0, ) == 0x0
 02088   896   NtAllocateVirtualMemory  (-1, 0, 0, 2432, 4096, 4, ... 11927552, 4096, ) == 0x0
 02089   896   NtAllocateVirtualMemory  (132, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 02090   896   NtWriteVirtualMemory  (132, 0x10000,  (132, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 02091   896   NtAllocateVirtualMemory  (132, 0, 0, 2432, 4096, 4, ... 131072, 4096, ) == 0x0
 02092   896   NtWriteVirtualMemory  (132, 0x20000,  (132, 0x20000, "\0\20\0\0\200\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0\26\0\10\2\220\2\0\0\0\0\0\0\364\3\366\3\230\4\0\0@\0B\0\220\10\0\0@\0B\0\324\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0@\0B\0\30\11\0\0\36\0 \0\\11\0\0\0\0\2\0|\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2432, ... 0x0, ) , 2432, ... 0x0, ) == 0x0
 02093   896   NtWriteVirtualMemory  (132, 0x7ffd6010,  (132, 0x7ffd6010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02094   896   NtWriteVirtualMemory  (132, 0x7ffd61e8,  (132, 0x7ffd61e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02095   896   NtFreeVirtualMemory  (-1, (0xb60000), 0, 32768, ... (0xb60000), 4096, ) == 0x0
 02096   896   NtAllocateVirtualMemory  (132, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 02097   896   NtAllocateVirtualMemory  (132, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 02098   896   NtProtectVirtualMemory  (132, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 02099   896   NtCreateThread  (0x1f03ff, 0x0, 132, 1241080, 1240744, 1, ... 156, {840, 1516}, ) == 0x0
 02100   896   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 7471184, 6488175, 6619219, 7733362}  (24, {168, 196, new_msg, 0, 7471184, 6488175, 6619219, 7733362} "\0\0\0\0\0\0\1\0\0\0\0\0S\0S\0\207\0\0\0\234\0\0\0H\3\0\0\354\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0H\7\24\0m\5\221|\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\220|\206\325\220|" ... {168, 196, reply, 0, 1252, 896, 82013, 0} "\0\0\0\0\0\0\1\0\0\0\0\0S\0S\0\204\0\0\0\234\0\0\0H\3\0\0\354\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0H\7\24\0m\5\221|\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\220|\206\325\220|" )  ... {168, 196, reply, 0, 1252, 896, 82013, 0}  (24, {168, 196, new_msg, 0, 7471184, 6488175, 6619219, 7733362} "\0\0\0\0\0\0\1\0\0\0\0\0S\0S\0\207\0\0\0\234\0\0\0H\3\0\0\354\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0H\7\24\0m\5\221|\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\220|\206\325\220|" ... {168, 196, reply, 0, 1252, 896, 82013, 0} "\0\0\0\0\0\0\1\0\0\0\0\0S\0S\0\204\0\0\0\234\0\0\0H\3\0\0\354\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0H\7\24\0m\5\221|\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\220|\206\325\220|" )  ) == 0x0
 02101   896   NtResumeThread  (156, ... 1, ) == 0x0
 02102   896   NtClose  (152, ... ) == 0x0
 02103   896   NtClose  (136, ... ) == 0x0
 02104   896   NtQueryInformationProcess  (132, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=840,ParentPid=1252,}, 0x0, ) == 0x0
 02105   896   NtUserWaitForInputIdle  (840, 30000, 0, ...
 02106   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 136, ) == 0x0
 02107   896   NtClose  (136, ... ) == 0x0
 02105   896   NtUserWaitForInputIdle  ... ) == 0x0
 02108   896   NtClose  (132, ... ) == 0x0
 02109   896   NtClose  (156, ... ) == 0x0
 02110   896   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.pif"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02111   896   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1237708,  (0x40100080, {24, 0, 0x40, 0, 1237708, "\??\C:\WINDOWS\system32\xslfdlnt.bat"}, 0x0, 128, 0, 5, 96, 0, 0, ... }, 0x0, 128, 0, 5, 96, 0, 0, ...
 02112   896   NtClose  (-2147481712, ... ) == 0x0
 02111   896   NtCreateFile  ... 156, {status=0x0, info=2}, ) == 0x0
 02113   896   NtWriteFile  (156, 0, 0, 0,  (156, 0, 0, 0, ":loop\15\12@del u:\work\packed.exe>nul\15\12@if exist u:\work\packed.exe goto loop\15\12@del C:\WINDOWS\system32\xslfdlnt.bat>nul\15\12", 119, 0x0, 0, ... {status=0x0, info=119}, ) , 119, 0x0, 0, ... {status=0x0, info=119}, ) == 0x0
 02114   896   NtClose  (156, ... ) == 0x0
 02115   896   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 02116   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1234000, ... ) }, 1234000, ... ) == 0x0
 02117   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1234736, ... ) }, 1234736, ... ) == 0x0
 02118   896   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 5, 96, ... 156, {status=0x0, info=1}, ) }, 5, 96, ... 156, {status=0x0, info=1}, ) == 0x0
 02119   896   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 156, ... 132, ) == 0x0
 02120   896   NtQueryVolumeInformationFile  (156, 1234012, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02121   896   NtWaitForSingleObject  (140, 0, {-1000000, -1}, ... ) == 0x0
 02122   896   NtReleaseMutant  (140, ... 0x0, ) == 0x0
 02123   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 136, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 136, {status=0x0, info=1}, ) == 0x0
 02124   896   NtQueryInformationFile  (136, 1232268, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02125   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 136, ... 152, ) == 0x0
 02126   896   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xce0000), 0x0, 1191936, ) == 0x0
 02127   896   NtQueryInformationFile  (136, 1232368, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02128   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02129   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02130   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 160, ) }, ... 160, ) == 0x0
 02131   896   NtQueryValueKey  (160,  (160, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (160, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02132   896   NtClose  (160, ... ) == 0x0
 02133   896   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02134   896   NtAllocateVirtualMemory  (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0
 02135   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02136   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1229964, 616, BothDirectory, 1,  (160, 0, 0, 0, 1229964, 616, BothDirectory, 1, "cmd.exe", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02137   896   NtClose  (160, ... ) == 0x0
 02138   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02139   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02140   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1230340, ... ) }, 1230340, ... ) == 0x0
 02141   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02142   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1229768, 616, BothDirectory, 1,  (160, 0, 0, 0, 1229768, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02143   896   NtClose  (160, ... ) == 0x0
 02144   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02145   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1229768, 616, BothDirectory, 1,  (160, 0, 0, 0, 1229768, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02146   896   NtClose  (160, ... ) == 0x0
 02147   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02148   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1229768, 616, BothDirectory, 1,  (160, 0, 0, 0, 1229768, 616, BothDirectory, 1, "cmd.exe", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02149   896   NtClose  (160, ... ) == 0x0
 02150   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02151   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02152   896   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02153   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02154   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02155   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 160, ) == 0x0
 02156   896   NtQueryInformationToken  (160, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02157   896   NtClose  (160, ... ) == 0x0
 02158   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02159   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\cmd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02160   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1231176, ... ) }, 1231176, ... ) == 0x0
 02161   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02162   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02163   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1230040, ... ) }, 1230040, ... ) == 0x0
 02164   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 5, 96, ... 160, {status=0x0, info=1}, ) }, 5, 96, ... 160, {status=0x0, info=1}, ) == 0x0
 02165   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 160, ... 164, ) == 0x0
 02166   896   NtClose  (160, ... ) == 0x0
 02167   896   NtMapViewOfSection  (164, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb60000), 0x0, 389120, ) == 0x0
 02168   896   NtClose  (164, ... ) == 0x0
 02169   896   NtUnmapViewOfSection  (-1, 0xb60000, ... ) == 0x0
 02170   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1229636, ... ) }, 1229636, ... ) == 0x0
 02171   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1230380,  (0x80100080, {24, 0, 0x40, 0, 1230380, "\??\C:\WINDOWS\system32\cmd.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 164, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 164, {status=0x0, info=1}, ) == 0x0
 02172   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 164, ... 160, ) == 0x0
 02173   896   NtClose  (164, ... ) == 0x0
 02174   896   NtMapViewOfSection  (160, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xb60000), {0, 0}, 389120, ) == 0x0
 02175   896   NtClose  (160, ... ) == 0x0
 02176   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02177   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02178   896   NtQueryDefaultLocale  (1, 1231000, ... ) == 0x0
 02179   896   NtQueryVirtualMemory  (-1, 0xb60000, Basic, 28, ... {BaseAddress=0xb60000,AllocationBase=0xb60000,AllocationProtect=0x2,RegionSize=0x5f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02180   896   NtQueryVirtualMemory  (-1, 0xb60000, Basic, 28, ... {BaseAddress=0xb60000,AllocationBase=0xb60000,AllocationProtect=0x2,RegionSize=0x5f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02181   896   NtUnmapViewOfSection  (-1, 0xb60000, ... ) == 0x0
 02182   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02183   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02184   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1230032, ... ) }, 1230032, ... ) == 0x0
 02185   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 5, 96, ... 160, {status=0x0, info=1}, ) }, 5, 96, ... 160, {status=0x0, info=1}, ) == 0x0
 02186   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 160, ... 164, ) == 0x0
 02187   896   NtClose  (160, ... ) == 0x0
 02188   896   NtMapViewOfSection  (164, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb60000), 0x0, 389120, ) == 0x0
 02189   896   NtClose  (164, ... ) == 0x0
 02190   896   NtUnmapViewOfSection  (-1, 0xb60000, ... ) == 0x0
 02191   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1229628, ... ) }, 1229628, ... ) == 0x0
 02192   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1230372,  (0x80100080, {24, 0, 0x40, 0, 1230372, "\??\C:\WINDOWS\system32\cmd.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 164, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 164, {status=0x0, info=1}, ) == 0x0
 02193   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 164, ... 160, ) == 0x0
 02194   896   NtClose  (164, ... ) == 0x0
 02195   896   NtMapViewOfSection  (160, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xb60000), {0, 0}, 389120, ) == 0x0
 02196   896   NtClose  (160, ... ) == 0x0
 02197   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02198   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02199   896   NtQueryDefaultLocale  (1, 1230992, ... ) == 0x0
 02200   896   NtQueryVirtualMemory  (-1, 0xb60000, Basic, 28, ... {BaseAddress=0xb60000,AllocationBase=0xb60000,AllocationProtect=0x2,RegionSize=0x5f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02201   896   NtUnmapViewOfSection  (-1, 0xb60000, ... ) == 0x0
 02202   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02203   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02204   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 160, ) == 0x0
 02205   896   NtQueryInformationToken  (160, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02206   896   NtClose  (160, ... ) == 0x0
 02207   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02208   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02209   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02210   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1231592, ... ) }, 1231592, ... ) == 0x0
 02211   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02212   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1231020, 616, BothDirectory, 1,  (160, 0, 0, 0, 1231020, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02213   896   NtClose  (160, ... ) == 0x0
 02214   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02215   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1231020, 616, BothDirectory, 1,  (160, 0, 0, 0, 1231020, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02216   896   NtClose  (160, ... ) == 0x0
 02217   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 02218   896   NtQueryDirectoryFile  (160, 0, 0, 0, 1231020, 616, BothDirectory, 1,  (160, 0, 0, 0, 1231020, 616, BothDirectory, 1, "cmd.exe", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02219   896   NtClose  (160, ... ) == 0x0
 02220   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02221   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02222   896   NtWaitForSingleObject  (140, 0, {-1000000, -1}, ... ) == 0x0
 02223   896   NtReleaseMutant  (140, ... 0x0, ) == 0x0
 02224   896   NtUnmapViewOfSection  (-1, 0xce0000, ... ) == 0x0
 02225   896   NtClose  (152, ... ) == 0x0
 02226   896   NtClose  (136, ... ) == 0x0
 02227   896   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 02228   896   NtOpenProcessToken  (-1, 0xa, ... 136, ) == 0x0
 02229   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 152, ) }, ... 152, ) == 0x0
 02230   896   NtQueryKey  (152, Basic, 520, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (152, Basic, 520, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="CodeIdentifierso"}, 46, ) }, 46, ) == 0x0
 02231   896   NtClose  (152, ... ) == 0x0
 02232   896   NtOpenKey  (0x2000000, {24, 104, 0x40, 0, 0,  (0x2000000, {24, 104, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02233   896   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 152, ) }, ... 152, ) == 0x0
 02234   896   NtQuerySymbolicLinkObject  (152, ...  (152, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 02235   896   NtClose  (152, ... ) == 0x0
 02236   896   NtQueryVolumeInformationFile  (156, 1231704, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02237   896   NtQueryInformationFile  (156, 1231820, 528, Name, ... {status=0x0, info=54}, ) == 0x0
 02238   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02239   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02240   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe"}, 1230992, ... ) }, 1230992, ... ) == 0x0
 02241   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 152, {status=0x0, info=1}, ) }, 3, 16417, ... 152, {status=0x0, info=1}, ) == 0x0
 02242   896   NtQueryDirectoryFile  (152, 0, 0, 0, 1230420, 616, BothDirectory, 1,  (152, 0, 0, 0, 1230420, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02243   896   NtClose  (152, ... ) == 0x0
 02244   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 152, {status=0x0, info=1}, ) }, 3, 16417, ... 152, {status=0x0, info=1}, ) == 0x0
 02245   896   NtQueryDirectoryFile  (152, 0, 0, 0, 1230420, 616, BothDirectory, 1,  (152, 0, 0, 0, 1230420, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02246   896   NtClose  (152, ... ) == 0x0
 02247   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 152, {status=0x0, info=1}, ) }, 3, 16417, ... 152, {status=0x0, info=1}, ) == 0x0
 02248   896   NtQueryDirectoryFile  (152, 0, 0, 0, 1230420, 616, BothDirectory, 1,  (152, 0, 0, 0, 1230420, 616, BothDirectory, 1, "cmd.exe", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02249   896   NtClose  (152, ... ) == 0x0
 02250   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02251   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02252   896   NtQueryInformationFile  (156, 1233860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02253   896   NtCreateSection  (0xf0005, 0x0, {388608, 0}, 2, 134217728, 156, ... 152, ) == 0x0
 02254   896   NtMapViewOfSection  (152, -1, (0x0), 0, 0, {0, 0}, 388608, 1, 0, 2, ... (0xb60000), {0, 0}, 389120, ) == 0x0
 02255   896   NtClose  (152, ... ) == 0x0
 02256   896   NtUnmapViewOfSection  (-1, 0xb60000, ... ) == 0x0
 02257   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 152, ) }, ... 152, ) == 0x0
 02258   896   NtQueryValueKey  (152,  (152, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02259   896   NtClose  (152, ... ) == 0x0
 02260   896   NtQueryInformationToken  (136, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 02261   896   NtQueryInformationToken  (136, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 02262   896   NtClose  (136, ... ) == 0x0
 02263   896   NtQuerySection  (132, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02264   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02265   896   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 02266   896   NtCreateProcessEx  (1235784, 2035711, 0, -1, 0, 132, 0, 0, 0, ... ) == 0x0
 02267   896   NtQueryInformationProcess  (136, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd8000,AffinityMask=0x1,BasePriority=8,Pid=860,ParentPid=1252,}, 0x0, ) == 0x0
 02268   896   NtReadVirtualMemory  (136, 0x7ffd8008, 4, ...  (136, 0x7ffd8008, 4, ... "\0\0\320J", 0x0, ) , 0x0, ) == 0x0
 02269   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\cmd.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02270   896   NtReadVirtualMemory  (136, 0x4ad00000, 4096, ...  (136, 0x4ad00000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\35\355\325\352Y\214\273\271Y\214\273\271Y\214\273\271\232\203\264\271_\214\273\271Y\214\272\271\200\214\273\271\232\203\346\271^\214\273\271\346\203\333\271[\214\273\271\232\203\345\271X\214\273\271\232\203\344\271m\214\273\271\232\203\341\271X\214\273\271RichY\214\273\271\0\0\0\0\0\0\0\0PE\0\0L\1\3\0\276~\20A\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0\366\1\0\0\366\3\0\0\0\0\0VP\0\0\0\20\0\0\0\360\1\0\0\0\320J\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\20\6\0\0\4\0\0\224$\6\0\3\0\0\200\0\0\20\0\0\0\20\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\366\1\0P\0\0\0\0\340\3\0\260(\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\5\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\223\1\0H\0\0\0H\2\0\0X\0\0\0\0\20\0\0\0\3\0\0\340\362\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\340\365\1\0\0\20\0\0\0\366\1\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 02271   896   NtReadVirtualMemory  (136, 0x4ad3e000, 256, ...  (136, 0x4ad3e000, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\3\0\0\00\0\0\200\13\0\0\0\200\0\0\200\16\0\0\0\230\0\0\200\20\0\0\0\260\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\1\0\0\0\310\0\0\200\2\0\0\0\340\0\0\200\3\0\0\0\370\0\0\200\4\0\0\0\20\1\0\200\5\0\0\0(\1\0\200\6\0\0\0@\1\0\200\7\0\0\0X\1\0\200\10\0\0\0p\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\1\0\0\0\210\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\200\2\0\200\240\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\1\0\0\0\270\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\4\0\0\320\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\4\0\0\340\1\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 02272   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02273   896   NtQueryInformationProcess  (136, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd8000,AffinityMask=0x1,BasePriority=8,Pid=860,ParentPid=1252,}, 0x0, ) == 0x0
 02274   896   NtAllocateVirtualMemory  (-1, 0, 0, 2468, 4096, 4, ... 11927552, 4096, ) == 0x0
 02275   896   NtAllocateVirtualMemory  (136, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 02276   896   NtWriteVirtualMemory  (136, 0x10000,  (136, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 02277   896   NtAllocateVirtualMemory  (136, 0, 0, 2468, 4096, 4, ... 131072, 4096, ) == 0x0
 02278   896   NtWriteVirtualMemory  (136, 0x20000,  (136, 0x20000, "\0\20\0\0\244\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0\26\0\10\2\220\2\0\0\0\0\0\0\364\3\366\3\230\4\0\06\08\0\220\10\0\0~\0\200\0\310\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\06\08\0H\11\0\0\36\0 \0\200\11\0\0\0\0\2\0\240\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2468, ... 0x0, ) , 2468, ... 0x0, ) == 0x0
 02279   896   NtWriteVirtualMemory  (136, 0x7ffd8010,  (136, 0x7ffd8010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02280   896   NtAllocateVirtualMemory  (136, 0, 0, 388, 4096, 4, ... 196608, 4096, ) == 0x0
 02281   896   NtWriteVirtualMemory  (136, 0x30000,  (136, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\1\0\0\253\355\15\254\262=\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 388, ... 0x0, ) , 388, ... 0x0, ) == 0x0
 02282   896   NtWriteVirtualMemory  (136, 0x7ffd81e8,  (136, 0x7ffd81e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02283   896   NtFreeVirtualMemory  (-1, (0xb60000), 0, 32768, ... (0xb60000), 4096, ) == 0x0
 02284   896   NtReadVirtualMemory  (136, 0x7ffd8010, 4, ...  (136, 0x7ffd8010, 4, ... "\0\0\2\0", 0x0, ) , 0x0, ) == 0x0
 02285   896   NtAllocateVirtualMemory  (136, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0
 02286   896   NtAllocateVirtualMemory  (136, 262144, 0, 1048576, 4096, 4, ... 262144, 1048576, ) == 0x0
 02287   896   NtCreateThread  (0x1f03ff, 0x0, 136, 1235792, 1235456, 1, ... 152, {860, 320}, ) == 0x0
 02288   896   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 6619256, 0, 0, 0}  (24, {168, 196, new_msg, 0, 6619256, 0, 0, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\210\0\0\0\230\0\0\0\\3\0\0@\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\221|D\342\22\0" ... {168, 196, reply, 0, 1252, 896, 82649, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\210\0\0\0\230\0\0\0\\3\0\0@\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\221|D\342\22\0" )  ... {168, 196, reply, 0, 1252, 896, 82649, 0}  (24, {168, 196, new_msg, 0, 6619256, 0, 0, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\210\0\0\0\230\0\0\0\\3\0\0@\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\221|D\342\22\0" ... {168, 196, reply, 0, 1252, 896, 82649, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\210\0\0\0\230\0\0\0\\3\0\0@\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\221|D\342\22\0" )  ) == 0x0
 02289   896   NtResumeThread  (152, ... 1, ) == 0x0
 02290   896   NtClose  (156, ... ) == 0x0
 02291   896   NtClose  (132, ... ) == 0x0
 02292   896   NtQueryInformationProcess  (136, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd8000,AffinityMask=0x1,BasePriority=8,Pid=860,ParentPid=1252,}, 0x0, ) == 0x0
 02293   896   NtUserWaitForInputIdle  (860, 30000, 0, ... ) == 0xffffffff
 02294   896   NtClose  (136, ... ) == 0x0
 02295   896   NtClose  (152, ... ) == 0x0
 02296   896   NtTerminateProcess  (0, 1, ...
 00941  2016   NtWaitForMultipleObjects  ... ) == 0xc0
 02296   896   NtTerminateProcess  ... ) == 0x0
 02297   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xb,}, 4, ... ) == 0x0
 02298   896   NtQueryVirtualMemory  (-1, 0xae6d20, Basic, 28, ... {BaseAddress=0xae6000,AllocationBase=0xab0000,AllocationProtect=0x80,RegionSize=0x3c000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02299   896   NtQueryVirtualMemory  (-1, 0xae762c, Basic, 28, ... {BaseAddress=0xae7000,AllocationBase=0xab0000,AllocationProtect=0x80,RegionSize=0x3b000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02300   896   NtQueryVirtualMemory  (-1, 0xabcef4, Basic, 28, ... {BaseAddress=0xabc000,AllocationBase=0xab0000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02301   896   NtGdiDeleteObjectApp  (2097808862, ... ) == 0x1
 02302   896   NtGdiDeleteObjectApp  (-771094889, ... ) == 0x1
 02303   896   NtGdiDeleteObjectApp  (-1022753048, ... ) == 0x1
 02304   896   NtUserDestroyCursor  (4522625, 1, ... ) == 0x1
 02305   896   NtUserDestroyCursor  (4915711, 1, ... ) == 0x1
 02306   896   NtUserDestroyCursor  (1638799, 1, ... ) == 0x1
 02307   896   NtUserDestroyCursor  (2884243, 1, ... ) == 0x1
 02308   896   NtUserDestroyCursor  (2425495, 1, ... ) == 0x1
 02309   896   NtUserDestroyCursor  (22544723, 1, ... ) == 0x1
 02310   896   NtUserDestroyCursor  (537329821, 1, ... ) == 0x1
 02311   896   NtUserFindExistingCursorIcon  (1241856, 1241872, 1241920, ... ) == 0x10011
 02312   896   NtUserGetThreadState  (2, ... ) == 0x0
 02313   896   NtDeleteAtom  (49194, ... ) == 0x0
 02314   896   NtDeleteAtom  (49193, ... ) == 0x0
 02315   896   NtGdiDeleteObjectApp  (1678247318, ... ) == 0x1
 02316   896   NtClose  (128, ... ) == 0x0
 02317   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xa,}, 4, ... ) == 0x0
 02318   896   NtUserGetAtomName  (49211, 1241944, ... ) == 0xf
 02319   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02320   896   NtUserGetAtomName  (49213, 1241944, ... ) == 0xd
 02321   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02322   896   NtUserGetAtomName  (49215, 1241944, ... ) == 0x10
 02323   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02324   896   NtUserGetAtomName  (49217, 1241944, ... ) == 0x12
 02325   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02326   896   NtUserGetAtomName  (49219, 1241944, ... ) == 0xd
 02327   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02328   896   NtUserGetAtomName  (49221, 1241944, ... ) == 0xb
 02329   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02330   896   NtUserGetAtomName  (49223, 1241944, ... ) == 0xf
 02331   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02332   896   NtUserGetAtomName  (49225, 1241944, ... ) == 0xd
 02333   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02334   896   NtUserGetAtomName  (49227, 1241944, ... ) == 0x11
 02335   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02336   896   NtUserGetAtomName  (49229, 1241944, ... ) == 0xf
 02337   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02338   896   NtUserGetAtomName  (49231, 1241944, ... ) == 0x11
 02339   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02340   896   NtUserGetAtomName  (49233, 1241944, ... ) == 0xf
 02341   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02342   896   NtUserGetAtomName  (49235, 1241944, ... ) == 0xc
 02343   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02344   896   NtUserGetAtomName  (49237, 1241936, ... ) == 0xd
 02345   896   NtUserUnregisterClass  (1241996, 1560870912, 1241984, ... ) == 0x1
 02346   896   NtUserGetAtomName  (49239, 1241936, ... ) == 0x11
 02347   896   NtUserUnregisterClass  (1241996, 1560870912, 1241984, ... ) == 0x1
 02348   896   NtUserGetAtomName  (49241, 1241944, ... ) == 0xc
 02349   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02350   896   NtUserGetAtomName  (49243, 1241944, ... ) == 0xe
 02351   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02352   896   NtUserGetAtomName  (49245, 1241944, ... ) == 0x8
 02353   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02354   896   NtUserGetAtomName  (49247, 1241944, ... ) == 0xd
 02355   896   NtUserUnregisterClass  (1242004, 1560870912, 1241992, ... ) == 0x1
 02356   896   NtUnmapViewOfSection  (-1, 0xbd0000, ... ) == 0x0
 02357   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 02358   896   NtFreeVirtualMemory  (-1, (0xa90000), 0, 32768, ... (0xa90000), 65536, ) == 0x0
 02359   896   NtUserGetAtomName  (49211, 1241976, ... ) == 0xf
 02360   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02361   896   NtUserGetAtomName  (49213, 1241976, ... ) == 0xd
 02362   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02363   896   NtUserGetAtomName  (49215, 1241976, ... ) == 0x10
 02364   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02365   896   NtUserGetAtomName  (49217, 1241976, ... ) == 0x12
 02366   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02367   896   NtUserGetAtomName  (49219, 1241976, ... ) == 0xd
 02368   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02369   896   NtUserGetAtomName  (49221, 1241976, ... ) == 0xb
 02370   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02371   896   NtUserGetAtomName  (49223, 1241976, ... ) == 0xf
 02372   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02373   896   NtUserGetAtomName  (49225, 1241976, ... ) == 0xd
 02374   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02375   896   NtUserGetAtomName  (49227, 1241976, ... ) == 0x11
 02376   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02377   896   NtUserGetAtomName  (49229, 1241976, ... ) == 0xf
 02378   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02379   896   NtUserGetAtomName  (49231, 1241976, ... ) == 0x11
 02380   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02381   896   NtUserGetAtomName  (49233, 1241976, ... ) == 0xf
 02382   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02383   896   NtUserGetAtomName  (49235, 1241976, ... ) == 0xc
 02384   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02385   896   NtUserGetAtomName  (49237, 1241968, ... ) == 0xd
 02386   896   NtUserUnregisterClass  (1242028, 2000486400, 1242016, ... ) == 0x1
 02387   896   NtUserGetAtomName  (49239, 1241968, ... ) == 0x11
 02388   896   NtUserUnregisterClass  (1242028, 2000486400, 1242016, ... ) == 0x1
 02389   896   NtUserGetAtomName  (49241, 1241976, ... ) == 0xc
 02390   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02391   896   NtUserGetAtomName  (49243, 1241976, ... ) == 0xe
 02392   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02393   896   NtUserGetAtomName  (49245, 1241976, ... ) == 0x8
 02394   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02395   896   NtUserGetAtomName  (49247, 1241976, ... ) == 0xd
 02396   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02397   896   NtUserGetAtomName  (49175, 1241976, ... ) == 0x6
 02398   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02399   896   NtUserGetAtomName  (49177, 1241976, ... ) == 0x6
 02400   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02401   896   NtUserGetAtomName  (49176, 1241976, ... ) == 0x4
 02402   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02403   896   NtUserGetAtomName  (49178, 1241976, ... ) == 0x7
 02404   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02405   896   NtUserGetAtomName  (49180, 1241976, ... ) == 0x8
 02406   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02407   896   NtUserGetAtomName  (49182, 1241976, ... ) == 0x9
 02408   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02409   896   NtUserGetAtomName  (49179, 1241968, ... ) == 0x9
 02410   896   NtUserUnregisterClass  (1242028, 2000486400, 1242016, ... ) == 0x1
 02411   896   NtUserGetAtomName  (49256, 1241976, ... ) == 0x7
 02412   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02413   896   NtUserGetAtomName  (49258, 1241976, ... ) == 0xd
 02414   896   NtUserUnregisterClass  (1242036, 2000486400, 1242024, ... ) == 0x1
 02415   896   NtUnmapViewOfSection  (-1, 0xaa0000, ... ) == 0x0
 02416   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0
 02417   896   NtDeviceIoControlFile  (60, 64, 0x0, 0x12f49c, 0x22415c,  (60, 64, 0x0, 0x12f49c, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#D\0\0\0\0\0\0\0\10 \210\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#D\0\0\0\0\0\0\0\10 \210\0\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (60, 64, 0x0, 0x12f49c, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#D\0\0\0\0\0\0\0\10 \210\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#D\0\0\0\0\0\0\0\10 \210\0\306\205\337w", ) , ) == 0x0
 02418   896   NtDeviceIoControlFile  (60, 64, 0x0, 0x12f464, 0x228168,  (60, 64, 0x0, 0x12f464, 0x228168, "D\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 02419   896   NtDeviceIoControlFile  (60, 64, 0x0, 0x12f49c, 0x22415c,  (60, 64, 0x0, 0x12f49c, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344`\0\0\0\0\0\0\0\10 \210\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344`\0\0\0\0\0\0\0\10 \210\0\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (60, 64, 0x0, 0x12f49c, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344`\0\0\0\0\0\0\0\10 \210\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344`\0\0\0\0\0\0\0\10 \210\0\306\205\337w", ) , ) == 0x0
 02420   896   NtDeviceIoControlFile  (60, 64, 0x0, 0x12f464, 0x228168,  (60, 64, 0x0, 0x12f464, 0x228168, "`\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 02421   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 02422   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0
 02423   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0
 02424   896   NtClose  (52, ... ) == 0x0
 02425   896   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 02426   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 02427   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 02428   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02429   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 52, ) }, ... 52, ) == 0x0
 02430   896   NtQueryValueKey  (52,  (52, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02431   896   NtClose  (52, ... ) == 0x0
 02432   896   NtClose  (44, ... ) == 0x0
 02433   896   NtClose  (60, ... ) == 0x0
 02434   896   NtFreeVirtualMemory  (-1, (0xb50000), 4096, 32768, ... (0xb50000), 4096, ) == 0x0
 02435   896   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1684890460, 1702389038, 0, 0}  (24, {20, 48, new_msg, 0, 1684890460, 1702389038, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {20, 48, reply, 0, 1252, 896, 82901, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0" )  ... {20, 48, reply, 0, 1252, 896, 82901, 0}  (24, {20, 48, new_msg, 0, 1684890460, 1702389038, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {20, 48, reply, 0, 1252, 896, 82901, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0" )  ) == 0x0
 02436   896   NtTerminateProcess  (-1, 1, ...