Summary:


NtConnectPort(>) 
 1 
NtQueryInformationJobObject(>) 
 2 
NtEnumerateKey(>) 
 8 
NtUserRegisterClassExWOW(>) 
 33 

NtCreateProcessEx(>) 
 1 
NtQueryPerformanceCounter(>) 
 2 
NtFsControlFile(>) 
 8 
NtOpenSection(>) 
 35 

NtDuplicateToken(>) 
 1 
NtUserCloseWindowStation(>) 
 2 
NtGdiCreateBitmap(>) 
 8 
NtSetInformationThread(>) 
 35 

NtGdiCreatePaletteInternal(>) 
 1 
NtAddAtom(>) 
 3 
NtQueryVolumeInformationFile(>) 
 8 
NtCreateFile(>) 
 39 

NtGdiInit(>) 
 1 
NtCallbackReturn(>) 
 3 
NtSetValueKey(>) 
 8 
NtQueryInformationToken(>) 
 39 

NtGdiQueryFontAssocInfo(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtUserSystemParametersInfo(>) 
 8 
NtRequestWaitReplyPort(>) 
 40 

NtNotifyChangeKey(>) 
 1 
NtOpenDirectoryObject(>) 
 3 
NtWaitForMultipleObjects(>) 
 9 
NtQueryInformationProcess(>) 
 41 

NtOpenEvent(>) 
 1 
NtOpenMutant(>) 
 3 
NtGdiCreateCompatibleDC(>) 
 10 
NtCreateEvent(>) 
 43 

NtOpenKeyedEvent(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 3 
NtGdiExtGetObjectW(>) 
 10 
NtQueryDirectoryFile(>) 
 44 

NtOpenProcess(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 3 
NtUserGetDC(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 48 

NtQueryInstallUILanguage(>) 
 1 
NtReadVirtualMemory(>) 
 3 
NtCreateKey(>) 
 12 
NtQueryDefaultLocale(>) 
 51 

NtQueryObject(>) 
 1 
NtReleaseMutant(>) 
 3 
NtQueryDefaultUILanguage(>) 
 12 
NtFreeVirtualMemory(>) 
 54 

NtQuerySystemTime(>) 
 1 
NtSetInformationObject(>) 
 3 
NtQueryInformationFile(>) 
 12 
NtGdiSelectBitmap(>) 
 57 

NtQueryTimerResolution(>) 
 1 
NtDuplicateObject(>) 
 4 
NtGdiDeleteObjectApp(>) 
 14 
NtOpenFile(>) 
 61 

NtRaiseException(>) 
 1 
NtCreateMutant(>) 
 5 
NtQueryDebugFilterState(>) 
 14 
NtUnmapViewOfSection(>) 
 64 

NtSecureConnectPort(>) 
 1 
NtWriteVirtualMemory(>) 
 5 
NtUserSelectPalette(>) 
 14 
NtUserFindWindowEx(>) 
 65 

NtUserCallNoParam(>) 
 1 
NtSetInformationFile(>) 
 6 
NtQuerySection(>) 
 19 
NtQueryVirtualMemory(>) 
 67 

NtUserEnumDisplayMonitors(>) 
 1 
NtUserRegisterWindowMessage(>) 
 6 
NtUserCallOneParam(>) 
 19 
NtQueryAttributesFile(>) 
 75 

NtUserGetForegroundWindow(>) 
 1 
NtGdiBitBlt(>) 
 7 
NtDeviceIoControlFile(>) 
 22 
NtSetEvent(>) 
 86 

NtUserGetKeyboardLayoutList(>) 
 1 
NtGdiCreateDIBitmapInternal(>) 
 7 
NtQueryInformationThread(>) 
 25 
NtQuerySystemInformation(>) 
 91 

NtUserGetObjectInformation(>) 
 1 
NtGdiGetDCObject(>) 
 7 
NtReadFile(>) 
 25 
NtCreateSection(>) 
 95 

NtUserGetProcessWindowStation(>) 
 1 
NtGdiGetDCforBitmap(>) 
 7 
NtSetInformationProcess(>) 
 25 
NtMapViewOfSection(>) 
 102 

NtUserGetThreadDesktop(>) 
 1 
NtGdiGetStockObject(>) 
 7 
NtCreateThread(>) 
 26 
NtWaitForSingleObject(>) 
 110 

NtUserOpenWindowStation(>) 
 1 
NtGdiRestoreDC(>) 
 7 
NtRegisterThreadTerminatePort(>) 
 26 
NtFlushInstructionCache(>) 
 120 

NtUserQueryWindow(>) 
 1 
NtGdiSaveDC(>) 
 7 
NtResumeThread(>) 
 26 
NtOpenKey(>) 
 189 

NtUserSetWindowsHookEx(>) 
 1 
NtGdiSetDIBitsToDeviceInternal(>) 
 7 
NtTestAlert(>) 
 26 
NtQueryValueKey(>) 
 205 

NtUserValidateHandleSecure(>) 
 1 
NtOpenProcessToken(>) 
 7 
NtOpenProcessTokenEx(>) 
 30 
NtAllocateVirtualMemory(>) 
 232 

NtAccessCheck(>) 
 2 
NtOpenThreadToken(>) 
 7 
NtOpenThreadTokenEx(>) 
 30 
NtProtectVirtualMemory(>) 
 271 

NtCreateIoCompletion(>) 
 2 
NtUserSetCursorIconData(>) 
 7 
NtWriteFile(>) 
 30 
NtDelayExecution(>) 
 323 

NtGdiCreateSolidBrush(>) 
 2 
NtCreateSemaphore(>) 
 8 
NtContinue(>) 
 33 
NtClose(>) 
 395 


Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147481368, {status=0x0, info=1}, ) }, 0, 32, ... -2147481368, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147481368, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147481368, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147481368, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147481368, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147481368, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147481368, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147481368, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147481368, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147481368, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147481368, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147481368, 0, 0x0, 0x0, 0x90120,  (-2147481368, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147481480, ) == 0x0
 00059   896   NtClose  (-2147481480, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481480, ... -2147482136, ) == 0x0
 00061   896   NtClose  (-2147482136, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482136, ... -2147482748, ) == 0x0
 00063   896   NtClose  (-2147482748, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482748, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147481480, ... ) == 0x0
 00105   896   NtClose  (-2147482136, ... ) == 0x0
 00106   896   NtClose  (-2147482748, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147482748, ) == 0x0
 00145   896   NtClose  (-2147482748, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482748, ... -2147482136, ) == 0x0
 00147   896   NtClose  (-2147482136, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482136, ... -2147481480, ) == 0x0
 00149   896   NtClose  (-2147481480, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481480, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147482748, ... ) == 0x0
 00178   896   NtClose  (-2147482136, ... ) == 0x0
 00179   896   NtClose  (-2147481480, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147481368, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x512000), 4096, 4, ... (0x512000), 4096, 8, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x512000), 4096, 8, ... (0x512000), 4096, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 5316608, 4096, ... ) == 0x0
 00249   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00250   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 00251   896   NtClose  (16, ... ) == 0x0
 00252   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00253   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00254   896   NtClose  (16, ... ) == 0x0
 00255   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00256   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00257   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00258   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00259   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00260   896   NtClose  (16, ... ) == 0x0
 00261   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00262   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00263   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00264   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00265   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00266   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00267   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00268   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00269   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00270   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00271   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00272   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00273   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00274   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00275   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00276   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00277   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00278   896   NtClose  (16, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00283   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00284   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00285   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00286   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00287   896   NtClose  (16, ... ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00289   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00290   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00291   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00292   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00293   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00294   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00295   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00296   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00297   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00298   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00299   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00300   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00301   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00302   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00303   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00304   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00305   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00306   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00307   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00308   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00309   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00310   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00311   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00312   896   NtProtectVirtualMemory  (-1, (0x512000), 4096, 4, ... (0x512000), 4096, 4, ) == 0x0
 00313   896   NtProtectVirtualMemory  (-1, (0x512000), 4096, 4, ... (0x512000), 4096, 4, ) == 0x0
 00314   896   NtFlushInstructionCache  (-1, 5316608, 4096, ... ) == 0x0
 00315   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00316   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00317   896   NtReadFile  (16, 0, 0, 0, 4, {1287630, 0}, 0, ... {status=0x0, info=4},  (16, 0, 0, 0, 4, {1287630, 0}, 0, ... {status=0x0, info=4}, "\345\20\351\0", ) , ) == 0x0
 00318   896   NtClose  (16, ... ) == 0x0
 00319   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00320   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00321   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00322   896   NtClose  (16, ... ) == 0x0
 00323   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00324   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00325   896   NtClose  (16, ... ) == 0x0
 00326   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00327   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00328   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00329   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00330   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00331   896   NtQueryValueKey  (16,  (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00332   896   NtClose  (16, ... ) == 0x0
 00333   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 16, ) }, ... 16, ) == 0x0
 00334   896   NtQueryValueKey  (16,  (16, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00335   896   NtClose  (16, ... ) == 0x0
 00336   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 16, ) }, ... 16, ) == 0x0
 00337   896   NtSetInformationObject  (16, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00338   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00339   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00340   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00341   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242044}  (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242044} "\210\6!\1\0\0\0\0\0\0\0\0\30\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\30\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242044} "\210\6!\1\0\0\0\0\0\0\0\0\30\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\30\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00342   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00343   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 28, ) }, ... 28, ) == 0x0
 00344   896   NtQueryValueKey  (28,  (28, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00345   896   NtClose  (28, ... ) == 0x0
 00346   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00347   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0
 00348   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00349   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 32, ) == 0x0
 00350   896   NtClose  (28, ... ) == 0x0
 00351   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x610000), 0x0, 110592, ) == 0x0
 00352   896   NtClose  (32, ... ) == 0x0
 00353   896   NtUnmapViewOfSection  (-1, 0x610000, ... ) == 0x0
 00354   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0
 00355   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00356   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 32, ... 28, ) == 0x0
 00357   896   NtClose  (32, ... ) == 0x0
 00358   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x610000), 0x0, 110592, ) == 0x0
 00359   896   NtClose  (28, ... ) == 0x0
 00360   896   NtUnmapViewOfSection  (-1, 0x610000, ... ) == 0x0
 00361   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0
 00362   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00363   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0
 00364   896   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00365   896   NtOpenProcessToken  (-1, 0x8, ... 36, ) == 0x0
 00366   896   NtQueryInformationToken  (36, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00367   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00368   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 40, ) }, ... 40, ) == 0x0
 00369   896   NtQueryValueKey  (40,  (40, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (40, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00370   896   NtClose  (40, ... ) == 0x0
 00371   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00372   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 40, ) == 0x0
 00373   896   NtQueryInformationToken  (40, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00374   896   NtClose  (40, ... ) == 0x0
 00375   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00376   896   NtClose  (36, ... ) == 0x0
 00377   896   NtClose  (28, ... ) == 0x0
 00378   896   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00379   896   NtClose  (32, ... ) == 0x0
 00380   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00381   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00382   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00383   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00384   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00385   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00386   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00387   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00388   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00389   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00390   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00391   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00392   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0
 00393   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00394   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00395   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00396   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMCTL32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00397   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0
 00398   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00399   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0
 00400   896   NtQueryValueKey  (32,  (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00401   896   NtClose  (32, ... ) == 0x0
 00402   896   NtMapViewOfSection  (-2147481368, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x610000), 0x0, 1060864, ) == 0x0
 00403   896   NtClose  (-2147481368, ... ) == 0x0
 00404   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00405   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00406   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147481368, ) == 0x0
 00407   896   NtQueryInformationToken  (-2147481368, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00408   896   NtQueryInformationToken  (-2147481368, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00409   896   NtClose  (-2147481368, ... ) == 0x0
 00410   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00411   896   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00412   896   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00413   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00414   896   NtQueryValueKey  (-2147481368,  (-2147481368, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00415   896   NtClose  (-2147481368, ... ) == 0x0
 00416   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00417   896   NtQueryValueKey  (-2147481368,  (-2147481368, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00418   896   NtClose  (-2147481368, ... ) == 0x0
 00419   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00420   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00421   896   NtUserCallNoParam  (24, ... ) == 0x0
 00422   896   NtGdiCreateCompatibleDC  (0, ...
 00423   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00422   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00424   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00425   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00426   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00427   896   NtGdiCreateSolidBrush  (0, 0, ...
 00428   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 10616832, 4096, ) == 0x0
 00427   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00429   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00430   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00431   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00432   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x24
 00433   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00434   896   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00435   896   NtClose  (44, ... ) == 0x0
 00436   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00437   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x8177c017
 00438   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00439   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x8177c01c
 00440   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00441   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x8177c01e
 00442   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00443   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x81778002
 00444   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10013
 00445   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x8177c018
 00446   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00447   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x8177c01a
 00448   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00449   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x8177c01d
 00450   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00451   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x8177c026
 00452   896   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00453   896   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x8177c019
 00454   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c020
 00455   896   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8177c022
 00456   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c023
 00457   896   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8177c024
 00458   896   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8177c025
 00459   896   NtCallbackReturn  (0, 0, 0, ...
 00460   896   NtGdiInit  (... ) == 0x1
 00461   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00462   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00463   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00464   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 10682368, 65536, ) == 0x0
 00465   896   NtAllocateVirtualMemory  (-1, 10682368, 0, 4096, 4096, 4, ... 10682368, 4096, ) == 0x0
 00466   896   NtAllocateVirtualMemory  (-1, 10686464, 0, 8192, 4096, 4, ... 10686464, 8192, ) == 0x0
 00467   896   NtAllocateVirtualMemory  (-1, 10694656, 0, 4096, 4096, 4, ... 10694656, 4096, ) == 0x0
 00468   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00469   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xa40000), 0x0, 12288, ) == 0x0
 00470   896   NtClose  (44, ... ) == 0x0
 00471   896   NtAllocateVirtualMemory  (-1, 10698752, 0, 4096, 4096, 4, ... 10698752, 4096, ) == 0x0
 00472   896   NtQueryDefaultUILanguage  (1241688, ...
 00473   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00474   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 00475   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00476   896   NtClose  (-2147481368, ... ) == 0x0
 00477   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00478   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00479   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00480   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00481   896   NtClose  (-2147481452, ... ) == 0x0
 00482   896   NtClose  (-2147481368, ... ) == 0x0
 00472   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00483   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.dll"}, 1, 96, ... 44, {status=0x0, info=1}, ) }, 1, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00484   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 44, ... 48, ) == 0x0
 00485   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa50000), 0x0, 618496, ) == 0x0
 00486   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00487   896   NtQueryDefaultUILanguage  (2090319928, ...
 00488   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00489   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 00490   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00491   896   NtClose  (-2147481368, ... ) == 0x0
 00492   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00493   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00495   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00496   896   NtClose  (-2147481452, ... ) == 0x0
 00497   896   NtClose  (-2147481368, ... ) == 0x0
 00487   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00498   896   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00499   896   NtQueryDefaultLocale  (1, 1239784, ... ) == 0x0
 00500   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00501   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240820, 1179817, 1240544}  (24, {128, 156, new_msg, 0, 2088850039, 1240820, 1179817, 1240544} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1,\0\0\0\377\377\377\377\0\0\0\0\340q\254\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0\350\362\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81835, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1,\0\0\0\377\377\377\377\0\0\0\0\340q\254\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0\350\362\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81835, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240820, 1179817, 1240544} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1,\0\0\0\377\377\377\377\0\0\0\0\340q\254\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0\350\362\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81835, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1,\0\0\0\377\377\377\377\0\0\0\0\340q\254\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0\350\362\22\0\0\0\0\0" )  ) == 0x0
 00502   896   NtClose  (44, ... ) == 0x0
 00503   896   NtClose  (48, ... ) == 0x0
 00504   896   NtUnmapViewOfSection  (-1, 0xa50000, ... ) == 0x0
 00505   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00506   896   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 48, ) == 0x0
 00507   896   NtQueryInformationProcess  (48, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00508   896   NtClose  (48, ... ) == 0x0
 00509   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00510   896   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 00511   896   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 00512   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00513   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 48, ) == 0x0
 00514   896   NtQueryInformationToken  (48, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00515   896   NtClose  (48, ... ) == 0x0
 00516   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 48, ) }, ... 48, ) == 0x0
 00517   896   NtOpenProcessToken  (-1, 0x8, ... 44, ) == 0x0
 00518   896   NtAccessCheck  (1329168, 44, 0x1, 1242880, 1242932, 56, 1242912, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00519   896   NtClose  (44, ... ) == 0x0
 00520   896   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Control Panel\Desktop"}, ... 44, ) }, ... 44, ) == 0x0
 00521   896   NtQueryValueKey  (44,  (44, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00522   896   NtClose  (44, ... ) == 0x0
 00523   896   NtUserSystemParametersInfo  (41, 500, 1243060, 0, ... ) == 0x1
 00524   896   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 00525   896   NtClose  (48, ... ) == 0x0
 00526   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00527   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00528   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c03b
 00529   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c03d
 00530   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00531   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c03f
 00532   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00533   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c041
 00534   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00535   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c043
 00536   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c045
 00537   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00538   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c047
 00539   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00540   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c049
 00541   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00542   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c04b
 00543   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00544   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c04d
 00545   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00546   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c04f
 00547   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c051
 00548   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00549   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c053
 00550   896   NtUserFindExistingCursorIcon  (1242808, 1242824, 1242872, ... ) == 0x10011
 00551   896   NtUserRegisterClassExWOW  (1242752, 1242820, 1242836, 1242852, 0, 384, 0, ... ) == 0x8177c055
 00552   896   NtUserFindExistingCursorIcon  (1242808, 1242824, 1242872, ... ) == 0x10011
 00553   896   NtUserRegisterClassExWOW  (1242752, 1242820, 1242836, 1242852, 0, 384, 0, ... ) == 0x8177c057
 00554   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00555   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c059
 00556   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10013
 00557   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c05b
 00558   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00559   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c05d
 00560   896   NtUserFindExistingCursorIcon  (1242812, 1242828, 1242876, ... ) == 0x10011
 00561   896   NtUserRegisterClassExWOW  (1242756, 1242824, 1242840, 1242856, 0, 384, 0, ... ) == 0x8177c05f
 00562   896   NtTestAlert  (... ) == 0x0
 00563   896   NtContinue  (1244464, 1, ...
 00564   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x607000,}, 4, ... ) == 0x0
 00565   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00566   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 48, ) == 0x0
 00567   896   NtQueryInformationToken  (48, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00568   896   NtClose  (48, ... ) == 0x0
 00569   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 48, ) }, ... 48, ) == 0x0
 00570   896   NtSetInformationObject  (48, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00571   896   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 44, ) }, ... 44, ) == 0x0
 00572   896   NtQueryValueKey  (44,  (44, "PINF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00573   896   NtClose  (44, ... ) == 0x0
 00574   896   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00575   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1234112,  (0x80100080, {24, 0, 0x40, 0, 1234112, "\??\u:\work\packed.exe"}, 0x0, 1, 1, 1, 96, 0, 0, ... 44, {status=0x0, info=1}, ) }, 0x0, 1, 1, 1, 96, 0, 0, ... 44, {status=0x0, info=1}, ) == 0x0
 00576   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp"}, 1233816, ... ) }, 1233816, ... ) == 0x0
 00577   896   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\0\0\0\0\23\230\0\0\2\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81836, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\23\230\0\0\3\0\0\0" )  ... {20, 48, reply, 0, 1252, 896, 81836, 0}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\0\0\0\0\23\230\0\0\2\0\0\0" ... {20, 48, reply, 0, 1252, 896, 81836, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\23\230\0\0\3\0\0\0" )  ) == 0x0
 00578   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233824,  (0x80100080, {24, 0, 0x40, 0, 1233824, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.tmp"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 00579   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1,  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00580   896   NtClose  (-2147481368, ... ) == 0x0
 00581   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1,  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00582   896   NtClose  (-2147481368, ... ) == 0x0
 00583   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1,  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00584   896   NtClose  (-2147481368, ... ) == 0x0
 00578   896   NtCreateFile  ... 52, {status=0x0, info=2}, ) == 0x0
 00585   896   NtClose  (52, ... ) == 0x0
 00586   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234112,  (0xc0100080, {24, 0, 0x40, 0, 1234112, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.tmp"}, 0x0, 128, 1, 5, 96, 0, 0, ... }, 0x0, 128, 1, 5, 96, 0, 0, ...
 00587   896   NtClose  (-2147481368, ... ) == 0x0
 00588   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1,  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00589   896   NtClose  (-2147481368, ... ) == 0x0
 00590   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1,  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00591   896   NtClose  (-2147481368, ... ) == 0x0
 00592   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1,  (-2147481368, 0, 0, 0, -518565888, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00593   896   NtClose  (-2147481368, ... ) == 0x0
 00586   896   NtCreateFile  ... 52, {status=0x0, info=3}, ) == 0x0
 00594   896   NtSetInformationFile  (44, 1234204, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00595   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\250J\271\0\347\20\351\0\341\20\346\0\32\357\351\0]\20\351\0\345\20\351\0\245\20\363\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\22\351\0_\0\351\16\372\244\340\315\304\250\350L(1y\220\261x\200s\305`\233o\202b\210m\305}\234s\2210\213e\305b\234n\305e\207d\200b\311W\214~\3322\350\32\3157\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0\345\20\351\0", ) , ) == 0x0
 00596   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "MZP\0\2\0\0\0\4\0\17\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\32\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 10240, 0x0, 0, ... , 10240, 0x0, 0, ...
 00597   896   NtContinue  (-135750188, 0, ...
 00596   896   NtWriteFile  ... {status=0x0, info=10240}, ) == 0x0
 00598   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\260\30\337\34\212,\244E\212b\220,E}\210\10\325\23h\7-\330\217\331\207\320\250\304-S!<\347\\233\334\15\341\203D\217p\270\271\341\13\225\377\303\322\261}`\277\347D\276\270!\270mA\226\300\203\233\271\1\265\206\202g\204\22\251\315\231/\350\2[T\304\32f\322\354R\20%\270\21o\311\332e\305\240CK\233x\252,\15\262;\305\346)\1\353\273G5\200\342\227i\3022\33\236C\311\1\313\301\364\20\343^\270l\3478\250\20101\270\13\377\31u\2001\225^\242\271\12I\7bQ\252\30\215\203u\24\341#)\302\305\210\325\326\222\22\244\36\10\311\35V\301I\1&\362\37\341\337\31f5\354]3\343\323\10\15\324\222\214;|\253\266\265t\31X\333&; !"\256W-\224!\257\251>\230P\14T\351(\344\314i\24f*\303\12\225\25\354\34\216\273?\12\15@;<\303`G\10\263d\234\310\240\226\374\2128\335\5\10#\20\216)f)\21\251\364#\232\247S\320R\377P\276\344u&\330\15nQ\335\324L\271$\\254\5\354-)4q\365\245\35\273\314\265\203i\221H\202\7\334|\301\315\370@m\274u%\233\264\304.I\177\357i\323A\306I\240]F\265\36\10\224\335\330\272\1{\270\336\225\303\304\301\217V\243,\223\23*\316\250D\20Wm\212(jx\275}\331\213Q\233\243X\3104\356\220\232\330\311^\374\363\302\227\361\357\26\12\311h\325\231\304\10\215\3601\201\221]\330>J\2611u\16\354\344\313\345p\357\316\32P\202s!\266\373R\312\350\234\370\3425\214\246\15&\1H\346\118\315\331\2\347p\251\3wXA\211\247H\3222\301K\16\3241CJ\17a\1[\1\11\17X\22\201X!\324\342\324\263\274\200\271\16$\356\33\362ac\334o[I\3404\17", ) \256W-\224!\257\251>\230P\14T\351(\344\314i\24f*\303\12\225\25\354\34\216\273?\12\15@;<\303`G\10\263d\234\310\240\226\374\2128\335\5\10#\20\216)f)\21\251\364#\232\247S\320R\377P\276\344u&\330\15nQ\335\324L\271$\\254\5\354-)4q\365\245\35\273\314\265\203i\221H\202\7\334|\301\315\370@m\274u%\233\264\304.I\177\357i\323A\306I\240]F\265\36\10\224\335\330\272\1{\270\336\225\303\304\301\217V\243,\223\23*\316\250D\20Wm\212(jx\275}\331\213Q\233\243X\3104\356\220\232\330\311^\374\363\302\227\361\357\26\12\311h\325\231\304\10\215\3601\201\221]\330>J\2611u\16\354\344\313\345p\357\316\32P\202s!\266\373R\312\350\234\370\3425\214\246\15&\1H\346\118\315\331\2\347p\251\3wXA\211\247H\3222\301K\16\3241CJ\17a\1[\1\11\17X\22\201X!\324\342\324\263\274\200\271\16$\356\33\362ac\334o[I\3404\17", ) == 0x0
 00599   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "U\106\34o\301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00600   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "2\322\342X]\2\374w\324\32\345H6]*\30\257\206\245\340\260\265[H\345\273{\345U\225^}\375T\251\221\0\200\214Z\201L\261Y\353Ks\0\267[\212T\265t\320d\376r\3756\201px\345uu\203!\211x\270\226\246\206\233\14\221`\305\35,p"z\231%\221@\317\221qC\365l\363\301\232\225}\235~p\216\20K`R\363\334\273\277%\367\230\3459\316\224\371\274\342\233o9\177Qe\14m\177\251\323\32\347\303\276\315\232\256\10\337\300\2359\23VR3OY<\256}\314\276\4\34|\254]R\24\2574\26V\366\306SR\375\270K\374\375\5\351^\354>\341\207\243V\325fK\310\17\226\324\366\340\33iK\245H*\13w\227\274?\356`*kJ=\2\221Y\364!\257\321\330\350\367\344>\21\27\1V\210l\226\227\207\31\1\223\272T\227e\214\1\313\23a\4\212\345\330\322o@\377D\365\22\336\304`nbw\336! \212\255S\255\10\31\357\253\267\272\20\341\215\220\37b|\355\27\330\300o\36\322J\31e^~DKg\\357\342\365\16\23\3236\237\254e\13o\276\273\30\371\362P\315\16\344)\21~8\265\216\5\310\324\322\200\3357\346M\341K\22\302\227\364l\257\212\247V\202\221\277`\321\354q\342\212\242\232\303\201\25B\7\356\4\3576\177>\232\261cq\232\267\12`K\272o\211l\367\13\363\10f\36\350)\35\355\350\356\261\32e\36769.\354^\0\252\1\361\33\220\374\4\355\323\22X r\373!?e\3656:S\320\4\355\377\373\13\35o|\363\221\211\10\253\305w\357+\11\35\367\242u\25\237J:n/Z\4e/\354\266\270\263\356\2034_\350\267\352\342\26\255O\247\243\20\237\27\27\261\227\33\236\15\352\257 \3\257\314C\5\331\327\26\321k\312\26B\0\236\320\1", ) z\231%\221@\317\221qC\365l\363\301\232\225}\235~p\216\20K`R\363\334\273\277%\367\230\3459\316\224\371\274\342\233o9\177Qe\14m\177\251\323\32\347\303\276\315\232\256\10\337\300\2359\23VR3OY<\256}\314\276\4\34|\254]R\24\2574\26V\366\306SR\375\270K\374\375\5\351^\354>\341\207\243V\325fK\310\17\226\324\366\340\33iK\245H*\13w\227\274?\356`*kJ=\2\221Y\364!\257\321\330\350\367\344>\21\27\1V\210l\226\227\207\31\1\223\272T\227e\214\1\313\23a\4\212\345\330\322o@\377D\365\22\336\304`nbw\336! \212\255S\255\10\31\357\253\267\272\20\341\215\220\37b|\355\27\330\300o\36\322J\31e^~DKg\\357\342\365\16\23\3236\237\254e\13o\276\273\30\371\362P\315\16\344)\21~8\265\216\5\310\324\322\200\3357\346M\341K\22\302\227\364l\257\212\247V\202\221\277`\321\354q\342\212\242\232\303\201\25B\7\356\4\3576\177>\232\261cq\232\267\12`K\272o\211l\367\13\363\10f\36\350)\35\355\350\356\261\32e\36769.\354^\0\252\1\361\33\220\374\4\355\323\22X r\373!?e\3656:S\320\4\355\377\373\13\35o|\363\221\211\10\253\305w\357+\11\35\367\242u\25\237J:n/Z\4e/\354\266\270\263\356\2034_\350\267\352\342\26\255O\247\243\20\237\27\27\261\227\33\236\15\352\257 \3\257\314C\5\331\327\26\321k\312\26B\0\236\320\1", ) == 0x0
 00601   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\327\302\13X\270\22\25w1\12\14H\323M\303\30J\226L\340U\245\262H\0\253\222\345\260\205\267}\30D@\221\345\220eZd\XY\16[\232\0RKcTPd9d\33b\246d`\221\345\220ej!lhQ\226C\226r\14tp,\35\311`\313z|5x@*\201\230C\20|\32\301\177\205\224\235\233`g\20\256p\273\3639\253V%\22\210\149+\204\20\274\7\213\2069\232A\214\14\210o@\323\377\367*\276(\212G\10:\320t9\366F\2733\252I\325\256\230\334W\4\371lE]\267\4F4\363F\37\306\266B\24\270\256\354\24\5\14N\5>\4\227JV0v\242\310\352\206=\366\5\13\200K@X\303\13\222\207U?\13p\303k\257-\353\221\274\344\310\2574\310\1\367\1.\370\27\344Fals\207n\31\344\203STrue\1.\3\210\4o\3651\322\212P\26D\20\27\304\205~\213w;1\311\212HCD\10\374\377B\267_\0\10\215u\17\213|\10\71\300\212\16;J\374u\267~\241[\216\\12\362\34\16\366\303\337\237Iu\342o[\253\361\371\27@$\16\19\370~\335\245g\5-\304;\2008'\17M\4[\373\302r\344\205\257o\267\277\202t\257\211\321\11a\13\212G\212*\201\360R\356\356\341\377\337\177\333\212Xc\224\212^\12\205[Sol|\36\13\26\30\217\36\159\364\355\15\376X\32\200\347\3379\313\374\267\0O\21\30\33u\354\355\3556\2\261 \227\353\310?\200\345\337:\266\300\355\355\32\353\342\35\212l\32\221l\30B\305\222\377\302\11\370\347Ku\360\217\243:\213?\263\4\200?\5\266]\243\7\203\321O\1\267\17\362\377\255\252\267J\20z\7\376\261r\13w\15\17\277\311\3J\334\252\5<\307\377\321\216\332\377B\345\2169\1", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00602   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "s\373\24\265e\307Ef\266\231l\6\363\220c\265\222\326l\227\232\36\236\21\203\257]\22\260\34\214\211\354\260\260\6V\327\210\35\325\254\365\210Qkv\240o\235|>\357\20]\274\202>\256\263\224:)0\374Ir4\344\327\353\316a\262\266\271l\207\335t\355J\355\310x\224\177\244\316\316\30t\206K\272\364\260B\315\361\260\30\273"\242\220/5m\234\254\13\255\222B\200K\232\345&\314\220\330\254\330\364\2\12\370\33\236\266\23\226\24\13\252\232\274\373\362A\254v\320v(i\325\221\151"L\237\214\300h\305\2\357Pk\32a\33\21BB\6i{\320\246\371\31+\216\231\353\3424=\350\326\220\177tfR\316!\215I\251{v\22d\5\361\366*\377\310=\5N\203\261~\360\203\267\311\364\360\226I\2661\32\35\3645\332\371\240\307@Y\326\310\311\356C\31]\206\0\336@\325/\3111\312\207\365g\3258\376b!\310\331(\3258\3141\317\205B\367\246\210\342\313\322w\276\36}\341\344\34I\346$\215\351\233\355j\357\243\376\22\307, \327\277\272O!\377z\23\322\371\360\264\235{`f\6\375\310\1L{\246E\243\246X\25\373\365\30\271\260Ba-\243\371\35\326\331\275\17r\232\362\0b\374\361\1'`0\22G\36*^\332\21\33\204\276\227\302\271\260\356\35\15P\346\355\322\230\346\254\376\222F1\353\317\1\305\332\347V\25\26;m\332:\331m\342`q\11\243\33\353\212\201OtT\264\25\3554\313\16\344\14\250\340\205\207\213\364\246\232\373\20\21JO\266\343\31\206\21\35\340E\0\375\360\355U\313\31\300*\354\24N\26\355@\205\253Y\344\372\4.\230\316\247\247\26\303H\15\210\329<^\j\20\26\31\354\13{\273\3216P\21\234'\22\335\0\266g\227\350\232`\202\330I\0\366\322\35E\2648", ) \242\220/5m\234\254\13\255\222B\200K\232\345&\314\220\330\254\330\364\2\12\370\33\236\266\23\226\24\13\252\232\274\373\362A\254v\320v(i\325\221\151 (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "s\373\24\265e\307Ef\266\231l\6\363\220c\265\222\326l\227\232\36\236\21\203\257]\22\260\34\214\211\354\260\260\6V\327\210\35\325\254\365\210Qkv\240o\235|>\357\20]\274\202>\256\263\224:)0\374Ir4\344\327\353\316a\262\266\271l\207\335t\355J\355\310x\224\177\244\316\316\30t\206K\272\364\260B\315\361\260\30\273"\242\220/5m\234\254\13\255\222B\200K\232\345&\314\220\330\254\330\364\2\12\370\33\236\266\23\226\24\13\252\232\274\373\362A\254v\320v(i\325\221\151"L\237\214\300h\305\2\357Pk\32a\33\21BB\6i{\320\246\371\31+\216\231\353\3424=\350\326\220\177tfR\316!\215I\251{v\22d\5\361\366*\377\310=\5N\203\261~\360\203\267\311\364\360\226I\2661\32\35\3645\332\371\240\307@Y\326\310\311\356C\31]\206\0\336@\325/\3111\312\207\365g\3258\376b!\310\331(\3258\3141\317\205B\367\246\210\342\313\322w\276\36}\341\344\34I\346$\215\351\233\355j\357\243\376\22\307, \327\277\272O!\377z\23\322\371\360\264\235{`f\6\375\310\1L{\246E\243\246X\25\373\365\30\271\260Ba-\243\371\35\326\331\275\17r\232\362\0b\374\361\1'`0\22G\36*^\332\21\33\204\276\227\302\271\260\356\35\15P\346\355\322\230\346\254\376\222F1\353\317\1\305\332\347V\25\26;m\332:\331m\342`q\11\243\33\353\212\201OtT\264\25\3554\313\16\344\14\250\340\205\207\213\364\246\232\373\20\21JO\266\343\31\206\21\35\340E\0\375\360\355U\313\31\300*\354\24N\26\355@\205\253Y\344\372\4.\230\316\247\247\26\303H\15\210\329<^\j\20\26\31\354\13{\273\3216P\21\234'\22\335\0\266g\227\350\232`\202\330I\0\366\322\35E\2648", ) , ) == 0x0
 00603   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240 (52, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00604   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\372\177+#\304\0)\11]<;\345\201\37@y\203\322h\307\245r\362\341\3732k|\344\30k.\275\6\374&\306\273\1{\244\242*\270\353\34Q%\244\2548\273lH\317w3\235\231\30\362\250X\263"\32`\34,\2\224\314\243\252\342 \355Fr\301s\2703\233\210\35\17{i\20\7Y?z\365\33498\356\361\220\305D\210\347\24.]\345\256\310\264\3\370\370x\337v\366aU\330\211\315\21\15\25\252\260\202\303\262O\20\274\315\233\207\321\322\320f\314_\221\17\276\307\353\33\353C\3008s8\16\21\6\305G3\207\5U\331\237Y\11}\344P\313M\5\271\222\\221\353\330\241S\370\365d\340F9\10\207\303\355\266\316\259\16\341D\232\210\4\242\2060\\347%PP\14\326Q<\222\231\21Wvm1n0Q\336\231\302\374\331\240q\262C\322\370VO\375\237\220YM;\240\220\234>\201}1C\261f\335J\261\323a=\345\32\3\4U*\311m\337yR\303\203\331\201*\323\11<\241\25\237\301\30\320\240B\366\327\310\215${y\344X\322\322\316hi#2\265\376\220\50\322\331\35\246\374\33a5O\267\337\31\323>\230\265\355\6\371\214\17\7`\342\311\3354q\215\270Y$\241\245\240\4\345\5a\367\357N\271\345\335\213\205\362\367`\254\344\265\250\360F\177\234\342\254`p`\243\220m\35\217T\335=\343p\312F>\235OHK\257e\2\243\256\2 \215r~\213i\21\350X]\222LI\351I\16\362\367\360\212\27\200\15i\351~\11\14\27\25\354\333\344\12\11\262\352\227t\330\357\230\322t\327\356Wj\357\211\11\340\267\274\322\205XgO\21Y1Y\177U\331\177\30\351\206\272|\263\262\250\357e\241\241i\366\12\376\217\262\302\262\370\214-\377\311\327\310{\215\363\334\300\343\356Z\241\7", ) \32`\34,\2\224\314\243\252\342 \355Fr\301s\2703\233\210\35\17{i\20\7Y?z\365\33498\356\361\220\305D\210\347\24.]\345\256\310\264\3\370\370x\337v\366aU\330\211\315\21\15\25\252\260\202\303\262O\20\274\315\233\207\321\322\320f\314_\221\17\276\307\353\33\353C\3008s8\16\21\6\305G3\207\5U\331\237Y\11}\344P\313M\5\271\222\\221\353\330\241S\370\365d\340F9\10\207\303\355\266\316\259\16\341D\232\210\4\242\2060\\347%PP\14\326Q<\222\231\21Wvm1n0Q\336\231\302\374\331\240q\262C\322\370VO\375\237\220YM;\240\220\234>\201}1C\261f\335J\261\323a=\345\32\3\4U*\311m\337yR\303\203\331\201*\323\11<\241\25\237\301\30\320\240B\366\327\310\215${y\344X\322\322\316hi#2\265\376\220\50\322\331\35\246\374\33a5O\267\337\31\323>\230\265\355\6\371\214\17\7`\342\311\3354q\215\270Y$\241\245\240\4\345\5a\367\357N\271\345\335\213\205\362\367`\254\344\265\250\360F\177\234\342\254`p`\243\220m\35\217T\335=\343p\312F>\235OHK\257e\2\243\256\2 \215r~\213i\21\350X]\222LI\351I\16\362\367\360\212\27\200\15i\351~\11\14\27\25\354\333\344\12\11\262\352\227t\330\357\230\322t\327\356Wj\357\211\11\340\267\274\322\205XgO\21Y1Y\177U\331\177\30\351\206\272|\263\262\250\357e\241\241i\366\12\376\217\262\302\262\370\214-\377\311\327\310{\215\363\334\300\343\356Z\241\7", ) == 0x0
 00605   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\37o\302#!\20\300\11\270,\322\345d\17\251yf\302\201\307@b\33\341\36"\202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00606   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\327\216\271\20"0\251\12WX\325\350;\33\277\34\355=\314\14\321\302\350\324.7\35\377eMPA\307\236r\275:X\342\250:6\33+"N\273 \371\333\27\342\247\2459Ry\16b\373u\177\2\22\276\7\347\332\203\357\377-\341wTK\12+\2J\216\212\302U\221H\336W\3230\216\22\3464\314\21\26$\310%J\204i\341\240\300\264N\177\237\214\377\17\220\336\367bg\252`\1\235%\323\330\210\267\7Wo\312\13r\31\330\257\26\205\25\346;\271jcP\4u\273\247s[\360\324\315\1`\211 \325\177\266Pt\346\345#\21\310^\206\11V\266\200\237=\364\245\223\334|\214\206\254x\362\3*\20\271\13\206\0\311k\364\16w\212C0\1\13\236O\363\3\257Mhx\361\324\263\357\313(\227\23\2606H'\251\246\202'\222t\275\317\267\26\371S\271t\242cn\15\20J\335;\205\2602\201\363\304\356\36; \260%\205\24\352\17G\32\361n1;\2664A\345#\261K]\340\207\252\30k\324\4\200\20\E#5\231\313\306\246\27l\373.#\0\14\324\303e\345Qm\12\263\264\202\337\233\357\372\211\341\326\251,\345\23\314@\210$\353\324v<\217\210xx\215\242\341\301\222~\305\360\370\360\232,\16:\277\270\223\237\23U\235\371\351\313\244\21\376\12%-\321\300\227\4\212\373\305\215\241\353\357\2057m\353\300\316\24\372\353.FKj\260\15\367\14\221\36\355\217\]\304\27\365;+\263\320g\236\4\233\261\344-;#\15\323r\305>n\37\264\20\221\15]\205uQS\0<\250i3\274\377+\342\33G\250\36\321\225\204\200>+\200t\374\340\345P\370"\340'+( ;\325\220\265\310\345\244\331\366\304\260\2320V\37a\4Y=e\204\322C\321\27l@\321\221d\272x&W\23\375\275", ) 0\251\12WX\325\350;\33\277\34\355=\314\14\321\302\350\324.7\35\377eMPA\307\236r\275:X\342\250:6\33+ (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\327\216\271\20"0\251\12WX\325\350;\33\277\34\355=\314\14\321\302\350\324.7\35\377eMPA\307\236r\275:X\342\250:6\33+"N\273 \371\333\27\342\247\2459Ry\16b\373u\177\2\22\276\7\347\332\203\357\377-\341wTK\12+\2J\216\212\302U\221H\336W\3230\216\22\3464\314\21\26$\310%J\204i\341\240\300\264N\177\237\214\377\17\220\336\367bg\252`\1\235%\323\330\210\267\7Wo\312\13r\31\330\257\26\205\25\346;\271jcP\4u\273\247s[\360\324\315\1`\211 \325\177\266Pt\346\345#\21\310^\206\11V\266\200\237=\364\245\223\334|\214\206\254x\362\3*\20\271\13\206\0\311k\364\16w\212C0\1\13\236O\363\3\257Mhx\361\324\263\357\313(\227\23\2606H'\251\246\202'\222t\275\317\267\26\371S\271t\242cn\15\20J\335;\205\2602\201\363\304\356\36; \260%\205\24\352\17G\32\361n1;\2664A\345#\261K]\340\207\252\30k\324\4\200\20\E#5\231\313\306\246\27l\373.#\0\14\324\303e\345Qm\12\263\264\202\337\233\357\372\211\341\326\251,\345\23\314@\210$\353\324v<\217\210xx\215\242\341\301\222~\305\360\370\360\232,\16:\277\270\223\237\23U\235\371\351\313\244\21\376\12%-\321\300\227\4\212\373\305\215\241\353\357\2057m\353\300\316\24\372\353.FKj\260\15\367\14\221\36\355\217\]\304\27\365;+\263\320g\236\4\233\261\344-;#\15\323r\305>n\37\264\20\221\15]\205uQS\0<\250i3\274\377+\342\33G\250\36\321\225\204\200>+\200t\374\340\345P\370"\340'+( ;\325\220\265\310\345\244\331\366\304\260\2320V\37a\4Y=e\204\322C\321\27l@\321\221d\272x&W\23\375\275", ) \340'+( ;\325\220\265\310\345\244\331\366\304\260\2320V\37a\4Y=e\204\322C\321\27l@\321\221d\272x&W\23\375\275", ) == 0x0
 00607   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211 (52, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00608   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\347\3431H\220\272C\277-Q\313\2108\223d\327\266OY\337\362\320!d\367I\301`\263\25]a\376\2T\377\363\300\12']J\320\212\251\21\26\200\14\32g\375?JQ\4\346\217\243\215\303t\335?\342\345dI\245Z\234\336\272bB\149\177\353\25\225\34\33L\6\31\223\4"nH\4O\263\33d\3445\236\2\306\354+2\307RR\31\243\365\2475\27S'W\355\2\235ho\363aN\337u\200\325H\350\272=\337\233\326\355=23\370\21\246\320\325\371\246?Y\220\301\364;\3112z\335m\360\221\0\25\272\273*\350C\35-w3[\215\230\350Lv\217\22130\221\323a\0\237\31\345\254\6\227\27 \305\262\370\3\7\3157\201\377\361\232\36\17\216&\223\344\263\352}\221d\207\243\253&\315]\211n\273\161\347Q"\372M\241\354\355\362\253n\356\242\350\12\17\331\347I\322&*\3\347\230 \26\25\16Q6\271\300\3200\231\344\337\213Y+v\220o\11\272\32\241]\24\372A\344z\307j\2\373D\367]\312\233\3\34C\355p\345t\376=\26\257\341\222\206\272\367\221\252\4o@\256\351\254>*\35\16a\346\270\35\227\325\344u\350\21C\341\350!\0\2275\21\370\200\320\12M\35bPk\301\25l\344\303\200Z<\222\34c\343\23\250-\224\205P(p>\233( \231P-\30\1687\301)B\362\375\213cS\242\227\347\16\345\264\345\353\334\342\374H\340\243\353(\355\223\273\362\340\22\316\350\371\232\266R\244\240Ph\221f!\246g\321amu\251\201\214#:\250\24\255\303zT\25\325\10\216\22\351\311\366\331\316\357\3478\346a\343\0To\345_\261a\264\301\213H\3657B\360\325\204\215\24\331\20\257`&8\241`\302\10\330\30", ) nH\4O\263\33d\3445\236\2\306\354+2\307RR\31\243\365\2475\27S'W\355\2\235ho\363aN\337u\200\325H\350\272=\337\233\326\355=23\370\21\246\320\325\371\246?Y\220\301\364;\3112z\335m\360\221\0\25\272\273*\350C\35-w3[\215\230\350Lv\217\22130\221\323a\0\237\31\345\254\6\227\27 \305\262\370\3\7\3157\201\377\361\232\36\17\216&\223\344\263\352}\221d\207\243\253&\315]\211n\273\161\347Q (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\347\3431H\220\272C\277-Q\313\2108\223d\327\266OY\337\362\320!d\367I\301`\263\25]a\376\2T\377\363\300\12']J\320\212\251\21\26\200\14\32g\375?JQ\4\346\217\243\215\303t\335?\342\345dI\245Z\234\336\272bB\149\177\353\25\225\34\33L\6\31\223\4"nH\4O\263\33d\3445\236\2\306\354+2\307RR\31\243\365\2475\27S'W\355\2\235ho\363aN\337u\200\325H\350\272=\337\233\326\355=23\370\21\246\320\325\371\246?Y\220\301\364;\3112z\335m\360\221\0\25\272\273*\350C\35-w3[\215\230\350Lv\217\22130\221\323a\0\237\31\345\254\6\227\27 \305\262\370\3\7\3157\201\377\361\232\36\17\216&\223\344\263\352}\221d\207\243\253&\315]\211n\273\161\347Q"\372M\241\354\355\362\253n\356\242\350\12\17\331\347I\322&*\3\347\230 \26\25\16Q6\271\300\3200\231\344\337\213Y+v\220o\11\272\32\241]\24\372A\344z\307j\2\373D\367]\312\233\3\34C\355p\345t\376=\26\257\341\222\206\272\367\221\252\4o@\256\351\254>*\35\16a\346\270\35\227\325\344u\350\21C\341\350!\0\2275\21\370\200\320\12M\35bPk\301\25l\344\303\200Z<\222\34c\343\23\250-\224\205P(p>\233( \231P-\30\1687\301)B\362\375\213cS\242\227\347\16\345\264\345\353\334\342\374H\340\243\353(\355\223\273\362\340\22\316\350\371\232\266R\244\240Ph\221f!\246g\321amu\251\201\214#:\250\24\255\303zT\25\325\10\216\22\351\311\366\331\316\357\3478\346a\343\0To\345_\261a\264\301\213H\3657B\360\325\204\215\24\331\20\257`&8\241`\302\10\330\30", ) \233\3\34C\355p\345t\376=\26\257\341\222\206\272\367\221\252\4o@\256\351\254>*\35\16a\346\270\35\227\325\344u\350\21C\341\350!\0\2275\21\370\200\320\12M\35bPk\301\25l\344\303\200Z<\222\34c\343\23\250-\224\205P(p>\233( \231P-\30\1687\301)B\362\375\213cS\242\227\347\16\345\264\345\353\334\342\374H\340\243\353(\355\223\273\362\340\22\316\350\371\232\266R\244\240Ph\221f!\246g\321amu\251\201\214#:\250\24\255\303zT\25\325\10\216\22\351\311\366\331\316\357\3478\346a\343\0To\345_\261a\264\301\213H\3657B\360\325\204\215\24\331\20\257`&8\241`\302\10\330\30", ) == 0x0
 00609   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022 (52, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \332\370\364\2669\325\34\266\326Yu\321\35;, (52, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A (52, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00610   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\235p\307\230\256^\206\374\362\342\306{\256\3\241S\225|\200t\263\274\10,\304O\244\4\214@\20b\232InS\264\\276a\315s\355\205e\225\354\323Q7\353\366\365]\351\227\341\27\335 \204\253%\327\276\30\336\260\276\347r\0\322r\302z\346\3\332\25W4\336\12~]Y\17\346?\312\340\345Gb\326\254\4\325\0\215o\241S\254T\350\340\350h0\220g\362\4\353\3651"I_\350\261\305\344\362\212\262\326\30p\260\327l\252\214\361\322\267}hC\350\271\344S\250\202o\3\313|\220\20\322\200\374\222\247`?\5a\267\346\360\341*\340\261\340\12\335\25\320\327O k\216\223\177\346\271\310u\326\242G\244\324\215\363\231@(\365\254\364 v\21}"\23\355\2608\16-W\16!,Z \345\324\2&M\201\366*\215\5\34\205\341\200\351|\240g\303\12\217\22^\252R\275KG9\356\234G"J\350\3\347r\215\236\311\333[l\340\34\345\20\365\4[,.\242\375\30\3750\311\313W<"$\3018\301,\311\4r\0\207\307\30\202\265Qe\355\261\20BS\352\345af\264\257\242\242\306J\353\2134\23\3\111\263Lv\205\374\345\3", ) I_\350\261\305\344\362\212\262\326\30p\260\327l\252\214\361\322\267}hC\350\271\344S\250\202o\3\313|\220\20\322\200\374\222\247`?\5a\267\346\360\341*\340\261\340\12\335\25\320\327O k\216\223\177\346\271\310u\326\242G\244\324\215\363\231@(\365\254\364 v\21}21-u\32\220\375\6\360-iX\365\367\320\242\260.\353\201\371\20\216\307\307\260\356\25\7\36\301h,\243E\221\352A\342\5%\3\223r\212\13K\362\21+\221\4\311\357\352\24\336F\341I\261\3c|.\27\365\325Ir\\252\341\304e\325\340\12\235\364u?A\11\232\353\21\207\217\31\270-\375\232a;M\23~\200qIk'\241\1779\4h]\21\346ep(\11\151\341\313\306\37B\252\362k}q}\33\313X\341Y\346\244F\220\347\10\320\12\254\22\307'_\24\261\243\212\33\230\371\375q)\250\353\0y\0\346\377)\0T\2\333]\241u\350El (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\235p\307\230\256^\206\374\362\342\306{\256\3\241S\225|\200t\263\274\10,\304O\244\4\214@\20b\232InS\264\\276a\315s\355\205e\225\354\323Q7\353\366\365]\351\227\341\27\335 \204\253%\327\276\30\336\260\276\347r\0\322r\302z\346\3\332\25W4\336\12~]Y\17\346?\312\340\345Gb\326\254\4\325\0\215o\241S\254T\350\340\350h0\220g\362\4\353\3651"I_\350\261\305\344\362\212\262\326\30p\260\327l\252\214\361\322\267}hC\350\271\344S\250\202o\3\313|\220\20\322\200\374\222\247`?\5a\267\346\360\341*\340\261\340\12\335\25\320\327O k\216\223\177\346\271\310u\326\242G\244\324\215\363\231@(\365\254\364 v\21}"\23\355\2608\16-W\16!,Z \345\324\2&M\201\366*\215\5\34\205\341\200\351|\240g\303\12\217\22^\252R\275KG9\356\234G"J\350\3\347r\215\236\311\333[l\340\34\345\20\365\4[,.\242\375\30\3750\311\313W<"$\3018\301,\311\4r\0\207\307\30\202\265Qe\355\261\20BS\352\345af\264\257\242\242\306J\353\2134\23\3\111\263Lv\205\374\345\3", ) J\350\3\347r\215\236\311\333[l\340\34\345\20\365\4[,.\242\375\30\3750\311\313W< (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\235p\307\230\256^\206\374\362\342\306{\256\3\241S\225|\200t\263\274\10,\304O\244\4\214@\20b\232InS\264\\276a\315s\355\205e\225\354\323Q7\353\366\365]\351\227\341\27\335 \204\253%\327\276\30\336\260\276\347r\0\322r\302z\346\3\332\25W4\336\12~]Y\17\346?\312\340\345Gb\326\254\4\325\0\215o\241S\254T\350\340\350h0\220g\362\4\353\3651"I_\350\261\305\344\362\212\262\326\30p\260\327l\252\214\361\322\267}hC\350\271\344S\250\202o\3\313|\220\20\322\200\374\222\247`?\5a\267\346\360\341*\340\261\340\12\335\25\320\327O k\216\223\177\346\271\310u\326\242G\244\324\215\363\231@(\365\254\364 v\21}"\23\355\2608\16-W\16!,Z \345\324\2&M\201\366*\215\5\34\205\341\200\351|\240g\303\12\217\22^\252R\275KG9\356\234G"J\350\3\347r\215\236\311\333[l\340\34\345\20\365\4[,.\242\375\30\3750\311\313W<"$\3018\301,\311\4r\0\207\307\30\202\265Qe\355\261\20BS\352\345af\264\257\242\242\306J\353\2134\23\3\111\263Lv\205\374\345\3", ) , ) == 0x0
 00611   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) |u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307 (52, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) X\4I\17\244\243\200\16\105\32E\22 (52, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00612   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\360\367&o`2\3701>\373\351\314\371D\372\32\212f\210'6=MP\371\270\31\354\312j\275\36*H\260>\220\316\373\234\7\31\205\1\341\257\245 SD\345\360\324\27\23\17\257\C~\305\13rl\274h\0P\256\14\347\212:\332\240\25\31\214\323P\264c>\16\364\21\353\216jY\374\4F3\221\203\360\20N\322y8\3520\306s\342|\371\226\3468+\27\371\213\240\340i\0\311\216\2026\365m=H\233\325\364 \260\3403\25t"Sd\236P\367\325\203\302\35Y\355\22yC\353)\352\4\340[C`\227#)\303\203\374\362\3110}YhA\34\374\336\237\11e\321\303\336\210\262L_U\10\311\206\351X\255\3m\331\342\211\263)?\23\246j\2731u\231\244\354.h\5\2055\203a\3\12\256`\241\377\3501\376\202\273\350q \5E\213\313\311\1\342n\222\321\251\21\207z]!\15\27\224r\255K\222\305aL\374\24\331\37\210\311\200\31\22>\25\255\321\13\2627R\275\27\353\0\375h\2609\251\0.&\34$\363\276b\17\340\35z$\13\342\200\242\24L9\367\30\11%\310\340\15\200\221\1M\3442\14\3151\204\235\302\364"bH\322U\276\303{\374\21\270E\367BdH\264<\20\332=\33\322\203\260\23\222.\242\363\236\24s\30\361`:w<#\354hc\206"\31784\211\3071\22\32\303\243\333\275\23\342\372\315U\23\232D\17F\300\304f[\3\355\33\341$\313\\221\24\222\12\360\177#H\345\11&\375\36\336C\270m\=TF5\264;\251_\246'?a;\365E\230\1\253P\10V\236u\20\27\322\271[\22\253\242\354\272i\200YD\6\2\344x\376\13\314J\30=\35\315[\375oAo\246b\205q\14", ) Sd\236P\367\325\203\302\35Y\355\22yC\353)\352\4\340[C`\227#)\303\203\374\362\3110}YhA\34\374222\7\0\361I>\336\237\11e\321\303\336\210\262L_U\10\311\206\351X\255\3m\331\342\211\263)?\23\246j\2731u\231\244\354.h\5\2055\203a\3\12\256`\241\377\3501\376\202\273\350q \5E\213\313\311\1\342n\222\321\251\21\207z]!\15\27\224r\255K\222\305aL\374\24\331\37\210\311\200\31\22>\25\255\321\13\2627R\275\27\353\0\375h\2609\251\0.&\34$\363\276b\17\340\35z$\13\342\200\242\24L9\367\30\11%\310\340\15\200\221\1M\3442\14\3151\204\235\302\364 (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\360\367&o`2\3701>\373\351\314\371D\372\32\212f\210'6=MP\371\270\31\354\312j\275\36*H\260>\220\316\373\234\7\31\205\1\341\257\245 SD\345\360\324\27\23\17\257\C~\305\13rl\274h\0P\256\14\347\212:\332\240\25\31\214\323P\264c>\16\364\21\353\216jY\374\4F3\221\203\360\20N\322y8\3520\306s\342|\371\226\3468+\27\371\213\240\340i\0\311\216\2026\365m=H\233\325\364 \260\3403\25t"Sd\236P\367\325\203\302\35Y\355\22yC\353)\352\4\340[C`\227#)\303\203\374\362\3110}YhA\34\374\336\237\11e\321\303\336\210\262L_U\10\311\206\351X\255\3m\331\342\211\263)?\23\246j\2731u\231\244\354.h\5\2055\203a\3\12\256`\241\377\3501\376\202\273\350q \5E\213\313\311\1\342n\222\321\251\21\207z]!\15\27\224r\255K\222\305aL\374\24\331\37\210\311\200\31\22>\25\255\321\13\2627R\275\27\353\0\375h\2609\251\0.&\34$\363\276b\17\340\35z$\13\342\200\242\24L9\367\30\11%\310\340\15\200\221\1M\3442\14\3151\204\235\302\364"bH\322U\276\303{\374\21\270E\367BdH\264<\20\332=\33\322\203\260\23\222.\242\363\236\24s\30\361`:w<#\354hc\206"\31784\211\3071\22\32\303\243\333\275\23\342\372\315U\23\232D\17F\300\304f[\3\355\33\341$\313\\221\24\222\12\360\177#H\345\11&\375\36\336C\270m\=TF5\264;\251_\246'?a;\365E\230\1\253P\10V\236u\20\27\322\271[\22\253\242\354\272i\200YD\6\2\344x\376\13\314J\30=\35\315[\375oAo\246b\205q\14", ) \31784\211\3071\22\32\303\243\333\275\23\342\372\315U\23\232D\17F\300\304f[\3\355\33\341$\313\\221\24\222\12\360\177#H\345\11&\375\36\336C\270m\=TF5\264220\27\5\3615a>;\251_\246'?a;\365E\230\1\253P\10V\236u\20\27\322\271[\22\253\242\354\272i\200YD\6\2\344x\376\13\314J\30=\35\315[\375oAo\246b\205q\14", ) == 0x0
 00613   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\25\347\317o\205"\211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00614   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\344\261\26NA\305\341\22\272\15\215\2629\224\302q\316Q\360\367m'\3544G\235k:j^[C\213|\260\205\2330\332\31\300Z\305\13N\26i\1|PW&\302\21\353\20\265~\210\315!c\2466m\227\341\370\16\26\323\7^\345\271\201\210\23\10\367\337\22r\315\261a\234\32\214\242{\254\267J\365\254\244\227>/q<\231xd\315\376\367\267\15\307\14WT]\254\251\26\332\204Tz\240\23-\336\262\251;\270\317\330\13\230\252\20\23(\30E\225\225&\300\215\351c\276S\21\303 l\33\365F\346\250\24\11\222P.F\241\16\11?y\214\34m\13#\311&\355\25\261s\351jb\300\355(\361*\7N\215V~\168\352'.\252\270\370p\2F\313\334\374\32\327\10\345\320\311\220\245\204\304\257\204\2\11\220\245\37\244lE\360\376\33\242 \307Rq\33\221, ) , ) == 0x0
 00615   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27 (52, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00616   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\217\24\33\30\233\376j\332\244\260=|m\37Z\237+r\214\204\15\360*{n\34\254\332\217\210"0c\301\320\35\364\207\11D\366\237%]e\307\215D\315\207\227"Ek\234\15\227\21\227\34\263\216\240\217C\275\21\226\360=nf\270\334-\353\225\12p\14\365\31\342\25)\25]8\372\321\215\333\253\310\226\360\353\22\275\5&\235\306\370\310\307\352\11OY\232\267O\335\275\23\3726\252\271#\220\263Q\25\6\212\275tlk\233l\364\323\234\251bm7\355\370e\341\250\222y\343\330\353h3\361!\262\244,\232\353\216[\200\335\262\313\230Q\1'\221\22W\357\36\266\343\233\31.\20\355\373:0\347(hmQ\5\17\216\313\342x\217b=\353~\340\233\354\340SLx\311\11\206X\30\256\6}\13\31\344i\3\367\315\302\336\221\303\300\221sD\354D\307\350\330!e\221\362\234\364\305\241\26\212\24R\235d\36x\358\335\231\221\344\1\332\237y\2304\321\364aU\273\24Q\7S\222\305\220B\4-r\252`\24\304\27\0\273\32\255\211\7\200\334\375\3416\2073\232\300\222\14\307\21\35\256\363\277\340s\355;\36a&BT8\362+'\302\24\11\352\307\24D\375\217\245<\350s\351\26I\350\304\221*f}\314\265\276\30\31\235\14\203\357 \4\16\0`P\356\21\357\3\265:\250=\264\37\251S\2551n\214V\203QD\3447\310\353", ) 0c\301\320\35\364\207\11D\366\237%]e\307\215D\315\207\227 (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\217\24\33\30\233\376j\332\244\260=|m\37Z\237+r\214\204\15\360*{n\34\254\332\217\210"0c\301\320\35\364\207\11D\366\237%]e\307\215D\315\207\227"Ek\234\15\227\21\227\34\263\216\240\217C\275\21\226\360=nf\270\334-\353\225\12p\14\365\31\342\25)\25]8\372\321\215\333\253\310\226\360\353\22\275\5&\235\306\370\310\307\352\11OY\232\267O\335\275\23\3726\252\271#\220\263Q\25\6\212\275tlk\233l\364\323\234\251bm7\355\370e\341\250\222y\343\330\353h3\361!\262\244,\232\353\216[\200\335\262\313\230Q\1'\221\22W\357\36\266\343\233\31.\20\355\373:0\347(hmQ\5\17\216\313\342x\217b=\353~\340\233\354\340SLx\311\11\206X\30\256\6}\13\31\344i\3\367\315\302\336\221\303\300\221sD\354D\307\350\330!e\221\362\234\364\305\241\26\212\24R\235d\36x\358\335\231\221\344\1\332\237y\2304\321\364aU\273\24Q\7S\222\305\220B\4-r\252`\24\304\27\0\273\32\255\211\7\200\334\375\3416\2073\232\300\222\14\307\21\35\256\363\277\340s\355;\36a&BT8\362+'\302\24\11\352\307\24D\375\217\245<\350s\351\26I\350\304\221*f}\314\265\276\30\31\235\14\203\357 \4\16\0`P\356\21\357\3\265:\250=\264\37\251S\2551n\214V\203QD\3447\310\353", ) , ) == 0x0
 00617   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D (52, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00618   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\3667\372\223\2369\265\15\37\370\226\3\352QL\240\210})+\33445?\254\252\304\335K\340\213\215\270>+\10\36\30\234\323\321\335\236\367(7\312\363\12S:4\250\16\363$\305C\311w\23\323\257OG\304\265\273\16\335_\306\361\350\262\373\256*\35\212\303\220\25+\233\24\304u9"\15\271x\246?.MQ\2570\264\351%\232Ps\270^\266\232\237\214#jb-\276\6\26[\16\230J\303\32na\12#\13\225\14\274\314\26M=n\202\245\37e\37\353\350\357\344\261&\364\227\22\16Q;c\376\206\301C\373\33\242\21\5n\330}W\16I\212Q\33\202\271\343\272\234\353\373\215\343\27\304K3\25\265\363\346\262-\342eM\217\0\274.[\30\332FLD\241\322\377\330\317\303\263C\362\371\311|\4OJ\272\357\343\11X\304\10S\357\377\16\376\265\314\364\347-\357u\307v\36\240/E.F\343\216\370\35\221\361\217\226\340n\344\3\245y/C[<\231\267\11\371\254@>>[?\214\320\371Mc\233\353\336\340\321\21\20\230\371\34\227\15=6\370<\361#1\255\311\25\333\310\233\203\13:\266\231\330<\2134\202~C\33\350:r\224A\221\313\273\13\3506u\3\235\222\3\32\375\366\202\301\213cD\360\3655\300\15\24i\344\352v\354\360\10\24730\325\361\210\353\327\320C\213\1\23\224\10\234\261\17\340\270\342k;\230\34\322\4\35n\22\27\237\2\232'\323+\3525\2275/D\343\20\246x\350\356\10n\32\367\356\22\334g\4\353\372v.\245\324\20\210\13\212\240^^Z\202\315\31\305\260\30\333\336\260\201\360\376\350\217\301\17z`\7\365\360\21\3mC\353\303\244\331\353\340H\22\320\310\356\332\224\201\276\201\375\373\234\27\237\367=\2233\12e\275\331\12\203\33\244|\35\346\322z\341l\366\277\353Q\304!", ) \15\271x\246?.MQ\2570\264\351%\232Ps\270^\266\232\237\214#jb-\276\6\26[\16\230J\303\32na\12#\13\225\14\274\314\26M=n\202\245\37e\37\353\350\357\344\261&\364\227\22\16Q;c\376\206\301C\373\33\242\21\5n\330}W\16I\212Q\33\202\271\343\272\234\353\373\215\343\27\304K3\25\265\363\346\262-\342eM\217\0\274.[\30\332FLD\241\322\377\330\317\303\263C\362\371\311|\4OJ\272\357\343\11X\304\10S\357\377\16\376\265\314\364\347-\357u\307v\36\240/E.F\343\216\370\35\221\361\217\226\340n\344\3\245y/C[<\231\267\11\371\254@>>[?\214\320\371Mc\233\353\336\340\321\21\20\230\371\34\227\15=6\370<\361#1\255\311\25\333\310\233\203\13:\266\231\330<\2134\202~C\33\350:r\224A\221\313\273\13\3506u\3\235\222\3\32\375\366\202\301\213cD\360\3655\300\15\24i\344\352v\354\360\10\24730\325\361\210\353\327\320C\213\1\23\224\10\234\261\17\340\270\342k;\230\34\322\4\35n\22\27\237\2\232'\323+\3525\2275/D\343\20\246x\350\356\10n\32\367\356\22\334g\4\353\372v.\245\324\20\210\13\212\240^^Z\202\315\31\305\260\30\333\336\260\201\360\376\350\217\301\17z`\7\365\360\21\3mC\353\303\244\331\353\340H\22\320\310\356\332\224\201\276\201\375\373\234\27\237\367=\2233\12e\275\331\12\203\33\244|\35\346\322z\341l\366\277\353Q\304!", ) == 0x0
 00619   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\23'\23\223{)\\15\372\350\177\3\17A\245\240mm\300+9$\334?I\272-\335\256\360b\215].\302\10\373\10u\3234\315w\367\315'#\363\357C\3234M\36\32$ S w\366\303FO\242\324\\273\353\315\266\306\24\370[\373K:\364\212&\200\374+~\4-u\3342\344\271\235\266\326.\250AF0Q\371\314\232\265cQ^S\212v\214\306z\213-[\26\377[\353\210\243\303\377~\210\12\306\33|\14Y\334\377M\330~k\245\372u\366\353\15\377\15\261\303\344~\22\353A\322c\33\226(C\36\13K\21\340~1}\262\36\240\212\264\13k\271\6\252u\353\36\235\12\27![\332\25P\343\17\262\310\362\214Mj\20U.\276\103F\251TH\322\32\310&\303VS\33\371,l\355O\257\252\6\343\354H-\10\266\377\26\16\33\245%\364\2=\6u"f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00620   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\3251\301\336s\34\2'\363\23\277\15c\356~\254\350\14\376\213:+\2u'\205\377\13\317\256,\237\116\3357\357I)Z\276\300\22\213\212\344\302\240\327\213\233l\253\23\243\4\236#\350\4\332{$w\273\1P\255\241E\261\273\344n1\31\245\240\354)]T\215\20\224\363\337\353s\32b\377\346\336\250\304\223;\333\27\336\337\24)\363\20P\266x6\375A_e8(G\225'\213\16\220\277\24\367\270=4\263:\321\331a\373\345n\266PYF\31\13\322\373\220\225=\221LFFY\306M`\30x.4\236\3439h\306\321\221\17<\334\20\363\1\325\17\361U$\2\270V\251\361\276Q\330\350`;\362\303QG\333r\322\254)s\372$e)\352\350\345\376H\272\255\347\22_\344\216g_\260\370\12`\217f)\276T\24\246h\356E\273u\372h\354\315\303W\355$\274\22\5\24\222f20<\220\313\243\11\230\341R\241\24\322\270\4\234\264\350\13\23,\211\20\233\364T\362\12\227N\16A\33sj\376\236\149=\305\200\346f\322\31\222+\322cMjq\333c\231\354\24\351f\322bf\255\305t\263bl\12"\305\210\234_\25\254\250}\376\251\7\324F\252\275eNQ\334U\206k$\265V\31\353\31\351\360\344T\371\344\363\21\324\334\355\35G[Z\200I\10\276\300b\352d\222\207[4\365\351\376\346\34h\302\320\213\222\233\350\221\13\16#)\255(\11p\266Tt\325\254\213\320\336`\216\307p\325\316\233\254_\335\217s\22\217\223\324;\236\30P/\352\75\213\340\357\237\36\262\0\302\373\262\241\364v[C)B@\373\3406\300\31c\317\353\251U\210\27\11\337&\316\245\32\241d\366 \20\1&\335\235\16\23\246\310,q4F\23;\357Aa(?m\212/\365$\226\23b\4\336\377\232\214", ) \305\210\234_\25\254\250}\376\251\7\324F\252\275eNQ\334U\206k$\265V\31\353\31\351\360\344T\371\344\363\21\324\334\355\35G[Z\200I\10\276\300b\352d\222\207[4\365\351\376\346\34h\302\320\213\222\233\350\221\13\16#)\255(\11p\266Tt\325\254\213\320\336`\216\307p\325\316\233\254_\335\217s\22\217\223\324;\236\30P/\352\75\213\340\357\237\36\262\0\302\373\262\241\364v[C)B@\373\3406\300\31c\317\353\251U\210\27\11\337&\316\245\32\241d\366 \20\1&\335\235\16\23\246\310,q4F\23;\357Aa(?m\212/\365$\226\23b\4\336\377\232\214", ) == 0x0
 00621   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216 (52, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00622   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\366=b\274f*\327\334\30%\244\15\357\231\350\241\343\314/\0\353i\225\364\203\333\303\263Z\237\276\22\25|\32"\31-\231\1771\341\17a\203\316\353\316U\15\35\265;\355\202\34\212\364\257\265\371\224\217\355@\3700w\11\237\11\355\236}c\2723\311 Z\337\275p}\242'\207\226\206\215\177sl%-mL_;a\365\367\0$X\274|N(\355\270\22S\304\17\201D\253\0\305\323\6T\324\6\366\201\3G\265\257\26N~\357\37\262\25\251q\366t\330y\276P%\6\216\34\252\265B\255w\354ED\374$\221\353\267G\272\246\250e\235_\262\20\375\360\375(W\240\325\235\231\30\22\264\272\300\245Q,\261?`\344\211\357\222\2.\374\202\242+Y\200A\222\354)\243\320MI\350d\201\200A\33y)\3315\366\327\212\227\265\4)\3~K\274PO\220\353\22B\226R\220\235\16\331\310\201g\342\230\34\260`\312\264}\261L$\332\177\320\357\27^SH\22\31Z\355\253\226\331\305\270|\202\341\210\233\244\315\332\213/\207v#\316\220\26\260\304+\27r\304d\304\375\374\22\221\255\3107\3077\11}\204\261\373,\25\261\31\37\257\257\206,~\177\254\237\276\212\25\240\312\340^\0\271\212\5\347+\374\250M\217\253\35\247\206\231h\\376\374\343W\353\213\342\321\3\3\367u2\332\210\27\342\4\257\317\354\10\355\34\177e\274\206\316\20\361\16\361\34\274\206\214Y\3600\315\14\315[\354\277\240\32\2260\257e!\350\244\30\217\255X\354\207m\357\270[F\377\346\13m\27\27\312Wp\255\27\32\5\207\257\220\243b\205\203\37>\363\203\273v\2\275\346\360\357{")$\31\200\26\374\27\276dw\32\233\224\14\316\351n\367\315\340\244\21\211\361\254\250\346e\304\2138F$\1\351\12!\1\345\221\267\340R\335\13\200", ) \31-\231\1771\341\17a\203\316\353\316U\15\35\265;\355\202\34\212\364\257\265\371\224\217\355@\3700w\11\237\11\355\236}c\2723\311 Z\337\275p}\242'\207\226\206\215\177sl%-mL_;a\365\367\0$X\274|N(\355\270\22S\304\17\201D\253\0\305\323\6T\324\6\366\201\3G\265\257\26N~\357\37\262\25\251q\366t\330y\276P%\6\216\34\252\265B\255w\354ED\374$\221\353\267G\272\246\250e\235_\262\20\375\360\375(W\240\325\235\231\30\22\264\272\300\245Q,\261?`\344\211\357\222\2.\374\202\242+Y\200A\222\354)\243\320MI\350d\201\200A\33y)\3315\366\327\212\227\265\4)\3~K\274PO\220\353\22B\226R\220\235\16\331\310\201g\342\230\34\260`\312\264}\261L$\332\177\320\357\27^SH\22\31Z\355\253\226\331\305\270|\202\341\210\233\244\315\332\213/\207v#\316\220\26\260\304+\27r\304d\304\375\374\22\221\255\3107\3077\11}\204\261\373,\25\261\31\37\257\257\206,~\177\254\237\276\212\25\240\312\340^\0\271\212\5\347+\374\250M\217\253\35\247\206\231h\\376\374\343W\353\213\342\321\3\3\367u2\332\210\27\342\4\257\317\354\10\355\34\177e\274\206\316\20\361\16\361\34\274\206\214Y\3600\315\14\315[\354\277\240\32\2260\257e!\350\244\30\217\255X\354\207m\357\270[F\377\346\13m\27\27\312Wp\255\27\32\5\207\257\220\243b\205\203\37>\363\203\273v\2\275\346\360\357{ (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\366=b\274f*\327\334\30%\244\15\357\231\350\241\343\314/\0\353i\225\364\203\333\303\263Z\237\276\22\25|\32"\31-\231\1771\341\17a\203\316\353\316U\15\35\265;\355\202\34\212\364\257\265\371\224\217\355@\3700w\11\237\11\355\236}c\2723\311 Z\337\275p}\242'\207\226\206\215\177sl%-mL_;a\365\367\0$X\274|N(\355\270\22S\304\17\201D\253\0\305\323\6T\324\6\366\201\3G\265\257\26N~\357\37\262\25\251q\366t\330y\276P%\6\216\34\252\265B\255w\354ED\374$\221\353\267G\272\246\250e\235_\262\20\375\360\375(W\240\325\235\231\30\22\264\272\300\245Q,\261?`\344\211\357\222\2.\374\202\242+Y\200A\222\354)\243\320MI\350d\201\200A\33y)\3315\366\327\212\227\265\4)\3~K\274PO\220\353\22B\226R\220\235\16\331\310\201g\342\230\34\260`\312\264}\261L$\332\177\320\357\27^SH\22\31Z\355\253\226\331\305\270|\202\341\210\233\244\315\332\213/\207v#\316\220\26\260\304+\27r\304d\304\375\374\22\221\255\3107\3077\11}\204\261\373,\25\261\31\37\257\257\206,~\177\254\237\276\212\25\240\312\340^\0\271\212\5\347+\374\250M\217\253\35\247\206\231h\\376\374\343W\353\213\342\321\3\3\367u2\332\210\27\342\4\257\317\354\10\355\34\177e\274\206\316\20\361\16\361\34\274\206\214Y\3600\315\14\315[\354\277\240\32\2260\257e!\350\244\30\217\255X\354\207m\357\270[F\377\346\13m\27\27\312Wp\255\27\32\5\207\257\220\243b\205\203\37>\363\203\273v\2\275\346\360\357{")$\31\200\26\374\27\276dw\32\233\224\14\316\351n\367\315\340\244\21\211\361\254\250\346e\304\2138F$\1\351\12!\1\345\221\267\340R\335\13\200", ) , ) == 0x0
 00623   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\23-\213\274\203:>\334\3755M\15\12\211\1\241\6\334\306\0\16y|\364f\313*\263\277\217W\2\327\5\225\32\307\11\304\231\232!\10\17\204\223'\353+E\344\35P+\4\202\371\232\35\257P\351}\217\10P\210\222\31v\11\10\216\224c_#  \277\317Tp\230\262\316\207s\226d\177\226|\314-\210\\266;\204\345\36\0\301HU|\2538\4\270\367C-\17dTB\0 \303\357T1\26\37\20\324\23\256\265J\6\247~\12\17[\25La\37t=iWP\300\26g\34O\245\253\255\222\374\254D\314x\353RWS\246Mut_W\0\24\360\308\276\2400\215p\30\367\244S\300@A\305\261\332p\15\211\12\202\353.\31\222K+\274\220\250\222\119J\320\250Y\1dd\220\250\33\234905\23\307c\227P\24\300\3\233[UP\252\200\2\22\247\206\273\220x\360\310dw\13\230\371\240\211\312QmXL\301\312\226\320\12\7\267S\255\2\360Z\10\273\177\331 \250\225\202\4\1\331\233A\3353\213\312\227\237#+\200\377\260!;\376r!t-\375\31\2x\255-'.7\354mm\261\36<\374\261\374\17F\257c<\227\177I\217W\212\360\260#\340\273\20P\212\340\367\302\374M]f\253\370\267o\231\215L\27\374\6G\2\213\7\301\352\3\22e\333\332m\7\13\4J\337\5\10\10\14\226eY\226'\20\24\36\30\34Y\226eY\25 $\14(K\5\277E\12\1770Ju\310\350A\10f\255\275\374nm\12\7\331[\243\357\17\13\210\7\376\312\262`D\27\377\25n\257u\263\213\205f\17\327\363f\253\237\2X\366\31\357\2362\300$\374\220\377\374\362\256\215w\377\213}\14+\371\207\367(\360M\21l\341E\250\3u-\213\335V\315\1\14\32\310\1\0\201^\340\267\315\342\200", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00624   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\306\345\374\205\203V\25\6\376db\22\340\313\341s\312\313w\242\213$\323C{\22\13\6\364\377\3512Qb\7/H\352\322\373\222\262\224\31U\1\364\353\36f\6\377\211\357\356\16\305\262|\12\336]\21\177u\23\321\0\345\241\234\213QB\22x,H$09w\250`\16\3417\5\355\247\304\227\1\226u\231@\3709\16!\10_\375\35\27\1\13\2218\360W\360MB\200\362Td_\341^S\24\5&\303\32/E\361\24,\11Q?\327+\336|\17\177F\330\2\221i\14=\0\11\202\205\301{\330\36z\357\304\351\244\17o\4}~\267f\357\4h\244m\354\5]J\357\15\37IL\32\35\371\373\17n#\267N\241\222p\350\274\341\21\226t\220]\36U\364Y\17\317\220\236\30\366\223\225\223*F\212\201\247o\0t\243\20\364\247\315\220h\21F\305\342\14\236=2\213\375A\276\341\333U\366\237\263\327:\364\332!BwR\201\276\3\301\357\344~0\325\361_\326;\275\224Y-\327\301s\37j%Yrw\360\303\224\250\13\344Zp\3\367\20 6\361\350\270nB\270x\12\257\177\24\336\242\243\353\316\366\255\344\22\365\10\323\237[=\312\367\220\333\6\363@Z\206\370\255\252|\34F\37\30k\370\262\370my\344\270\303\212\22\354\346\371@\272a\252\340in\225\355\300\376G\351\371\1/B\250\301\33\334@"\205\1\21\273aq\351,m\203\352\370\220!\33\243\270@\270\351Np*\202\366t\321\213/\252\361O\355\10\350\346\274H\2752e\271'\370\261\2429\262\367\250;\22\362$\376(\362;\31\323\1I)c\263\24\212\17\343#~D&\244\342\260M\226\261x\266\5\271\376>\21h{r\235\365\224\240\27\350\1\230\6t|\301<\1\0\221\233\333]\217\14\257\354\364\344\303\361>S.k\12f\352\", ) \205\1\21\273aq\351,m\203\352\370\220!\33\243\270@\270\351Np*\202\366t\321\213/\252\361O\355\10\350\346\274H\2752e\271'\370\261\2429\262\367\250;\22\362$\376(\362;\31\323\1I)c\263\24\212\17\343#~D&\244\342\260M\226\261x\266\5\271\376>\21h{r\235\365\224\240\27\350\1\230\6t|\301<\1\0\221\233\333]\217\14\257\354\364\344\303\361>S.k\12f\352\", ) == 0x0
 00625   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "#\365\25\205fF\374\6\33t\213\22\5\333\10s/\333\236\242n4:C\236\2\342\6\21\357\02\264r\356/\255\372;\373w\242}\31\260\21\35\353\373v\357\377l\377\7\16 \242\225\12;M\370\177\220\38\0\0\261u\213\264R\373x\311X\3150\334gA`\353\361\336\5\10\267-\227\344\206\234\231\245\350\320\16\304\30\266\375\370\7\350\13t(\31W\25]\253\200\27D\215_\4N\272\24\3406*\32\312U\30\24\311\31\270?2;7|\352o\257\330\347\201\200\14\330\20\340\202`\321\222\330\373j\6\304\14\264\346o\341m\227\267\203\377\355hA}\5\5\270Z\6\15\372Y\245\32\370\351\22\17\2133^ND\202\231\350Y\361\370\226\221\200\264\36\260\344\260\17*\200w\30\23\203|\223\317Vc\201B\177\351tF\0\35\247(\200\201\21\243\325\13\14{-\333\213\30QW\341>E\37\237V\307\323\364?1\253w\267\221W\3$\377\15~\325\305\30_3+T\224\274=>\301\226\17\203%\274b\236\360&\204A\13\1J\231\3\22\0\3116\24\370Qn\247\250\221\12Jo\375\336G\263\2\316\23\275\15\22\20\30:\237\276-#\367u\313\357\363\245Jo\370H\272\225\34\243\17\361k\35\242\21m\234\364Q\303o\2\5\346\34PSaO\360\200np\375)\376\242\371\20\1\312RA\301\376\314\251"`\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) `\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00626   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\206^\361!\311+\312\264\177\23\237B\244D\342D\361\21\212t\245^\215t\361w\250\14-u$\4\361(\312\220I[~H\344\23\214\30\345.\315\313G:1\75\302cA\317\220y\204\241\352\355\231e\333\340:\305U\277\7<\373\307M\311g\355\306\356\364\245\201\246P\336\3\23\330\263+\246\234\342|\215P\247\232\361\21u\254u\207\30J\342_O\357\264M?*\236?\270\274\26\207\352%U|\351OZ_\310\233\205\317\255\24\241$\341K\343\374\214\13\241\0\3128V\7 \215aS\373\24\241\364:\14\235\24\373S\240\30R\11\334\205uS\320U\321\35'@1S\371\177\2213\351\207\324\204qO"EMO\275aY\330\237/\260\30\32E=\1778\267)d\274\303j\37\335t\312)x_\240\354\257\30\212\204\243\232\310\201\312H]\227i\220\376|\352w\13\252\244p~G\256\30\346w\356\246\2050P\1g7\350\271\215\23\20 \34\20\3724\345G\321\217\30\26\15\0\264\360\353iW@\233\3\260t\217T\361\337\231T\3450k*]\311G\27\267(\371\344\222F &\342\10\377P\364g\277\1P\336\370\27\36c)\354I\32\324\347\332C\211\20\365\202\350E\325\204\271T\5\356\326S-\1\206\351_\374m\346\356D\273\2:L"\30\305\241\177\334>\23gp\344\2\2\2.WU\367\317\351\225\4\345W1H\3613\243.\246YQ8\274\330\357\244\357\10\265\242\341\353\345\2\250e\371\257\255\23\215\2G\266\261h\216\365\216p\376\11\15\3J< \360\334\347\355\4\366\200\353\37\35\355\266\351\20\351\10\371\23#\226\321\23\251 \366\255lM", ) H\344\23\214\30\345.\315\313G:1\75\302cA\317\220y\204\241\352\355\231e\333\340:\305U\277\7<\373\307M\311g\355\306\356\364\245\201\246P\336\3\23\330\263+\246\234\342|\215P\247\232\361\21u\254u\207\30J\342_O\357\264M?*\236?\270\274\26\207\352%U|\351OZ_\310\233\205\317\255\24\241$\341K\343\374\214\13\241\0\3128V\7 \215aS\373\24\241\364:\14\235\24\373S\240\30R\11\334\205uS\320U\321\35'@1S\371\177\2213\351\207\324\204qO (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\206^\361!\311+\312\264\177\23\237B\244D\342D\361\21\212t\245^\215t\361w\250\14-u$\4\361(\312\220I[~H\344\23\214\30\345.\315\313G:1\75\302cA\317\220y\204\241\352\355\231e\333\340:\305U\277\7<\373\307M\311g\355\306\356\364\245\201\246P\336\3\23\330\263+\246\234\342|\215P\247\232\361\21u\254u\207\30J\342_O\357\264M?*\236?\270\274\26\207\352%U|\351OZ_\310\233\205\317\255\24\241$\341K\343\374\214\13\241\0\3128V\7 \215aS\373\24\241\364:\14\235\24\373S\240\30R\11\334\205uS\320U\321\35'@1S\371\177\2213\351\207\324\204qO"EMO\275aY\330\237/\260\30\32E=\1778\267)d\274\303j\37\335t\312)x_\240\354\257\30\212\204\243\232\310\201\312H]\227i\220\376|\352w\13\252\244p~G\256\30\346w\356\246\2050P\1g7\350\271\215\23\20 \34\20\3724\345G\321\217\30\26\15\0\264\360\353iW@\233\3\260t\217T\361\337\231T\3450k*]\311G\27\267(\371\344\222F &\342\10\377P\364g\277\1P\336\370\27\36c)\354I\32\324\347\332C\211\20\365\202\350E\325\204\271T\5\356\326S-\1\206\351_\374m\346\356D\273\2:L"\30\305\241\177\334>\23gp\344\2\2\2.WU\367\317\351\225\4\345W1H\3613\243.\246YQ8\274\330\357\244\357\10\265\242\341\353\345\2\250e\371\257\255\23\215\2G\266\261h\216\365\216p\376\11\15\3J< \360\334\347\355\4\366\200\353\37\35\355\266\351\20\351\10\371\23#\226\321\23\251 \366\255lM", ) \30\305\241\177\334>\23gp\344\2\2\2.WU\367\317\351\225\4\345W1H\3613\243.\246YQ8\274\330\357\244\357\10\265\242\341\353\345\2\250e\371\257\255\23\215\2G\266\261h\216\365\216p\376\11\15\3J< \360\334\347\355\4\366\200\353\37\35\355\266\351\20\351\10\371\23#\226\321\23\251 \366\255lM", ) == 0x0
 00627   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "cN\30!,;#\264\232\3vBAT\13D\24\1ct@Ndt\24gA\14\310e\315\4\248#\220\254K\227<\203$\\310?H\351^a\234\210\233BX#\364C\311e(|I\14\240\250^T\5s\37\310\3\1\253JD\5C\30\316\7\311\313H\1\3e\30\0>$\313\242*\330\7\320\322\212A*\200\220\204D\372\4\231\200\313\11: EV\7\331\353.M,w\4\306\13\344L\201C@7\3\366\310Z+C\214\13|h@N\232\24\1\234\254\220\227\361J\7O\246\357Q]\326*{/Q\274\363\227\3%\260l\0O\277O!\233`\337D\24D4\10K\6\354e\13D\20#8\263\27\311\215\204C\22\24D\344\323\14x\4\22SE\10\273\119\225\234S5E8\35\302P\330S\34ox3\14\227=\204\224_\313E\250_Ta\274\310v/U\10\363E\330o\321\267\314tU\303\217\174t/9\221_E\374F\30o\224J\232-\221#H\270\207\200\220\33l\3w\356\272Mp\233WG\30\3g\7\246` \271\1\202'\1\271h\3\371 \371\0\234\0W8\217\375\6\344\0Q\340\2i\262Pr\3UdfT\24\317pT\0 \202*\270\331\256\27R8\20\344wV\311&\7\30\26P\21wV\1\265\316\21\27\373s\300\354\254\12=\347?S`\20\20\222\1E0\224PT\340\376?S\310\21o\351\272\354\204\346\13TR\2\337\\313\30 \261\226\334\333\3\216p\1\22\353\2\313G\274\367*\371|\4\0G\330H\24#J.CI\2708Y\310\6\244\12\30\\242\4\373\14\2Mu\20\257H\3d\2\242\246Xhk\345gp\33\31\344\3\257,\311\3609\367\4\4\23\220\2\3\322\15\4\266\14\0\0\10\34\3\312\2264\3@ \23\275\205M", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00628   896   NtReadFile  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\177P\371\214\347\14\371\205nA\362\27%+\2458\2641\14R\210\267\277\210\25\256\352|/|w\11\305Ny\346\376\320,h\23\37\304\330\365!YF\16\354\245\15\201\33\222\301\351\201\17\331\32\257\21!\6\265k\370\217A\370\21=k\255\203\343\345\6\366aa\212\310\342+\356|_\214\307\256\371\201\347\262\2\301Z\21\217@Y\311\302vk\361\262\305P\346\21U q\315\257"\244\263\115r@\235\36o\14,\335\373\226\315X\347\13\301P*@\365Uc\261\274\13h|\201\32\340\221\322\213\354\20B\1\272\360X\323[\11\254\33\265B"\23\367\357R\34/\217\33R\271\261a:\265\203\204\321\253\20o\353\317\364\355\222C\211\337\241\205\26A\236\373\14\303c\330\353r\22r\11\2134\371s$>\223\266\334M\307Yi"\216\20>d\271\5V\32\300\370W\31"\352\362\244&:\3514\362B\265\32\275\20\355\6\355M\343A\305\2\341\324\226d\340{\375\6\243\264y\11\363\33k\242\2166\367#\274\15\353=\15\334q\5\4\205\128\365\13\360\263\340_\235\242\17\2\177\260\3669\334\26\336\10\357\234\263u\322;!r\245\20i\3J\10\205\243\321$I7\370I\255\210\202\4\353 \231\232\310k\370n\350\370\211\300fq\331\211\312<0\214<`\375\2\31\36\312\250\375\322\261\337\271\331w-\352e\213\236\240F\270\21\341\16\346\22\247\34\257@\232B[C/\32[\148\256\341\322U\262\272\344\210\24\205Y&\273\257\16g\11Z%x\37K\336\326d"F4|\3416\351pv)\307\355SA\351H)\340\204,\250\315\311\207T\2\207A\325s\361\24\30N\35B\37h\256\212\261\237\364)\33\1\315rT\11\2'z\226(\314\345\224\354M1\222$\242\215\20\22\0\263xS\352\377\4", ) \244\263\115r@\235\36o\14,\335\373\226\315X\347\13\301P*@\365Uc\261\274\13h|\201\32\340\221\322\213\354\20B\1\272\360X\323[\11\254\33\265B (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\177P\371\214\347\14\371\205nA\362\27%+\2458\2641\14R\210\267\277\210\25\256\352|/|w\11\305Ny\346\376\320,h\23\37\304\330\365!YF\16\354\245\15\201\33\222\301\351\201\17\331\32\257\21!\6\265k\370\217A\370\21=k\255\203\343\345\6\366aa\212\310\342+\356|_\214\307\256\371\201\347\262\2\301Z\21\217@Y\311\302vk\361\262\305P\346\21U q\315\257"\244\263\115r@\235\36o\14,\335\373\226\315X\347\13\301P*@\365Uc\261\274\13h|\201\32\340\221\322\213\354\20B\1\272\360X\323[\11\254\33\265B"\23\367\357R\34/\217\33R\271\261a:\265\203\204\321\253\20o\353\317\364\355\222C\211\337\241\205\26A\236\373\14\303c\330\353r\22r\11\2134\371s$>\223\266\334M\307Yi"\216\20>d\271\5V\32\300\370W\31"\352\362\244&:\3514\362B\265\32\275\20\355\6\355M\343A\305\2\341\324\226d\340{\375\6\243\264y\11\363\33k\242\2166\367#\274\15\353=\15\334q\5\4\205\128\365\13\360\263\340_\235\242\17\2\177\260\3669\334\26\336\10\357\234\263u\322;!r\245\20i\3J\10\205\243\321$I7\370I\255\210\202\4\353 \231\232\310k\370n\350\370\211\300fq\331\211\312<0\214<`\375\2\31\36\312\250\375\322\261\337\271\331w-\352e\213\236\240F\270\21\341\16\346\22\247\34\257@\232B[C/\32[\148\256\341\322U\262\272\344\210\24\205Y&\273\257\16g\11Z%x\37K\336\326d"F4|\3416\351pv)\307\355SA\351H)\340\204,\250\315\311\207T\2\207A\325s\361\24\30N\35B\37h\256\212\261\237\364)\33\1\315rT\11\2'z\226(\314\345\224\354M1\222$\242\215\20\22\0\263xS\352\377\4", ) \216\20>d\271\5V\32\300\370W\31 (44, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\177P\371\214\347\14\371\205nA\362\27%+\2458\2641\14R\210\267\277\210\25\256\352|/|w\11\305Ny\346\376\320,h\23\37\304\330\365!YF\16\354\245\15\201\33\222\301\351\201\17\331\32\257\21!\6\265k\370\217A\370\21=k\255\203\343\345\6\366aa\212\310\342+\356|_\214\307\256\371\201\347\262\2\301Z\21\217@Y\311\302vk\361\262\305P\346\21U q\315\257"\244\263\115r@\235\36o\14,\335\373\226\315X\347\13\301P*@\365Uc\261\274\13h|\201\32\340\221\322\213\354\20B\1\272\360X\323[\11\254\33\265B"\23\367\357R\34/\217\33R\271\261a:\265\203\204\321\253\20o\353\317\364\355\222C\211\337\241\205\26A\236\373\14\303c\330\353r\22r\11\2134\371s$>\223\266\334M\307Yi"\216\20>d\271\5V\32\300\370W\31"\352\362\244&:\3514\362B\265\32\275\20\355\6\355M\343A\305\2\341\324\226d\340{\375\6\243\264y\11\363\33k\242\2166\367#\274\15\353=\15\334q\5\4\205\128\365\13\360\263\340_\235\242\17\2\177\260\3669\334\26\336\10\357\234\263u\322;!r\245\20i\3J\10\205\243\321$I7\370I\255\210\202\4\353 \231\232\310k\370n\350\370\211\300fq\331\211\312<0\214<`\375\2\31\36\312\250\375\322\261\337\271\331w-\352e\213\236\240F\270\21\341\16\346\22\247\34\257@\232B[C/\32[\148\256\341\322U\262\272\344\210\24\205Y&\273\257\16g\11Z%x\37K\336\326d"F4|\3416\351pv)\307\355SA\351H)\340\204,\250\315\311\207T\2\207A\325s\361\24\30N\35B\37h\256\212\261\237\364)\33\1\315rT\11\2'z\226(\314\345\224\354M1\222$\242\215\20\22\0\263xS\352\377\4", ) F4|\3416\351pv)\307\355SA\351H)\340\204,\250\315\311\207T\2\207A\325s\361\24\30N\35B\37h\256\212\261\237\364)\33\1\315rT\11\2'z\226(\314\345\224\354M1\222$\242\215\20\22\0\263xS\352\377\4", ) == 0x0
 00629   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237) (52, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00630   896   NtReadFile  (44, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048},  (44, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\245[\351\0\265[\351\0\201K\351\0\221K\351\0\1y\351\0\21y\351\0\341z\351\0\351z\351\0\361z\351\0\371z\351\0\301z\351\0\311z\351\0\321z\351\0\331z\351\0\241z\351\0\251z\351\0Ez\351\0Qz\351\0=z\351\0\371{\351\0\265{\351\0M{\351\05{\351\0\365|\351\0u|\351\0\15|\351\0a~\351\0\25\177\351\0\325`\351\0\361a\351\0Ea\351\0\221c\351\0\231e\351\0\241g\351\0\315h\351\0-h\351\0\255i\351\0mi\351\0\231j\351\0yj\351\0%j\351\0\25j\351\0}S\354\0\5S\354\029\356\0\169\356\0\347:\356\0\377:\356\0\321:\356\0\253:\356\0\214:\356\0a:\356\0E:\356\0\:\356\01:\356\0\15:\356\0\33:\356\0\367;\356\0\315;\356\0\244;\356\0\265;\356\0\230;\356\0s;\356\0R;\356\04;\356\0\35;\356\0\376<\356\0\257<\356\0\212<\356\0w<\356\0$<\356\0\4<\356\0\341=\356\0\334=\356\0\202=\356\0\231=\356\0w=\356\0O=\356\0%=\356\03=\356\0\11=\356\0\344>\356\0\377>\356\0\312>\356\0\241>\356\0\273>\356\0\234>\356\0a>\356\0o>\356\0v>\356\0z>\356\0\371\20\377\0\362\20\360\0\361\20\361\0\360\20\363\0\341\20\352\0\355\20\356\0\343\20\354\0\316\20\362\0\370\20\367\0\301\20\311\0\315\20\303\0\314\20\310\0\306\20\313\0\372\20\314\0\303\20\316\0\366\20\370\0\367\20\345\0\365\20\347\0\352\20\344\0\356\20\343\0\354\20\305\0\345\20\353\0\344\20\307\0\310\20\351\0\345\20\351\0\345\20\351\0\345\20\351@\301h\231$\324"\247m\220t\231@\261^\244U\241@\351@\301h\231$\324%\247m", ) \247m\220t\231@\261^\244U\241@\351@\301h\231$\324%\247m", ) == 0x0
 00631   896   NtWriteFile  (52, 0, 0, 0,  (52, 0, 0, 0, "@K\0\0PK\0\0d[\0\0t[\0\0\344i\0\0\364i\0\0\4j\0\0\14j\0\0\24j\0\0\34j\0\0$j\0\0,j\0\04j\0\0\0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) \0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) == 0x0
 00632   896   NtClose  (52, ... ) == 0x0
 00633   896   NtClose  (44, ... ) == 0x0
 00634   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.tmp"}, 1242360, ... ) }, 1242360, ... ) == 0x0
 00635   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.tmp"}, 5, 96, ... 44, {status=0x0, info=1}, ) }, 5, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00636   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 44, ... 52, ) == 0x0
 00637   896   NtClose  (44, ... ) == 0x0
 00638   896   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa50000), 0x0, 176128, ) == 0x0
 00639   896   NtClose  (52, ... ) == 0x0
 00640   896   NtUnmapViewOfSection  (-1, 0xa50000, ... ) == 0x0
 00641   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 00642   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 00643   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.tmp"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00644   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 52, ... 44, ) == 0x0
 00645   896   NtQuerySection  (44, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00646   896   NtClose  (52, ... ) == 0x0
 00647   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0xa50000), 0x0, 471040, ) == STATUS_IMAGE_NOT_AT_BASE
 00648   896   NtMapViewOfSection  (44, -1, (0xa50000), 0, 0, 0x0, 471040, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00649   896   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00650   896   NtClose  (44, ... ) == 0x0
 00651   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 8, ) == 0x0
 00652   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 8, ... (0xac2000), 4096, 4, ) == 0x0
 00653   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00654   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00655   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00656   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00657   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00658   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00659   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00660   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00661   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00662   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00663   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.DLL"}, ... 44, ) }, ... 44, ) == 0x0
 00664   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 73728, ) == 0x0
 00665   896   NtClose  (44, ... ) == 0x0
 00666   896   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00667   896   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00668   896   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00669   896   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00670   896   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00671   896   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00672   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00673   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00674   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00675   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 44, ) }, ... 44, ) == 0x0
 00676   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00677   896   NtClose  (44, ... ) == 0x0
 00678   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00679   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00680   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00681   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00682   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00683   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00684   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00685   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00686   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00687   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 44, ) }, ... 44, ) == 0x0
 00688   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00689   896   NtClose  (44, ... ) == 0x0
 00690   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00691   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00692   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00693   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00694   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00695   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00696   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00697   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00698   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00699   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00700   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00701   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00702   896   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00703   896   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00704   896   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00705   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00706   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00707   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00708   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.DLL"}, ... 44, ) }, ... 44, ) == 0x0
 00709   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00710   896   NtClose  (44, ... ) == 0x0
 00711   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00712   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00713   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00714   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00715   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00716   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00717   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00718   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00719   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00720   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00721   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00722   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00723   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00724   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00725   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00726   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00727   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00728   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00729   896   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00730   896   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00731   896   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00732   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00733   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00734   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00735   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00736   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00737   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00738   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00739   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00740   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == 0x0
 00741   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 5, 96, ... 44, {status=0x0, info=1}, ) }, 5, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00742   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 44, ... 52, ) == 0x0
 00743   896   NtQuerySection  (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00744   896   NtClose  (44, ... ) == 0x0
 00745   896   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0
 00746   896   NtClose  (52, ... ) == 0x0
 00747   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00748   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1241056, ... ) }, 1241056, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00749   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1241056, ... ) }, 1241056, ... ) == 0x0
 00750   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00751   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 52, ... 44, ) == 0x0
 00752   896   NtQuerySection  (44, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00753   896   NtClose  (52, ... ) == 0x0
 00754   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00755   896   NtClose  (44, ... ) == 0x0
 00756   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00757   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00758   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00759   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00760   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1240240, ... ) }, 1240240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00761   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1240240, ... ) }, 1240240, ... ) == 0x0
 00762   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 44, {status=0x0, info=1}, ) }, 5, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00763   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 44, ... 52, ) == 0x0
 00764   896   NtQuerySection  (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00765   896   NtClose  (44, ... ) == 0x0
 00766   896   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00767   896   NtClose  (52, ... ) == 0x0
 00768   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00769   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00770   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00771   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00772   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00773   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00774   896   NtProtectVirtualMemory  (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0
 00775   896   NtProtectVirtualMemory  (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0
 00776   896   NtFlushInstructionCache  (-1, 1907167232, 52, ... ) == 0x0
 00777   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00778   896   NtProtectVirtualMemory  (-1, (0xac2000), 4096, 4, ... (0xac2000), 4096, 4, ) == 0x0
 00779   896   NtFlushInstructionCache  (-1, 11280384, 4096, ... ) == 0x0
 00780   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPR.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00781   896   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 52, ) == 0x0
 00782   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 44, ) == 0x0
 00783   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 56, ) }, ... 56, ) == 0x0
 00784   896   NtNotifyChangeKey  (56, 44, 0, 0, 2011455960, 4, 0, 0, 0, 1, ... ) == 0x103
 00785   896   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00786   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 60, ) == 0x0
 00787   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 64, ) == 0x0
 00788   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00789   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00790   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11337728, 65536, ) == 0x0
 00791   896   NtAllocateVirtualMemory  (-1, 11337728, 0, 4096, 4096, 4, ... 11337728, 4096, ) == 0x0
 00792   896   NtAllocateVirtualMemory  (-1, 11341824, 0, 8192, 4096, 4, ... 11341824, 8192, ) == 0x0
 00793   896   NtAllocateVirtualMemory  (-1, 11350016, 0, 4096, 4096, 4, ... 11350016, 4096, ) == 0x0
 00794   896   NtAllocateVirtualMemory  (-1, 11354112, 0, 4096, 4096, 4, ... 11354112, 4096, ) == 0x0
 00795   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00796   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00797   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00798   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00799   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLE32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00800   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 68, {status=0x0, info=0}, ) }, 7, 16, ... 68, {status=0x0, info=0}, ) == 0x0
 00801   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "\321\17\307e\226Z\343\372\352\315\246{I\316J4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00802   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00803   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00804   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00805   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00806   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00807   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00808   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00809   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481368, 2, ) }, 0, 0x0, 0, ... -2147481368, 2, ) == 0x0
 00810   896   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "\255\232]\315\177\34\17\347\202R[\207\4\3\365\301e&k\375Nb\301B\333\302R\376\250\232\31\244C\251\262\201\322r\225\\235\304E\245\30/\25s?,\34\356CB\321\230XT\169\253s\231\13\222:\222\337\3724\36m+ei\12cQ\344\266", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "\255\232]\315\177\34\17\347\202R[\207\4\3\365\301e&k\375Nb\301B\333\302R\376\250\232\31\244C\251\262\201\322r\225\\235\304E\245\30/\25s?,\34\356CB\321\230XT\169\253s\231\13\222:\222\337\3724\36m+ei\12cQ\344\266", 80, ... ) , 80, ... ) == 0x0
 00811   896   NtClose  (-2147481368, ... ) == 0x0
 00801   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\201\335\311\234\210\34\221, ) , ) == 0x0
 00812   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00813   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00814   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 72, ) }, ... 72, ) == 0x0
 00815   896   NtQueryValueKey  (72,  (72, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00816   896   NtClose  (72, ... ) == 0x0
 00817   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 72, ) }, ... 72, ) == 0x0
 00818   896   NtQueryValueKey  (72,  (72, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00819   896   NtClose  (72, ... ) == 0x0
 00820   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00821   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00822   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00823   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00824   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 72, ) }, ... 72, ) == 0x0
 00825   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00826   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00827   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00828   896   NtClose  (72, ... ) == 0x0
 00829   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 72, ) }, ... 72, ) == 0x0
 00830   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00831   896   NtQueryValueKey  (72,  (72, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00832   896   NtClose  (72, ... ) == 0x0
 00833   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 72, ) }, ... 72, ) == 0x0
 00834   896   NtOpenEvent  (0x1f0003, {24, 72, 0x0, 0, 0,  (0x1f0003, {24, 72, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00835   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00836   896   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 00837   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00838   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00839   896   NtOpenKey  (0x9, {24, 16, 0x40, 0, 0,  (0x9, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00840   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00841   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00842   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00843   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00844   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00845   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00846   896   NtQueryPerformanceCounter  (... {-1449528651, 16}, {3579545, 0}, ) == 0x0
 00847   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbe3.tmp"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00848   896   NtUserCallOneParam  (0, 41, ... ) == 0x4
 00849   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 8192, 4096, 4, ... 1339392, 8192, ) == 0x0
 00850   896   NtQueryVirtualMemory  (-1, 0x12f630, Basic, 28, ... {BaseAddress=0x12f000,AllocationBase=0x30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 00851   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 11534336, 1048576, ) == 0x0
 00852   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00853   896   NtAllocateVirtualMemory  (-1, 11534336, 0, 16384, 4096, 4, ... 11534336, 16384, ) == 0x0
 00854   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00855   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00856   896   NtOpenKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00857   896   NtOpenKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00858   896   NtOpenProcessToken  (-1, 0x8, ... 76, ) == 0x0
 00859   896   NtQueryInformationToken  (76, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00860   896   NtClose  (76, ... ) == 0x0
 00861   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.ENU"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00862   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.ENU"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00863   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.ENU.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00864   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.EN"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00865   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.EN"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00866   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\hbe3.EN.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00867   896   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 76, ) == 0x0
 00868   896   NtUserGetDC  (0, ... ) == 0x1010052
 00869   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00870   896   NtUserGetDC  (0, ... ) == 0x1010052
 00871   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00872   896   NtGdiCreatePaletteInternal  (1241804, 16, ... ) == 0x64080596
 00873   896   NtGdiGetStockObject  (7, ... ) == 0x1b00017
 00874   896   NtGdiGetStockObject  (5, ... ) == 0x1900015
 00875   896   NtUserFindExistingCursorIcon  (1242168, 1242184, 1242232, ... ) == 0x10003
 00876   896   NtAddAtom  ( ("D\0e\0l\0p\0h\0i\00\00\00\00\00\04\0E\04\0", 28, 1242732, ... ) , 28, 1242732, ... ) == 0x0
 00877   896   NtAddAtom  ( ("C\0o\0n\0t\0r\0o\0l\0O\0f\0s\00\00\0A\05\00\00\00\00\00\00\00\00\00\03\08\00\0", 52, 1242732, ... ) , 52, 1242732, ... ) == 0x0
 00878   896   NtUserSystemParametersInfo  (104, 0, 11542084, 0, ... ) == 0x1
 00879   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 00880   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10023
 00881   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 00882   896   NtUserGetDC  (0, ... ) == 0x1010052
 00883   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xc9050697
 00884   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00885   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0x185000f
 00886   896   NtGdiGetDCforBitmap  (-922417513, ... ) == 0x860107ab
 00887   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00888   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0xc9050697
 00889   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00890   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00891   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11220492, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 00892   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00893   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0xc9050697
 00894   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 00895   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc9050697
 00896   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xba0106e8
 00897   896   NtGdiExtGetObjectW  (-922417513, 24, 1241212, ... ) == 0x18
 00898   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x710504dc
 00899   896   NtGdiSelectBitmap  (-2046752853, -922417513, ... ) == 0x185000f
 00900   896   NtGdiSelectBitmap  (-1174337816, 1896154332, ... ) == 0x185000f
 00901   896   NtGdiBitBlt  (-1174337816, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00902   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc9050697
 00903   896   NtGdiSelectBitmap  (-1174337816, 25493519, ... ) == 0x710504dc
 00904   896   NtGdiDeleteObjectApp  (-922417513, ... ) == 0x1
 00905   896   NtGdiDeleteObjectApp  (-1174337816, ... ) == 0x1
 00906   896   NtUserCallOneParam  (0, 33, ... ) == 0x2007009d
 00907   896   NtUserSetCursorIconData  (537329821, 1241316, 1241332, 1241396, ... ) == 0x1
 00908   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10029
 00909   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10027
 00910   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10025
 00911   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 00912   896   NtUserGetDC  (0, ... ) == 0x1010052
 00913   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x750505de
 00914   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00915   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x185000f
 00916   896   NtGdiGetDCforBitmap  (1963263454, ... ) == 0x860107ab
 00917   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00918   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x750505de
 00919   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00920   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00921   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11220800, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 00922   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00923   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x750505de
 00924   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 00925   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x750505de
 00926   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xcb010697
 00927   896   NtGdiExtGetObjectW  (1963263454, 24, 1241212, ... ) == 0x18
 00928   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x160506c8
 00929   896   NtGdiSelectBitmap  (-2046752853, 1963263454, ... ) == 0x185000f
 00930   896   NtGdiSelectBitmap  (-889125225, 369428168, ... ) == 0x185000f
 00931   896   NtGdiBitBlt  (-889125225, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00932   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x750505de
 00933   896   NtGdiSelectBitmap  (-889125225, 25493519, ... ) == 0x160506c8
 00934   896   NtGdiDeleteObjectApp  (1963263454, ... ) == 0x1
 00935   896   NtGdiDeleteObjectApp  (-889125225, ... ) == 0x1
 00936   896   NtUserCallOneParam  (0, 33, ... ) == 0x1580153
 00937   896   NtUserSetCursorIconData  (22544723, 1241316, 1241332, 1241396, ... ) == 0x1
 00938   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 00939   896   NtUserGetDC  (0, ... ) == 0x1010052
 00940   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xbc0506e8
 00941   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00942   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0x185000f
 00943   896   NtGdiGetDCforBitmap  (-1140521240, ... ) == 0x860107ab
 00944   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00945   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0xbc0506e8
 00946   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00947   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00948   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11221108, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 00949   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00950   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0xbc0506e8
 00951   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 00952   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xbc0506e8
 00953   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0x770105de
 00954   896   NtGdiExtGetObjectW  (-1140521240, 24, 1241212, ... ) == 0x18
 00955   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x2a050554
 00956   896   NtGdiSelectBitmap  (-2046752853, -1140521240, ... ) == 0x185000f
 00957   896   NtGdiSelectBitmap  (1996555742, 704972116, ... ) == 0x185000f
 00958   896   NtGdiBitBlt  (1996555742, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00959   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xbc0506e8
 00960   896   NtGdiSelectBitmap  (1996555742, 25493519, ... ) == 0x2a050554
 00961   896   NtGdiDeleteObjectApp  (-1140521240, ... ) == 0x1
 00962   896   NtGdiDeleteObjectApp  (1996555742, ... ) == 0x1
 00963   896   NtUserCallOneParam  (0, 33, ... ) == 0x250297
 00964   896   NtUserSetCursorIconData  (2425495, 1241316, 1241332, 1241396, ... ) == 0x1
 00965   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 00966   896   NtUserGetDC  (0, ... ) == 0x1010052
 00967   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xcd050697
 00968   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00969   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0x185000f
 00970   896   NtGdiGetDCforBitmap  (-855308649, ... ) == 0x860107ab
 00971   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00972   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0xcd050697
 00973   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 00974   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00975   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11221416, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 00976   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 00977   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0xcd050697
 00978   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 00979   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xcd050697
 00980   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xbe0106e8
 00981   896   NtGdiExtGetObjectW  (-855308649, 24, 1241212, ... ) == 0x18
 00982   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x6905057d
 00983   896   NtGdiSelectBitmap  (-2046752853, -855308649, ... ) == 0x185000f
 00984   896   NtGdiSelectBitmap  (-1107228952, 1761936765, ... ) == 0x185000f
 00985   896   NtGdiBitBlt  (-1107228952, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00986   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xcd050697
 00987   896   NtGdiSelectBitmap  (-1107228952, 25493519, ... ) == 0x6905057d
 00988   896   NtGdiDeleteObjectApp  (-855308649, ... ) == 0x1
 00989   896   NtGdiDeleteObjectApp  (-1107228952, ... ) == 0x1
 00990   896   NtUserCallOneParam  (0, 33, ... ) == 0x2c0293
 00991   896   NtUserSetCursorIconData  (2884243, 1241316, 1241332, 1241396, ... ) == 0x1
 00992   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 00993   896   NtUserGetDC  (0, ... ) == 0x1010052
 00994   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x790505de
 00995   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00996   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x185000f
 00997   896   NtGdiGetDCforBitmap  (2030372318, ... ) == 0x860107ab
 00998   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 00999   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x790505de
 01000   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01001   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01002   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11221724, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 01003   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01004   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x790505de
 01005   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01006   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x790505de
 01007   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xcf010697
 01008   896   NtGdiExtGetObjectW  (2030372318, 24, 1241212, ... ) == 0x18
 01009   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xcf0506b6
 01010   896   NtGdiSelectBitmap  (-2046752853, 2030372318, ... ) == 0x185000f
 01011   896   NtGdiSelectBitmap  (-822016361, -821754186, ... ) == 0x185000f
 01012   896   NtGdiBitBlt  (-822016361, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01013   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0x790505de
 01014   896   NtGdiSelectBitmap  (-822016361, 25493519, ... ) == 0xcf0506b6
 01015   896   NtGdiDeleteObjectApp  (2030372318, ... ) == 0x1
 01016   896   NtGdiDeleteObjectApp  (-822016361, ... ) == 0x1
 01017   896   NtUserCallOneParam  (0, 33, ... ) == 0x19018f
 01018   896   NtUserSetCursorIconData  (1638799, 1241316, 1241332, 1241396, ... ) == 0x1
 01019   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01020   896   NtUserGetDC  (0, ... ) == 0x1010052
 01021   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xc00506e8
 01022   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01023   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0x185000f
 01024   896   NtGdiGetDCforBitmap  (-1073412376, ... ) == 0x860107ab
 01025   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01026   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0xc00506e8
 01027   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01028   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01029   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11222340, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 01030   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01031   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0xc00506e8
 01032   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01033   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc00506e8
 01034   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0x7b0105de
 01035   896   NtGdiExtGetObjectW  (-1073412376, 24, 1241212, ... ) == 0x18
 01036   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x220505f7
 01037   896   NtGdiSelectBitmap  (-2046752853, -1073412376, ... ) == 0x185000f
 01038   896   NtGdiSelectBitmap  (2063664606, 570754551, ... ) == 0x185000f
 01039   896   NtGdiBitBlt  (2063664606, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01040   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xc00506e8
 01041   896   NtGdiSelectBitmap  (2063664606, 25493519, ... ) == 0x220505f7
 01042   896   NtGdiDeleteObjectApp  (-1073412376, ... ) == 0x1
 01043   896   NtGdiDeleteObjectApp  (2063664606, ... ) == 0x1
 01044   896   NtUserCallOneParam  (0, 33, ... ) == 0x4b01ff
 01045   896   NtUserSetCursorIconData  (4915711, 1241316, 1241332, 1241396, ... ) == 0x1
 01046   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01047   896   NtUserGetDC  (0, ... ) == 0x1010052
 01048   896   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0xd1050697
 01049   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01050   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0x185000f
 01051   896   NtGdiGetDCforBitmap  (-788199785, ... ) == 0x860107ab
 01052   896   NtGdiSaveDC  (-2046752853, ... ) == 0x1
 01053   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0xd1050697
 01054   896   NtGdiGetDCObject  (-2046752853, 524288, ... ) == 0x188000b
 01055   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01056   896   NtGdiSetDIBitsToDeviceInternal  (-2046752853, 0, 0, 32, 64, 0, 0, 0, 64, 11222032, 1319624, 0, 256, 48, 1, 0, ... ) == 0x40
 01057   896   NtUserSelectPalette  (-2046752853, 25690123, 0, ... ) == 0x188000b
 01058   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0xd1050697
 01059   896   NtGdiRestoreDC  (-2046752853, -1, ... ) == 0x1
 01060   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xd1050697
 01061   896   NtGdiCreateCompatibleDC  (-2046752853, ... ) == 0xc20106e8
 01062   896   NtGdiExtGetObjectW  (-788199785, 24, 1241212, ... ) == 0x18
 01063   896   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xce0506aa
 01064   896   NtGdiSelectBitmap  (-2046752853, -788199785, ... ) == 0x185000f
 01065   896   NtGdiSelectBitmap  (-1040120088, -838531414, ... ) == 0x185000f
 01066   896   NtGdiBitBlt  (-1040120088, 0, 0, 32, 64, -2046752853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01067   896   NtGdiSelectBitmap  (-2046752853, 25493519, ... ) == 0xd1050697
 01068   896   NtGdiSelectBitmap  (-1040120088, 25493519, ... ) == 0xce0506aa
 01069   896   NtGdiDeleteObjectApp  (-788199785, ... ) == 0x1
 01070   896   NtGdiDeleteObjectApp  (-1040120088, ... ) == 0x1
 01071   896   NtUserCallOneParam  (0, 33, ... ) == 0x450281
 01072   896   NtUserSetCursorIconData  (4522625, 1241316, 1241332, 1241396, ... ) == 0x1
 01073   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10015
 01074   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10019
 01075   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001f
 01076   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001b
 01077   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10021
 01078   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001d
 01079   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10013
 01080   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10017
 01081   896   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01082   896   NtUserCallOneParam  (0, 40, ... ) == 0x4090409
 01083   896   NtUserGetDC  (0, ... ) == 0x1010052
 01084   896   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 01085   896   NtUserEnumDisplayMonitors  (0, 0, 10945124, 11542664, ... ) == 0x1
 01086   896   NtUserSystemParametersInfo  (31, 60, 1241032, 0, ... ) == 0x1
 01087   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1329240, ... ) == 0xc30a06e8
 01088   896   NtGdiExtGetObjectW  (-1022753048, 420, 1241736, ... ) == 0x164
 01089   896   NtUserSystemParametersInfo  (41, 0, 1241232, 0, ... ) == 0x1
 01090   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1329232, ... ) == 0x7d0a05de
 01091   896   NtGdiExtGetObjectW  (2097808862, 420, 1241736, ... ) == 0x164
 01092   896   NtGdiHfontCreate  (1241912, 356, 0, 0, 1329224, ... ) == 0xd20a0697
 01093   896   NtGdiExtGetObjectW  (-771094889, 420, 1241736, ... ) == 0x164
 01094   896   NtUserFindExistingCursorIcon  (1241812, 1241828, 1241876, ... ) == 0x0
 01095   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 11403264, 4096, ) == 0x0
 01096   896   NtUserGetKeyboardLayoutList  (64, 1242400, ... ) == 0x1
 01097   896   NtUserRegisterWindowMessage  ( ("Delphi Picture", ... ) , ... ) == 0xc13a
 01098   896   NtUserRegisterWindowMessage  ( ("Delphi Component", ... ) , ... ) == 0xc13b
 01099   896   NtOpenMutant  (0x1f0001, {24, 72, 0x0, 0, 0,  (0x1f0001, {24, 72, 0x0, 0, 0, "Residented"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01100   896   NtUserSetWindowsHookEx  (10813440, 1243784, 0, 4, 10821308, 2, ... ) == 0x5a01d7
 01101   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1244964,  (0xc0100080, {24, 0, 0x40, 0, 1244964, "\??\SICE"}, 0x0, 128, 3, 1, 96, 0, 0, ... ) }, 0x0, 128, 3, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01102   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1244964,  (0xc0100080, {24, 0, 0x40, 0, 1244964, "\??\SIWVID"}, 0x0, 128, 3, 1, 96, 0, 0, ... ) }, 0x0, 128, 3, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01103   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1244964,  (0xc0100080, {24, 0, 0x40, 0, 1244964, "\??\NTICE"}, 0x0, 128, 3, 1, 96, 0, 0, ... ) }, 0x0, 128, 3, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01104   896   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Wine"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01105   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01106   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01107   896   NtQueryVirtualMemory  (-1, 0x5acbb9, Basic, 28, ... {BaseAddress=0x5ac000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x56000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01108   896   NtContinue  (1244368, 0, ...
 01109   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244952,  (0x80100080, {24, 0, 0x40, 0, 1244952, "\??\C:\WINDOWS\system32\KERNEL32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 80, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 80, {status=0x0, info=1}, ) == 0x0
 01110   896   NtQueryInformationFile  (80, 1245004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01111   896   NtAllocateVirtualMemory  (-1, 0, 0, 984576, 4096, 64, ... 12582912, 987136, ) == 0x0
 01112   896   NtReadFile  (80, 0, 0, 0, 984576, 0x0, 0, ... {status=0x0, info=984576},  (80, 0, 0, 0, 984576, 0x0, 0, ... {status=0x0, info=984576}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\27\206 \244S\347N\367S\347N\367S\347N\367S\347O\367\332\346N\367\220\350\23\367P\347N\367\220\350\22\367R\347N\367\220\350\20\367R\347N\367\220\350A\367V\347N\367\220\350\21\367\216\347N\367\220\350.\367W\347N\367\220\350\24\367R\347N\367RichS\347N\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\325\233#F\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\12\0"\10\0\0\0\7\0\0\0\0\0\256\265\0\0\0\20\0\0\0\360\7\0\0\0\200|\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0P\17\0\0\4\0\0\223\222\17\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\34&\0\0{l\0\0\314\7\10\0(\0\0\0\0\220\10\0\350^\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\16\0\354[\0\0\2600\10\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\343\4\0@\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\21!\10\0\0\20\0\0\0"\10\0", ) \10\0\0\0\7\0\0\0\0\0\256\265\0\0\0\20\0\0\0\360\7\0\0\0\200|\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0P\17\0\0\4\0\0\223\222\17\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\34&\0\0{l\0\0\314\7\10\0(\0\0\0\0\220\10\0\350^\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\16\0\354[\0\0\2600\10\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\343\4\0@\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\21!\10\0\0\20\0\0\0 (80, 0, 0, 0, 984576, 0x0, 0, ... {status=0x0, info=984576}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\27\206 \244S\347N\367S\347N\367S\347N\367S\347O\367\332\346N\367\220\350\23\367P\347N\367\220\350\22\367R\347N\367\220\350\20\367R\347N\367\220\350A\367V\347N\367\220\350\21\367\216\347N\367\220\350.\367W\347N\367\220\350\24\367R\347N\367RichS\347N\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\325\233#F\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\12\0"\10\0\0\0\7\0\0\0\0\0\256\265\0\0\0\20\0\0\0\360\7\0\0\0\200|\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0P\17\0\0\4\0\0\223\222\17\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\34&\0\0{l\0\0\314\7\10\0(\0\0\0\0\220\10\0\350^\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\16\0\354[\0\0\2600\10\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\343\4\0@\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\21!\10\0\0\20\0\0\0"\10\0", ) , ) == 0x0
 01113   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244952,  (0x80100080, {24, 0, 0x40, 0, 1244952, "\??\C:\WINDOWS\system32\USER32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 84, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 84, {status=0x0, info=1}, ) == 0x0
 01114   896   NtQueryInformationFile  (84, 1245004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01115   896   NtAllocateVirtualMemory  (-1, 0, 0, 577536, 4096, 64, ... 13631488, 577536, ) == 0x0
 01116   896   NtReadFile  (84, 0, 0, 0, 577536, 0x0, 0, ... {status=0x0, info=577536},  (84, 0, 0, 0, 577536, 0x0, 0, ... {status=0x0, info=577536}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\376\7\341\342\272f\217\261\272f\217\261\272f\217\261\272f\216\261\361g\217\261yi\322\261\275f\217\261yi\323\261\273f\217\261yi\321\261\273f\217\261yi\200\261\262f\217\261yi\320\261\315f\217\261yi\325\261\273f\217\261Rich\272f\217\261\0\0\0\0\0\0\0\0PE\0\0L\1\4\0|-\360E\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\12\0\360\5\0\0\342\2\0\0\0\0\0f\351\1\0\0\20\0\0\0\260\5\0\0\0A~\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\0\11\0\0\4\0\0\341@\11\0\2\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\3708\0\0\251K\0\0\250\343\5\0P\0\0\0\0 \6\0\230\240\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\10\0\350-\0\0\210\377\5\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\260\355\3\0@\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\344\4\0\0\234\340\5\0\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\347\357\5\0\0\20\0\0\0\360\5\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01117   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244956,  (0x80100080, {24, 0, 0x40, 0, 1244956, "\??\C:\WINDOWS\system32\ADVAPI32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 88, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 88, {status=0x0, info=1}, ) == 0x0
 01118   896   NtQueryInformationFile  (88, 1245008, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01119   896   NtAllocateVirtualMemory  (-1, 0, 0, 616960, 4096, 64, ... 14221312, 618496, ) == 0x0
 01120   896   NtReadFile  (88, 0, 0, 0, 616960, 0x0, 0, ... {status=0x0, info=616960},  (88, 0, 0, 0, 616960, 0x0, 0, ... {status=0x0, info=616960}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\250j\342h\354\13\214;\354\13\214;\354\13\214;/\4\321;\353\13\214;/\4\203;\341\13\214;=\7\323;\356\13\214;\354\13\215;T\12\214;/\4\320;\355\13\214;/\4\322;\355\13\214;/\4\354;\361\13\214;/\4\323;~\13\214;/\4\326;\355\13\214;Rich\354\13\214;\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\247\226\20A\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\12\0D\7\0\0<\2\0\0\0\0\0\324p\0\0\0\20\0\0\0 \7\0\0\0\335w\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\260\11\0\0\4\0\0\344\15\12\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\244\26\0\0\23R\0\04(\7\0P\0\0\0\0\260\7\0\200\251\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\11\08K\0\0xR\7\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0V\2\0H\0\0\0\210\2\0\0L\0\0\0\0\20\0\0\244\6\0\0\340&\7\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\331B\7\0", ) , ) == 0x0
 01121   896   NtClose  (88, ... ) == 0x0
 01122   896   NtClose  (84, ... ) == 0x0
 01123   896   NtClose  (80, ... ) == 0x0
 01124   896   NtRaiseException  (1244376, 1243636, 1, ...
 01125   896   NtQueryVirtualMemory  (-1, 0x7c85a0a0, Basic, 28, ... {BaseAddress=0x7c85a000,AllocationBase=0x7c800000,AllocationProtect=0x80,RegionSize=0x2a000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01126   896   NtContinue  (1242596, 0, ...
 01127   896   NtOpenMutant  (0x120001, {24, 72, 0x2, 0, 0,  (0x120001, {24, 72, 0x2, 0, 0, "DBWinMutex"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01128   896   NtCreateMutant  (0x1f0001, {24, 72, 0x82, 1244396, 0,  (0x1f0001, {24, 72, 0x82, 1244396, 0, "DBWinMutex"}, 0, ... 80, ) }, 0, ... 80, ) == 0x0
 01129   896   NtWaitForSingleObject  (80, 0, 0x0, ... ) == 0x0
 01130   896   NtOpenSection  (0x2, {24, 72, 0x0, 0, 0,  (0x2, {24, 72, 0x0, 0, 0, "DBWIN_BUFFER"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01131   896   NtReleaseMutant  (80, ... 0x0, ) == 0x0
 01132   896   NtAllocateVirtualMemory  (-1, 0, 0, 748, 4096, 4, ... 14876672, 4096, ) == 0x0
 01133   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "winmm.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01134   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\winmm.dll"}, 1242956, ... ) }, 1242956, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01135   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\winmm.dll"}, 1242956, ... ) }, 1242956, ... ) == 0x0
 01136   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\winmm.dll"}, 5, 96, ... 84, {status=0x0, info=1}, ) }, 5, 96, ... 84, {status=0x0, info=1}, ) == 0x0
 01137   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 84, ... 88, ) == 0x0
 01138   896   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01139   896   NtClose  (84, ... ) == 0x0
 01140   896   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b40000), 0x0, 184320, ) == 0x0
 01141   896   NtClose  (88, ... ) == 0x0
 01142   896   NtProtectVirtualMemory  (-1, (0x76b41000), 860, 4, ... (0x76b41000), 4096, 32, ) == 0x0
 01143   896   NtProtectVirtualMemory  (-1, (0x76b41000), 4096, 32, ... (0x76b41000), 4096, 4, ) == 0x0
 01144   896   NtFlushInstructionCache  (-1, 1991512064, 860, ... ) == 0x0
 01145   896   NtProtectVirtualMemory  (-1, (0x76b41000), 860, 4, ... (0x76b41000), 4096, 32, ) == 0x0
 01146   896   NtProtectVirtualMemory  (-1, (0x76b41000), 4096, 32, ... (0x76b41000), 4096, 4, ) == 0x0
 01147   896   NtFlushInstructionCache  (-1, 1991512064, 860, ... ) == 0x0
 01148   896   NtProtectVirtualMemory  (-1, (0x76b41000), 860, 4, ... (0x76b41000), 4096, 32, ) == 0x0
 01149   896   NtProtectVirtualMemory  (-1, (0x76b41000), 4096, 32, ... (0x76b41000), 4096, 4, ) == 0x0
 01150   896   NtFlushInstructionCache  (-1, 1991512064, 860, ... ) == 0x0
 01151   896   NtProtectVirtualMemory  (-1, (0x76b41000), 860, 4, ... (0x76b41000), 4096, 32, ) == 0x0
 01152   896   NtProtectVirtualMemory  (-1, (0x76b41000), 4096, 32, ... (0x76b41000), 4096, 4, ) == 0x0
 01153   896   NtFlushInstructionCache  (-1, 1991512064, 860, ... ) == 0x0
 01154   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmm.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01155   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 88, ) == 0x0
 01156   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 84, ) == 0x0
 01157   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 92, ) == 0x0
 01158   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32"}, ... 96, ) }, ... 96, ) == 0x0
 01159   896   NtQueryValueKey  (96,  (96, "wave", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "wave", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01160   896   NtAllocateVirtualMemory  (-1, 0, 0, 524280, 8192, 4, ... 14942208, 524288, ) == 0x0
 01161   896   NtAllocateVirtualMemory  (-1, 14942208, 0, 4096, 4096, 4, ... 14942208, 4096, ) == 0x0
 01162   896   NtQueryValueKey  (96,  (96, "wave", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "wave", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01163   896   NtQueryValueKey  (96,  (96, "wave1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "wave1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01164   896   NtQueryValueKey  (96,  (96, "wave1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "wave1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01165   896   NtQueryValueKey  (96,  (96, "wave2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01166   896   NtQueryValueKey  (96,  (96, "wave3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01167   896   NtQueryValueKey  (96,  (96, "wave4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01168   896   NtQueryValueKey  (96,  (96, "wave5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01169   896   NtQueryValueKey  (96,  (96, "wave6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01170   896   NtQueryValueKey  (96,  (96, "wave7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01171   896   NtQueryValueKey  (96,  (96, "wave8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01172   896   NtQueryValueKey  (96,  (96, "wave9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01173   896   NtQueryValueKey  (96,  (96, "midi", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "midi", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01174   896   NtQueryValueKey  (96,  (96, "midi", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "midi", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01175   896   NtQueryValueKey  (96,  (96, "midi1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "midi1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01176   896   NtQueryValueKey  (96,  (96, "midi1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "midi1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01177   896   NtQueryValueKey  (96,  (96, "midi2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01178   896   NtQueryValueKey  (96,  (96, "midi3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01179   896   NtQueryValueKey  (96,  (96, "midi4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01180   896   NtQueryValueKey  (96,  (96, "midi5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01181   896   NtQueryValueKey  (96,  (96, "midi6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01182   896   NtQueryValueKey  (96,  (96, "midi7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01183   896   NtQueryValueKey  (96,  (96, "midi8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01184   896   NtQueryValueKey  (96,  (96, "midi9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01185   896   NtQueryTimerResolution  (... 156250, 10000, 156250, ) == 0x0
 01186   896   NtQueryValueKey  (96,  (96, "aux", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "aux", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01187   896   NtQueryValueKey  (96,  (96, "aux", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "aux", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01188   896   NtQueryValueKey  (96,  (96, "aux1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "aux1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01189   896   NtQueryValueKey  (96,  (96, "aux1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "aux1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01190   896   NtQueryValueKey  (96,  (96, "aux2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01191   896   NtQueryValueKey  (96,  (96, "aux3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01192   896   NtQueryValueKey  (96,  (96, "aux4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01193   896   NtQueryValueKey  (96,  (96, "aux5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01194   896   NtQueryValueKey  (96,  (96, "aux6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01195   896   NtQueryValueKey  (96,  (96, "aux7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01196   896   NtQueryValueKey  (96,  (96, "aux8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01197   896   NtQueryValueKey  (96,  (96, "aux9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01198   896   NtUserRegisterWindowMessage  ( ("MSJSTICK_VJOYD_MSGSTR", ... ) , ... ) == 0xc076
 01199   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm"}, ... 100, ) }, ... 100, ) == 0x0
 01200   896   NtQueryValueKey  (100,  (100, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01201   896   NtClose  (100, ... ) == 0x0
 01202   896   NtCreateEvent  (0x1f0003, {24, 72, 0x80, 0, 0,  (0x1f0003, {24, 72, 0x80, 0, 0, "DINPUTWINMM"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 01203   896   NtQueryValueKey  (96,  (96, "mixer", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "mixer", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01204   896   NtQueryValueKey  (96,  (96, "mixer", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "mixer", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01205   896   NtQueryValueKey  (96,  (96, "mixer1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "mixer1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01206   896   NtQueryValueKey  (96,  (96, "mixer1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (96, "mixer1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 01207   896   NtQueryValueKey  (96,  (96, "mixer2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01208   896   NtQueryValueKey  (96,  (96, "mixer3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01209   896   NtQueryValueKey  (96,  (96, "mixer4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01210   896   NtQueryValueKey  (96,  (96, "mixer5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01211   896   NtQueryValueKey  (96,  (96, "mixer6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   896   NtQueryValueKey  (96,  (96, "mixer7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01213   896   NtQueryValueKey  (96,  (96, "mixer8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01214   896   NtQueryValueKey  (96,  (96, "mixer9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01215   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15466496, 1048576, ) == 0x0
 01216   896   NtAllocateVirtualMemory  (-1, 16506880, 0, 8192, 4096, 4, ... 16506880, 8192, ) == 0x0
 01217   896   NtProtectVirtualMemory  (-1, (0xfbe000), 4096, 260, ... (0xfbe000), 4096, 4, ) == 0x0
 01218   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244080, 1244024, 1, ... 100, {1252, 2016}, ) == 0x0
 01219   896   NtQueryInformationThread  (100, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 01220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 5986764, 0, 65535, 2147344384}  (24, {28, 56, new_msg, 0, 5986764, 0, 65535, 2147344384} "\0\0\0\0\1\0\1\0\\23\264v\334\343\200|d\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|d\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 5986764, 0, 65535, 2147344384} "\0\0\0\0\1\0\1\0\\23\264v\334\343\200|d\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|d\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 01221   896   NtResumeThread  (100, ... 1, ) == 0x0
 01222  2016   NtTestAlert  (... ) == 0x0
 01223  2016   NtContinue  (16514352, 1, ...
 01224  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01225  2016   NtDelayExecution  (0, {-150000, -1}, ...
 01226   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 16515072, 1048576, ) == 0x0
 01227   896   NtAllocateVirtualMemory  (-1, 17555456, 0, 8192, 4096, 4, ... 17555456, 8192, ) == 0x0
 01228   896   NtProtectVirtualMemory  (-1, (0x10be000), 4096, 260, ... (0x10be000), 4096, 4, ) == 0x0
 01229   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244080, 1244024, 1, ... 104, {1252, 596}, ) == 0x0
 01230   896   NtQueryInformationThread  (104, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=596,}, 0x0, ) == 0x0
 01231   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|h\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|h\0\0\0\344\4\0\0T\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81840, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|h\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|h\0\0\0\344\4\0\0T\2\0\0" )  ) == 0x0
 01232   896   NtResumeThread  (104, ... 1, ) == 0x0
 01233   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17563648, 1048576, ) == 0x0
 01234   896   NtAllocateVirtualMemory  (-1, 18604032, 0, 8192, 4096, 4, ...
 01235   596   NtTestAlert  (... ) == 0x0
 01236   596   NtContinue  (17562928, 1, ...
 01237   596   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01238   596   NtDelayExecution  (0, {-150000, -1}, ...
 01234   896   NtAllocateVirtualMemory  ... 18604032, 8192, ) == 0x0
 01239   896   NtProtectVirtualMemory  (-1, (0x11be000), 4096, 260, ... (0x11be000), 4096, 4, ) == 0x0
 01240   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244080, 1244024, 1, ... 108, {1252, 376}, ) == 0x0
 01241   896   NtQueryInformationThread  (108, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=376,}, 0x0, ) == 0x0
 01242   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|l\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|l\0\0\0\344\4\0\0x\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|l\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|l\0\0\0\344\4\0\0x\1\0\0" )  ) == 0x0
 01243   896   NtResumeThread  (108, ... 1, ) == 0x0
 01244   376   NtTestAlert  (... ) == 0x0
 01245   376   NtContinue  (18611504, 1, ...
 01246   376   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01247   376   NtDelayExecution  (0, {-150000, -1}, ...
 01248   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 18612224, 1048576, ) == 0x0
 01249   896   NtAllocateVirtualMemory  (-1, 19652608, 0, 8192, 4096, 4, ... 19652608, 8192, ) == 0x0
 01250   896   NtProtectVirtualMemory  (-1, (0x12be000), 4096, 260, ... (0x12be000), 4096, 4, ) == 0x0
 01251   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244080, 1244024, 1, ... 112, {1252, 420}, ) == 0x0
 01252   896   NtQueryInformationThread  (112, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=420,}, 0x0, ) == 0x0
 01253   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|p\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|p\0\0\0\344\4\0\0\244\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81842, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|p\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|p\0\0\0\344\4\0\0\244\1\0\0" )  ) == 0x0
 01254   896   NtResumeThread  (112, ... 1, ) == 0x0
 01255   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19660800, 1048576, ) == 0x0
 01256   896   NtAllocateVirtualMemory  (-1, 20701184, 0, 8192, 4096, 4, ...
 01257   420   NtTestAlert  (... ) == 0x0
 01258   420   NtContinue  (19660080, 1, ...
 01259   420   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01260   420   NtDelayExecution  (0, {-150000, -1}, ...
 01256   896   NtAllocateVirtualMemory  ... 20701184, 8192, ) == 0x0
 01261   896   NtProtectVirtualMemory  (-1, (0x13be000), 4096, 260, ... (0x13be000), 4096, 4, ) == 0x0
 01262   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244080, 1244024, 1, ... 116, {1252, 384}, ) == 0x0
 01263   896   NtQueryInformationThread  (116, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=384,}, 0x0, ) == 0x0
 01264   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|t\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|t\0\0\0\344\4\0\0\200\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|t\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|t\0\0\0\344\4\0\0\200\1\0\0" )  ) == 0x0
 01265   896   NtResumeThread  (116, ... 1, ) == 0x0
 01266   384   NtTestAlert  (... ) == 0x0
 01267   384   NtContinue  (20708656, 1, ...
 01268   384   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01269   384   NtDelayExecution  (0, {-150000, -1}, ...
 01270   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 20709376, 1048576, ) == 0x0
 01271   896   NtAllocateVirtualMemory  (-1, 21749760, 0, 8192, 4096, 4, ... 21749760, 8192, ) == 0x0
 01272   896   NtProtectVirtualMemory  (-1, (0x14be000), 4096, 260, ... (0x14be000), 4096, 4, ) == 0x0
 01273   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244080, 1244024, 1, ... 120, {1252, 1028}, ) == 0x0
 01274   896   NtQueryInformationThread  (120, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 01275   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|x\0\0\0\344\4\0\0\4\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|x\0\0\0\344\4\0\0\4\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|x\0\0\0\344\4\0\0\4\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|x\0\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 01276   896   NtResumeThread  (120, ... 1, ) == 0x0
 01277   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 21757952, 1048576, ) == 0x0
 01278   896   NtAllocateVirtualMemory  (-1, 22798336, 0, 8192, 4096, 4, ...
 01279  1028   NtTestAlert  (... ) == 0x0
 01280  1028   NtContinue  (21757232, 1, ...
 01281  1028   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01282  1028   NtDelayExecution  (0, {-150000, -1}, ...
 01278   896   NtAllocateVirtualMemory  ... 22798336, 8192, ) == 0x0
 01283   896   NtProtectVirtualMemory  (-1, (0x15be000), 4096, 260, ... (0x15be000), 4096, 4, ) == 0x0
 01284   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244080, 1244024, 1, ... 124, {1252, 2012}, ) == 0x0
 01285   896   NtQueryInformationThread  (124, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=2012,}, 0x0, ) == 0x0
 01286   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200||\0\0\0\344\4\0\0\334\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200||\0\0\0\344\4\0\0\334\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200||\0\0\0\344\4\0\0\334\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200||\0\0\0\344\4\0\0\334\7\0\0" )  ) == 0x0
 01287   896   NtResumeThread  (124, ... 1, ) == 0x0
 01288  2012   NtTestAlert  (... ) == 0x0
 01289  2012   NtContinue  (22805808, 1, ...
 01290  2012   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01291  2012   NtDelayExecution  (0, {-150000, -1}, ...
 01292   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 22806528, 1048576, ) == 0x0
 01293   896   NtAllocateVirtualMemory  (-1, 23846912, 0, 8192, 4096, 4, ... 23846912, 8192, ) == 0x0
 01294   896   NtProtectVirtualMemory  (-1, (0x16be000), 4096, 260, ... (0x16be000), 4096, 4, ) == 0x0
 01295   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244080, 1244024, 1, ... 128, {1252, 1168}, ) == 0x0
 01296   896   NtQueryInformationThread  (128, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=1168,}, 0x0, ) == 0x0
 01297   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|\200\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|\200\0\0\0\344\4\0\0\220\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|\200\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\334\343\200|\200\0\0\0\344\4\0\0\220\4\0\0" )  ) == 0x0
 01298   896   NtResumeThread  (128, ... 1, ) == 0x0
 01299   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 132, ) == 0x0
 01300   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01301  1168   NtTestAlert  (... ) == 0x0
 01302  1168   NtContinue  (23854384, 1, ...
 01303  1168   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01304  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 01300   896   NtCreateEvent  ... 136, ) == 0x0
 01305   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 140, ) == 0x0
 01306   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 144, ) == 0x0
 01307   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0
 01308   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 152, ) == 0x0
 01309   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 156, ) == 0x0
 01310   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 160, ) == 0x0
 01311   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 164, ) == 0x0
 01312   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01313   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01314   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 176, ) == 0x0
 01315   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 180, ) == 0x0
 01316   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 184, ) == 0x0
 01317   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 188, ) == 0x0
 01318   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 192, ) == 0x0
 01319   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 23855104, 1048576, ) == 0x0
 01320   896   NtAllocateVirtualMemory  (-1, 24895488, 0, 8192, 4096, 4, ... 24895488, 8192, ) == 0x0
 01321   896   NtProtectVirtualMemory  (-1, (0x17be000), 4096, 260, ... (0x17be000), 4096, 4, ) == 0x0
 01322   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 196, {1252, 1180}, ) == 0x0
 01323   896   NtQueryInformationThread  (196, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 01324   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1991507968, 1244878, 1244872, 1244872}  (24, {28, 56, new_msg, 0, 1991507968, 1244878, 1244872, 1244872} "\0\0\0\0\1\0\1\0\34\08\0\2\0\0\0\304\0\0\0\344\4\0\0\234\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\304\0\0\0\344\4\0\0\234\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1991507968, 1244878, 1244872, 1244872} "\0\0\0\0\1\0\1\0\34\08\0\2\0\0\0\304\0\0\0\344\4\0\0\234\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\304\0\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 01325   896   NtResumeThread  (196, ... 1, ) == 0x0
 01326   896   NtSetInformationThread  (196, BasePriority, {thread info, class 3, size 4}, 4, ...
 01327  1180   NtTestAlert  (... ) == 0x0
 01328  1180   NtContinue  (24902960, 1, ...
 01329  1180   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01330  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 01326   896   NtSetInformationThread  ... ) == 0x0
 01331   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 24903680, 1048576, ) == 0x0
 01332   896   NtAllocateVirtualMemory  (-1, 25944064, 0, 8192, 4096, 4, ... 25944064, 8192, ) == 0x0
 01333   896   NtProtectVirtualMemory  (-1, (0x18be000), 4096, 260, ... (0x18be000), 4096, 4, ) == 0x0
 01334   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 200, {1252, 928}, ) == 0x0
 01335   896   NtQueryInformationThread  (200, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=928,}, 0x0, ) == 0x0
 01336   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\310\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\310\0\0\0\344\4\0\0\240\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\310\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\310\0\0\0\344\4\0\0\240\3\0\0" )  ) == 0x0
 01337   896   NtResumeThread  (200, ... 1, ) == 0x0
 01338   896   NtSetInformationThread  (200, BasePriority, {thread info, class 3, size 4}, 4, ...
 01339   928   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 01340   928   NtTestAlert  (... ) == 0x0
 01341   928   NtContinue  (25951536, 1, ...
 01342   928   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01343   928   NtWaitForSingleObject  (136, 0, 0x0, ...
 01338   896   NtSetInformationThread  ... ) == 0x0
 01344   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 25952256, 1048576, ) == 0x0
 01345   896   NtAllocateVirtualMemory  (-1, 26992640, 0, 8192, 4096, 4, ... 26992640, 8192, ) == 0x0
 01346   896   NtProtectVirtualMemory  (-1, (0x19be000), 4096, 260, ... (0x19be000), 4096, 4, ) == 0x0
 01347   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 204, {1252, 428}, ) == 0x0
 01348   896   NtQueryInformationThread  (204, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=428,}, 0x0, ) == 0x0
 01349   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\314\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\314\0\0\0\344\4\0\0\254\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\314\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\314\0\0\0\344\4\0\0\254\1\0\0" )  ) == 0x0
 01350   896   NtResumeThread  (204, ... 1, ) == 0x0
 01351   428   NtTestAlert  (... ) == 0x0
 01352   428   NtContinue  (27000112, 1, ...
 01353   428   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01354   428   NtWaitForSingleObject  (140, 0, 0x0, ...
 01355   896   NtSetInformationThread  (204, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 01356   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27000832, 1048576, ) == 0x0
 01357   896   NtAllocateVirtualMemory  (-1, 28041216, 0, 8192, 4096, 4, ... 28041216, 8192, ) == 0x0
 01358   896   NtProtectVirtualMemory  (-1, (0x1abe000), 4096, 260, ... (0x1abe000), 4096, 4, ) == 0x0
 01359   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 208, {1252, 1732}, ) == 0x0
 01360   896   NtQueryInformationThread  (208, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 01361   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\320\0\0\0\344\4\0\0\304\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\320\0\0\0\344\4\0\0\304\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\320\0\0\0\344\4\0\0\304\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\320\0\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 01362   896   NtResumeThread  (208, ... 1, ) == 0x0
 01363   896   NtSetInformationThread  (208, BasePriority, {thread info, class 3, size 4}, 4, ...
 01364  1732   NtTestAlert  (... ) == 0x0
 01365  1732   NtContinue  (28048688, 1, ...
 01366  1732   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01367  1732   NtWaitForSingleObject  (144, 0, 0x0, ...
 01363   896   NtSetInformationThread  ... ) == 0x0
 01368   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28049408, 1048576, ) == 0x0
 01369   896   NtAllocateVirtualMemory  (-1, 29089792, 0, 8192, 4096, 4, ... 29089792, 8192, ) == 0x0
 01370   896   NtProtectVirtualMemory  (-1, (0x1bbe000), 4096, 260, ... (0x1bbe000), 4096, 4, ) == 0x0
 01371   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 212, {1252, 748}, ) == 0x0
 01372   896   NtQueryInformationThread  (212, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=748,}, 0x0, ) == 0x0
 01373   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\344\4\0\0\354\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\344\4\0\0\354\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81851, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\344\4\0\0\354\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\344\4\0\0\354\2\0\0" )  ) == 0x0
 01374   896   NtResumeThread  (212, ... 1, ) == 0x0
 01375   896   NtSetInformationThread  (212, BasePriority, {thread info, class 3, size 4}, 4, ...
 01376   748   NtTestAlert  (... ) == 0x0
 01377   748   NtContinue  (29097264, 1, ...
 01378   748   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01379   748   NtWaitForSingleObject  (148, 0, 0x0, ...
 01375   896   NtSetInformationThread  ... ) == 0x0
 01225  2016   NtDelayExecution  ... ) == 0x0
 01238   596   NtDelayExecution  ... ) == 0x0
 01247   376   NtDelayExecution  ... ) == 0x0
 01260   420   NtDelayExecution  ... ) == 0x0
 01269   384   NtDelayExecution  ... ) == 0x0
 01282  1028   NtDelayExecution  ... ) == 0x0
 01291  2012   NtDelayExecution  ... ) == 0x0
 01380  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 01381   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01382   376   NtDelayExecution  (0, {-20010000, -1}, ...
 01383   420   NtDelayExecution  (0, {-20010000, -1}, ...
 01384   384   NtDelayExecution  (0, {-20010000, -1}, ...
 01385  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 01386  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 01387   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 29097984, 1048576, ) == 0x0
 01388   896   NtAllocateVirtualMemory  (-1, 30138368, 0, 8192, 4096, 4, ... 30138368, 8192, ) == 0x0
 01389   896   NtProtectVirtualMemory  (-1, (0x1cbe000), 4096, 260, ... (0x1cbe000), 4096, 4, ) == 0x0
 01390   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 216, {1252, 900}, ) == 0x0
 01391   896   NtQueryInformationThread  (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=900,}, 0x0, ) == 0x0
 01392   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\344\4\0\0\204\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\344\4\0\0\204\3\0\0" )  ) == 0x0
 01393   896   NtResumeThread  (216, ... 1, ) == 0x0
 01394   896   NtSetInformationThread  (216, BasePriority, {thread info, class 3, size 4}, 4, ...
 01395   900   NtTestAlert  (... ) == 0x0
 01396   900   NtContinue  (30145840, 1, ...
 01397   900   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01398   900   NtWaitForSingleObject  (152, 0, 0x0, ...
 01394   896   NtSetInformationThread  ... ) == 0x0
 01399   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 30146560, 1048576, ) == 0x0
 01400   896   NtAllocateVirtualMemory  (-1, 31186944, 0, 8192, 4096, 4, ... 31186944, 8192, ) == 0x0
 01401   896   NtProtectVirtualMemory  (-1, (0x1dbe000), 4096, 260, ... (0x1dbe000), 4096, 4, ) == 0x0
 01402   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 220, {1252, 1388}, ) == 0x0
 01403   896   NtQueryInformationThread  (220, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 01404   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\344\4\0\0l\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 01405   896   NtResumeThread  (220, ... 1, ) == 0x0
 01406   896   NtSetInformationThread  (220, BasePriority, {thread info, class 3, size 4}, 4, ...
 01407  1388   NtTestAlert  (... ) == 0x0
 01408  1388   NtContinue  (31194416, 1, ...
 01409  1388   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01410  1388   NtWaitForSingleObject  (156, 0, 0x0, ...
 01406   896   NtSetInformationThread  ... ) == 0x0
 01411   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 31195136, 1048576, ) == 0x0
 01412   896   NtAllocateVirtualMemory  (-1, 32235520, 0, 8192, 4096, 4, ... 32235520, 8192, ) == 0x0
 01413   896   NtProtectVirtualMemory  (-1, (0x1ebe000), 4096, 260, ... (0x1ebe000), 4096, 4, ) == 0x0
 01414   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 224, {1252, 2036}, ) == 0x0
 01415   896   NtQueryInformationThread  (224, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=2036,}, 0x0, ) == 0x0
 01416   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\344\4\0\0\364\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\344\4\0\0\364\7\0\0" )  ) == 0x0
 01417   896   NtResumeThread  (224, ... 1, ) == 0x0
 01418   896   NtSetInformationThread  (224, BasePriority, {thread info, class 3, size 4}, 4, ...
 01419  2036   NtTestAlert  (... ) == 0x0
 01420  2036   NtContinue  (32242992, 1, ...
 01421  2036   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01422  2036   NtWaitForSingleObject  (160, 0, 0x0, ...
 01418   896   NtSetInformationThread  ... ) == 0x0
 01423   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32243712, 1048576, ) == 0x0
 01424   896   NtAllocateVirtualMemory  (-1, 33284096, 0, 8192, 4096, 4, ... 33284096, 8192, ) == 0x0
 01425   896   NtProtectVirtualMemory  (-1, (0x1fbe000), 4096, 260, ... (0x1fbe000), 4096, 4, ) == 0x0
 01426   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 228, {1252, 1372}, ) == 0x0
 01427   896   NtQueryInformationThread  (228, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1372,}, 0x0, ) == 0x0
 01428   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\344\4\0\0\\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\344\4\0\0\\5\0\0" )  ) == 0x0
 01429   896   NtResumeThread  (228, ... 1, ) == 0x0
 01430  1372   NtTestAlert  (... ) == 0x0
 01431  1372   NtContinue  (33291568, 1, ...
 01432  1372   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01433  1372   NtWaitForSingleObject  (164, 0, 0x0, ...
 01434   896   NtSetInformationThread  (228, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 01435   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 33292288, 1048576, ) == 0x0
 01436   896   NtAllocateVirtualMemory  (-1, 34332672, 0, 8192, 4096, 4, ... 34332672, 8192, ) == 0x0
 01437   896   NtProtectVirtualMemory  (-1, (0x20be000), 4096, 260, ... (0x20be000), 4096, 4, ) == 0x0
 01438   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 232, {1252, 1600}, ) == 0x0
 01439   896   NtQueryInformationThread  (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 01440   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\344\4\0\0@\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 01441   896   NtResumeThread  (232, ... 1, ) == 0x0
 01442   896   NtSetInformationThread  (232, BasePriority, {thread info, class 3, size 4}, 4, ...
 01443  1600   NtTestAlert  (... ) == 0x0
 01444  1600   NtContinue  (34340144, 1, ...
 01445  1600   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01446  1600   NtWaitForSingleObject  (168, 0, 0x0, ...
 01442   896   NtSetInformationThread  ... ) == 0x0
 01447   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 34340864, 1048576, ) == 0x0
 01448   896   NtAllocateVirtualMemory  (-1, 35381248, 0, 8192, 4096, 4, ... 35381248, 8192, ) == 0x0
 01449   896   NtProtectVirtualMemory  (-1, (0x21be000), 4096, 260, ... (0x21be000), 4096, 4, ) == 0x0
 01450   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 236, {1252, 1948}, ) == 0x0
 01451   896   NtQueryInformationThread  (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=1948,}, 0x0, ) == 0x0
 01452   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\344\4\0\0\234\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\344\4\0\0\234\7\0\0" )  ) == 0x0
 01453   896   NtResumeThread  (236, ... 1, ) == 0x0
 01454   896   NtSetInformationThread  (236, BasePriority, {thread info, class 3, size 4}, 4, ...
 01455  1948   NtTestAlert  (... ) == 0x0
 01456  1948   NtContinue  (35388720, 1, ...
 01457  1948   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01458  1948   NtWaitForSingleObject  (172, 0, 0x0, ...
 01454   896   NtSetInformationThread  ... ) == 0x0
 01459   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 35389440, 1048576, ) == 0x0
 01460   896   NtAllocateVirtualMemory  (-1, 36429824, 0, 8192, 4096, 4, ... 36429824, 8192, ) == 0x0
 01461   896   NtProtectVirtualMemory  (-1, (0x22be000), 4096, 260, ... (0x22be000), 4096, 4, ) == 0x0
 01462   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 240, {1252, 252}, ) == 0x0
 01463   896   NtQueryInformationThread  (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa6000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 01464   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\360\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\360\0\0\0\344\4\0\0\374\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\360\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\360\0\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 01465   896   NtResumeThread  (240, ... 1, ) == 0x0
 01466   896   NtSetInformationThread  (240, BasePriority, {thread info, class 3, size 4}, 4, ...
 01467   252   NtTestAlert  (... ) == 0x0
 01468   252   NtContinue  (36437296, 1, ...
 01469   252   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01470   252   NtWaitForSingleObject  (176, 0, 0x0, ...
 01466   896   NtSetInformationThread  ... ) == 0x0
 01471   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 36438016, 1048576, ) == 0x0
 01472   896   NtAllocateVirtualMemory  (-1, 37478400, 0, 8192, 4096, 4, ... 37478400, 8192, ) == 0x0
 01473   896   NtProtectVirtualMemory  (-1, (0x23be000), 4096, 260, ... (0x23be000), 4096, 4, ) == 0x0
 01474   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 244, {1252, 1300}, ) == 0x0
 01475   896   NtQueryInformationThread  (244, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa5000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 01476   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\364\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\364\0\0\0\344\4\0\0\24\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\364\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\364\0\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 01477   896   NtResumeThread  (244, ... 1, ) == 0x0
 01478   896   NtSetInformationThread  (244, BasePriority, {thread info, class 3, size 4}, 4, ...
 01479  1300   NtTestAlert  (... ) == 0x0
 01480  1300   NtContinue  (37485872, 1, ...
 01481  1300   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01482  1300   NtWaitForSingleObject  (180, 0, 0x0, ...
 01478   896   NtSetInformationThread  ... ) == 0x0
 01483   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 37486592, 1048576, ) == 0x0
 01484   896   NtAllocateVirtualMemory  (-1, 38526976, 0, 8192, 4096, 4, ... 38526976, 8192, ) == 0x0
 01485   896   NtProtectVirtualMemory  (-1, (0x24be000), 4096, 260, ... (0x24be000), 4096, 4, ) == 0x0
 01486   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 248, {1252, 1096}, ) == 0x0
 01487   896   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa4000,Pid=1252,Tid=1096,}, 0x0, ) == 0x0
 01488   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\370\0\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\370\0\0\0\344\4\0\0H\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\370\0\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\370\0\0\0\344\4\0\0H\4\0\0" )  ) == 0x0
 01489   896   NtResumeThread  (248, ... 1, ) == 0x0
 01490   896   NtSetInformationThread  (248, BasePriority, {thread info, class 3, size 4}, 4, ...
 01491  1096   NtTestAlert  (... ) == 0x0
 01492  1096   NtContinue  (38534448, 1, ...
 01493  1096   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01494  1096   NtWaitForSingleObject  (184, 0, 0x0, ...
 01490   896   NtSetInformationThread  ... ) == 0x0
 01495   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 38535168, 1048576, ) == 0x0
 01496   896   NtAllocateVirtualMemory  (-1, 39575552, 0, 8192, 4096, 4, ... 39575552, 8192, ) == 0x0
 01497   896   NtProtectVirtualMemory  (-1, (0x25be000), 4096, 260, ... (0x25be000), 4096, 4, ) == 0x0
 01498   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 252, {1252, 1708}, ) == 0x0
 01499   896   NtQueryInformationThread  (252, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa3000,Pid=1252,Tid=1708,}, 0x0, ) == 0x0
 01500   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\374\0\0\0\344\4\0\0\254\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\374\0\0\0\344\4\0\0\254\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\374\0\0\0\344\4\0\0\254\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\374\0\0\0\344\4\0\0\254\6\0\0" )  ) == 0x0
 01501   896   NtResumeThread  (252, ... 1, ) == 0x0
 01502  1708   NtTestAlert  (... ) == 0x0
 01503  1708   NtContinue  (39583024, 1, ...
 01504  1708   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01505  1708   NtWaitForSingleObject  (188, 0, 0x0, ...
 01506   896   NtSetInformationThread  (252, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 01507   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 39583744, 1048576, ) == 0x0
 01508   896   NtAllocateVirtualMemory  (-1, 40624128, 0, 8192, 4096, 4, ... 40624128, 8192, ) == 0x0
 01509   896   NtProtectVirtualMemory  (-1, (0x26be000), 4096, 260, ... (0x26be000), 4096, 4, ) == 0x0
 01510   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244048, 1243992, 1, ... 256, {1252, 1024}, ) == 0x0
 01511   896   NtQueryInformationThread  (256, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa2000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 01512   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\0\1\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\0\1\0\0\344\4\0\0\0\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\0\1\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\0\1\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 01513   896   NtResumeThread  (256, ... 1, ) == 0x0
 01514   896   NtSetInformationThread  (256, BasePriority, {thread info, class 3, size 4}, 4, ...
 01515  1024   NtTestAlert  (... ) == 0x0
 01516  1024   NtContinue  (40631600, 1, ...
 01517  1024   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01518  1024   NtWaitForSingleObject  (192, 0, 0x0, ...
 01514   896   NtSetInformationThread  ... ) == 0x0
 01519   896   NtSetEvent  (140, ...
 01354   428   NtWaitForSingleObject  ... ) == 0x0
 01520   428   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01521   428   NtWaitForSingleObject  (140, 0, 0x0, ...
 01519   896   NtSetEvent  ... 0x0, ) == 0x0
 01522   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01523   896   NtSetEvent  (184, ...
 01494  1096   NtWaitForSingleObject  ... ) == 0x0
 01524  1096   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01525  1096   NtWaitForSingleObject  (184, 0, 0x0, ...
 01523   896   NtSetEvent  ... 0x0, ) == 0x0
 01526   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01527   896   NtQueryVirtualMemory  (-1, 0x10000, Basic, 28, ... {BaseAddress=0x10000,AllocationBase=0x10000,AllocationProtect=0x4,RegionSize=0x2000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 01528   896   NtSetEvent  (144, ...
 01367  1732   NtWaitForSingleObject  ... ) == 0x0
 01529  1732   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01530  1732   NtWaitForSingleObject  (144, 0, 0x0, ...
 01528   896   NtSetEvent  ... 0x0, ) == 0x0
 01531   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01532   896   NtSetEvent  (192, ...
 01518  1024   NtWaitForSingleObject  ... ) == 0x0
 01533  1024   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01534  1024   NtWaitForSingleObject  (192, 0, 0x0, ...
 01532   896   NtSetEvent  ... 0x0, ) == 0x0
 01535   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01536   896   NtUserGetForegroundWindow  (... ) == 0xf0104
 01537   896   NtUserValidateHandleSecure  (983300, ... ) == 0x1
 01538   896   NtUserQueryWindow  (983300, 0, ... ) == 0x2fc
 01539   896   NtSetEvent  (140, ...
 01521   428   NtWaitForSingleObject  ... ) == 0x0
 01540   428   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01541   428   NtWaitForSingleObject  (140, 0, 0x0, ...
 01539   896   NtSetEvent  ... 0x0, ) == 0x0
 01542   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01543   896   NtSetEvent  (160, ...
 01422  2036   NtWaitForSingleObject  ... ) == 0x0
 01544  2036   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01545  2036   NtWaitForSingleObject  (160, 0, 0x0, ...
 01543   896   NtSetEvent  ... 0x0, ) == 0x0
 01546   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01547   896   NtSetEvent  (172, ...
 01458  1948   NtWaitForSingleObject  ... ) == 0x0
 01548  1948   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01549  1948   NtWaitForSingleObject  (172, 0, 0x0, ...
 01547   896   NtSetEvent  ... 0x0, ) == 0x0
 01550   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01551   896   NtSetEvent  (132, ...
 01330  1180   NtWaitForSingleObject  ... ) == 0x0
 01552  1180   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01553  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 01551   896   NtSetEvent  ... 0x0, ) == 0x0
 01554   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01555   896   NtSetEvent  (192, ...
 01534  1024   NtWaitForSingleObject  ... ) == 0x0
 01556  1024   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01557  1024   NtWaitForSingleObject  (192, 0, 0x0, ...
 01555   896   NtSetEvent  ... 0x0, ) == 0x0
 01558   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01559   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 40632320, 65536, ) == 0x0
 01560   896   NtQuerySystemInformation  (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0
 01561   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 65536, ) == 0x0
 01562   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 40632320, 65536, ) == 0x0
 01563   896   NtQuerySystemInformation  (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0
 01564   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 65536, ) == 0x0
 01565   896   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 01566   896   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 01567   896   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 01568   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 40632320, 65536, ) == 0x0
 01569   896   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 01570   896   NtCreateSection  (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 260, ) == 0x0
 01571   896   NtMapViewOfSection  (260, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0x26d0000), 0x0, 4194304, ) == 0x0
 01572   896   NtAllocateVirtualMemory  (-1, 40697856, 0, 1, 4096, 4, ... 40697856, 4096, ) == 0x0
 01573   896   NtAllocateVirtualMemory  (-1, 40701952, 0, 1116, 4096, 4, ... 40701952, 4096, ) == 0x0
 01574   896   NtCreateSection  (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 264, ) == 0x0
 01575   896   NtMapViewOfSection  (264, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0x2ad0000), 0x0, 4194304, ) == 0x0
 01576   896   NtAllocateVirtualMemory  (-1, 44892160, 0, 1, 4096, 4, ... 44892160, 4096, ) == 0x0
 01577   896   NtCreateSection  (0xf0007, 0x0, {46452, 0}, 4, 134217728, 0, ... 268, ) == 0x0
 01578   896   NtMapViewOfSection  (268, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2ed0000), {0, 0}, 49152, ) == 0x0
 01579   896   NtUnmapViewOfSection  (-1, 0x2ed0000, ... ) == 0x0
 01580   896   NtMapViewOfSection  (268, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2ed0000), {0, 0}, 49152, ) == 0x0
 01581   896   NtClose  (264, ... ) == 0x0
 01582   896   NtUnmapViewOfSection  (-1, 0x2ad0000, ... ) == 0x0
 01583   896   NtClose  (260, ... ) == 0x0
 01584   896   NtUnmapViewOfSection  (-1, 0x26d0000, ... ) == 0x0
 01585   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 65536, ) == 0x0
 01586   896   NtUnmapViewOfSection  (-1, 0x2ed0000, ... ) == 0x0
 01587   896   NtMapViewOfSection  (268, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x26c0000), {0, 0}, 49152, ) == 0x0
 01588   896   NtUnmapViewOfSection  (-1, 0x26c0000, ... ) == 0x0
 01589   896   NtMapViewOfSection  (268, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x26c0000), {0, 0}, 49152, ) == 0x0
 01590   896   NtUnmapViewOfSection  (-1, 0x26c0000, ... ) == 0x0
 01591   896   NtSetEvent  (180, ...
 01482  1300   NtWaitForSingleObject  ... ) == 0x0
 01592  1300   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01593  1300   NtWaitForSingleObject  (180, 0, 0x0, ...
 01591   896   NtSetEvent  ... 0x0, ) == 0x0
 01594   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01595   896   NtSetEvent  (172, ...
 01549  1948   NtWaitForSingleObject  ... ) == 0x0
 01596  1948   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01597  1948   NtWaitForSingleObject  (172, 0, 0x0, ...
 01595   896   NtSetEvent  ... 0x0, ) == 0x0
 01598   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01599   896   NtSetEvent  (164, ...
 01433  1372   NtWaitForSingleObject  ... ) == 0x0
 01600  1372   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01601  1372   NtWaitForSingleObject  (164, 0, 0x0, ...
 01599   896   NtSetEvent  ... 0x0, ) == 0x0
 01602   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01603   896   NtQueryVirtualMemory  (-1, 0x7c809e68, Basic, 28, ... {BaseAddress=0x7c809000,AllocationBase=0x7c800000,AllocationProtect=0x80,RegionSize=0x7b000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01604   896   NtContinue  (1243208, 0, ...
 01605   896   NtSetEvent  (180, ...
 01593  1300   NtWaitForSingleObject  ... ) == 0x0
 01606  1300   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01607  1300   NtWaitForSingleObject  (180, 0, 0x0, ...
 01605   896   NtSetEvent  ... 0x0, ) == 0x0
 01608   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01609   896   NtAllocateVirtualMemory  (-1, 0, 0, 1000, 4096, 4, ... 40632320, 4096, ) == 0x0
 01610   896   NtQueryInformationProcess  (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 01611   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 4096, ) == 0x0
 01612   896   NtUserFindWindowEx  (0, 0,  (0, 0, "FilemonClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 01613   896   NtUserFindWindowEx  (0, 0, 0x0,  (0, 0, 0x0, "File Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0
 01614   896   NtUserFindWindowEx  (0, 0,  (0, 0, "PROCMON_WINDOW_CLASS", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 01615   896   NtUserFindWindowEx  (0, 0, 0x0,  (0, 0, 0x0, "Process Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0
 01616   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 40632320, 65536, ) == 0x0
 01617   896   NtQuerySystemInformation  (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0
 01618   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 65536, ) == 0x0
 01619   896   NtSetEvent  (148, ...
 01379   748   NtWaitForSingleObject  ... ) == 0x0
 01620   748   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01621   748   NtWaitForSingleObject  (148, 0, 0x0, ...
 01619   896   NtSetEvent  ... 0x0, ) == 0x0
 01622   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01623   896   NtSetEvent  (180, ...
 01607  1300   NtWaitForSingleObject  ... ) == 0x0
 01624  1300   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01625  1300   NtWaitForSingleObject  (180, 0, 0x0, ...
 01623   896   NtSetEvent  ... 0x0, ) == 0x0
 01626   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01627   896   NtUserFindWindowEx  (0, 0,  (0, 0, "RegmonClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 01628   896   NtUserFindWindowEx  (0, 0, 0x0,  (0, 0, 0x0, "Registry Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0
 01629   896   NtUserFindWindowEx  (0, 0,  (0, 0, "18467-41", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 01630   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 40632320, 65536, ) == 0x0
 01631   896   NtQuerySystemInformation  (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0
 01632   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 65536, ) == 0x0
 01633   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 40632320, 65536, ) == 0x0
 01634   896   NtQuerySystemInformation  (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0
 01635   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 65536, ) == 0x0
 01636   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 40632320, 65536, ) == 0x0
 01637   896   NtQuerySystemInformation  (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0
 01638   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 65536, ) == 0x0
 01639   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 40632320, 65536, ) == 0x0
 01640   896   NtQuerySystemInformation  (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0
 01641   896   NtFreeVirtualMemory  (-1, (0x26c0000), 0, 32768, ... (0x26c0000), 65536, ) == 0x0
 01642   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "SOFTWARE\NuMega\DriverStudio"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01643   896   NtSetEvent  (144, ...
 01530  1732   NtWaitForSingleObject  ... ) == 0x0
 01644  1732   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01645  1732   NtWaitForSingleObject  (144, 0, 0x0, ...
 01643   896   NtSetEvent  ... 0x0, ) == 0x0
 01646   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01647   896   NtSetEvent  (176, ...
 01470   252   NtWaitForSingleObject  ... ) == 0x0
 01648   252   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01649   252   NtWaitForSingleObject  (176, 0, 0x0, ...
 01647   896   NtSetEvent  ... 0x0, ) == 0x0
 01650   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 01651   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\u:\work"}, 3, 33, ... 260, {status=0x0, info=1}, ) }, 3, 33, ... 260, {status=0x0, info=1}, ) == 0x0
 01652   896   NtQueryVolumeInformationFile  (260, 1244936, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01653   896   NtClose  (12, ... ) == 0x0
 01654   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 4, ... 40632320, 4096, ) == 0x0
 01655   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVCP60.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01656   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\MSVCP60.dll"}, 1242956, ... ) }, 1242956, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01657   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSVCP60.dll"}, 1242956, ... ) }, 1242956, ... ) == 0x0
 01658   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSVCP60.dll"}, 5, 96, ... 12, {status=0x0, info=1}, ) }, 5, 96, ... 12, {status=0x0, info=1}, ) == 0x0
 01659   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 12, ... 264, ) == 0x0
 01660   896   NtQuerySection  (264, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01661   896   NtClose  (12, ... ) == 0x0
 01662   896   NtMapViewOfSection  (264, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76080000), 0x0, 413696, ) == 0x0
 01663   896   NtClose  (264, ... ) == 0x0
 01664   896   NtProtectVirtualMemory  (-1, (0x760ac000), 392, 4, ... (0x760ac000), 4096, 2, ) == 0x0
 01665   896   NtProtectVirtualMemory  (-1, (0x760ac000), 4096, 2, ... (0x760ac000), 4096, 4, ) == 0x0
 01666   896   NtFlushInstructionCache  (-1, 1980416000, 392, ... ) == 0x0
 01667   896   NtProtectVirtualMemory  (-1, (0x760ac000), 392, 4, ... (0x760ac000), 4096, 2, ) == 0x0
 01668   896   NtProtectVirtualMemory  (-1, (0x760ac000), 4096, 2, ... (0x760ac000), 4096, 4, ) == 0x0
 01669   896   NtFlushInstructionCache  (-1, 1980416000, 392, ... ) == 0x0
 01670   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCP60.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01671   896   NtAllocateVirtualMemory  (-1, 11358208, 0, 4096, 4096, 4, ... 11358208, 4096, ) == 0x0
 01672   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01673   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\iphlpapi.dll"}, 1242956, ... ) }, 1242956, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01674   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 1242956, ... ) }, 1242956, ... ) == 0x0
 01675   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 5, 96, ... 264, {status=0x0, info=1}, ) }, 5, 96, ... 264, {status=0x0, info=1}, ) == 0x0
 01676   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 264, ... 12, ) == 0x0
 01677   896   NtQuerySection  (12, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01678   896   NtClose  (264, ... ) == 0x0
 01679   896   NtMapViewOfSection  (12, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d60000), 0x0, 102400, ) == 0x0
 01680   896   NtClose  (12, ... ) == 0x0
 01681   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01682   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01683   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01684   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01685   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01686   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01687   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01688   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01689   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01690   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01691   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01692   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01693   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01694   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01695   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01696   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01697   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01698   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01699   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01700   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01701   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40697856, 65536, ) == 0x0
 01702   896   NtAllocateVirtualMemory  (-1, 40697856, 0, 4096, 4096, 4, ... 40697856, 4096, ) == 0x0
 01703   896   NtAllocateVirtualMemory  (-1, 40701952, 0, 8192, 4096, 4, ... 40701952, 8192, ) == 0x0
 01704   896   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 12, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 12, {status=0x0, info=0}, ) == 0x0
 01705   896   NtCreateFile  (0x40000000, {24, 0, 0x40, 0, 0,  (0x40000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 264, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 264, {status=0x0, info=0}, ) == 0x0
 01706   896   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 272, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 272, {status=0x0, info=0}, ) == 0x0
 01707   896   NtCreateFile  (0x100003, {24, 0, 0x40, 0, 0,  (0x100003, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 276, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 276, {status=0x0, info=0}, ) == 0x0
 01708   896   NtCreateFile  (0x20100080, {24, 0, 0x40, 0, 1242884,  (0x20100080, {24, 0, 0x40, 0, 1242884, "\??\Ip"}, 0x0, 128, 3, 1, 64, 0, 0, ... 280, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 64, 0, 0, ... 280, {status=0x0, info=0}, ) == 0x0
 01709   896   NtAllocateVirtualMemory  (-1, 40710144, 0, 36864, 4096, 4, ... 40710144, 36864, ) == 0x0
 01710   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 284, ) == 0x0
 01711   896   NtDeviceIoControlFile  (12, 284, 0x0, 0x0, 0x120003,  (12, 284, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (12, 284, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 01712   896   NtClose  (284, ... ) == 0x0
 01713   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 284, ) == 0x0
 01714   896   NtDeviceIoControlFile  (12, 284, 0x0, 0x0, 0x120003,  (12, 284, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , 36, 348, ... {status=0x0, info=118},  (12, 284, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , ) == 0x0
 01715   896   NtClose  (284, ... ) == 0x0
 01716   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 284, ) == 0x0
 01717   896   NtDeviceIoControlFile  (12, 284, 0x0, 0x0, 0x120003,  (12, 284, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363\232\201\1\0\0\0\5\0\0\0\232A\250\25\2230\265\6\353\210\1\0\326\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0h`k\0v\222\0\0\356\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , 36, 348, ... {status=0x0, info=158},  (12, 284, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363\232\201\1\0\0\0\5\0\0\0\232A\250\25\2230\265\6\353\210\1\0\326\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0h`k\0v\222\0\0\356\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , ) == 0x0
 01718   896   NtClose  (284, ... ) == 0x0
 01719   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 284, ) == 0x0
 01720   896   NtDeviceIoControlFile  (12, 284, 0x0, 0x0, 0x120003,  (12, 284, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (12, 284, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 01721   896   NtClose  (284, ... ) == 0x0
 01722   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 284, ) == 0x0
 01723   896   NtDeviceIoControlFile  (12, 284, 0x0, 0x0, 0x120003,  (12, 284, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , 36, 4, ... {status=0x0, info=4},  (12, 284, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , ) == 0x0
 01724   896   NtClose  (284, ... ) == 0x0
 01725   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 284, ) == 0x0
 01726   896   NtDeviceIoControlFile  (12, 284, 0x0, 0x0, 0x120003,  (12, 284, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , 36, 8, ... {status=0x0, info=8},  (12, 284, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , ) == 0x0
 01727   896   NtClose  (284, ... ) == 0x0
 01728   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 284, ) == 0x0
 01729   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 288, ) == 0x0
 01730   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01731   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01732   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01733   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01734   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01735   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01736   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01737   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01738   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01739   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01740   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01741   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01742   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01743   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01744   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01745   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01746   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01747   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01748   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01749   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01750   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01751   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01752   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01753   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01754   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01755   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01756   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01757   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01758   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01759   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01760   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01761   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01762   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01763   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01764   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01765   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01766   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01767   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01768   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01769   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01770   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01771   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01772   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01773   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01774   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01775   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01776   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01777   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01778   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01779   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01780   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01781   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01782   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01783   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01784   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01785   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01786   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01787   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01788   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01789   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01790   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01791   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01792   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01793   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01794   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01795   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01796   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01797   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01798   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01799   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01800   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01801   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01802   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01803   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01804   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01805   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01806   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01807   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01808   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01809   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01810   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01811   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01812   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01813   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01814   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01815   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01816   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01817   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01818   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01819   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01820   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01821   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01822   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01823   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01824   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01825   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01826   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01827   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01828   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01829   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01830   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01831   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01832   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01833   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01834   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01835   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01836   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01837   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01838   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01839   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01840   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01841   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01842   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01843   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01844   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01845   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01846   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01847   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01848   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01849   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01850   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40763392, 65536, ) == 0x0
 01851   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01852   896   NtAllocateVirtualMemory  (-1, 40763392, 0, 1, 4096, 4, ... 40763392, 4096, ) == 0x0
 01853   896   NtQueryVirtualMemory  (-1, 0x26e0000, Basic, 28, ... {BaseAddress=0x26e0000,AllocationBase=0x26e0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01854   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 65536, ) == 0x0
 01855   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Linkage"}, ... 292, ) }, ... 292, ) == 0x0
 01856   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\"}, ... 296, ) }, ... 296, ) == 0x0
 01857   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces"}, ... 300, ) }, ... 300, ) == 0x0
 01858   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters"}, ... 304, ) }, ... 304, ) == 0x0
 01859   896   NtQueryDefaultLocale  (1, 1242864, ... ) == 0x0
 01860   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHELL32.dll"}, ... 308, ) }, ... 308, ) == 0x0
 01861   896   NtMapViewOfSection  (308, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c9c0000), 0x0, 8482816, ) == 0x0
 01862   896   NtClose  (308, ... ) == 0x0
 01863   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01864   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01865   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01866   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01867   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01868   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01869   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01870   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01871   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01872   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01873   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01874   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01875   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01876   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01877   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01878   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01879   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01880   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01881   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 308, ) }, ... 308, ) == 0x0
 01882   896   NtMapViewOfSection  (308, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 01883   896   NtClose  (308, ... ) == 0x0
 01884   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01885   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01886   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01887   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01888   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01889   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01890   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01891   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01892   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01893   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01894   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01895   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01896   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01897   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01898   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01899   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01900   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01901   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01902   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01903   896   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01904   896   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01905   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01906   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01907   896   NtCreateSemaphore  (0x1f0003, {24, 72, 0x80, 1355512, 0,  (0x1f0003, {24, 72, 0x80, 1355512, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 308, ) }, 0, 2147483647, ... 308, ) == STATUS_OBJECT_NAME_EXISTS
 01908   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01909   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 312, ) }, ... 312, ) == 0x0
 01910   896   NtQueryValueKey  (312,  (312, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01911   896   NtClose  (312, ... ) == 0x0
 01912   896   NtQueryDefaultUILanguage  (1241288, ...
 01913   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01914   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 01915   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01916   896   NtClose  (-2147481368, ... ) == 0x0
 01917   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 01918   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01919   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01920   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01921   896   NtClose  (-2147481452, ... ) == 0x0
 01922   896   NtClose  (-2147481368, ... ) == 0x0
 01912   896   NtQueryDefaultUILanguage  ... ) == 0x0
 01923   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll"}, 1, 96, ... 312, {status=0x0, info=1}, ) }, 1, 96, ... 312, {status=0x0, info=1}, ) == 0x0
 01924   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 312, ... 316, ) == 0x0
 01925   896   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x26e0000), 0x0, 8462336, ) == 0x0
 01926   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01927   896   NtQueryDefaultLocale  (1, 1239384, ... ) == 0x0
 01928   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01929   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240420, 1179817, 1240144}  (24, {128, 156, new_msg, 0, 2088850039, 1240420, 1179817, 1240144} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\18\1\0\0\377\377\377\377\0\0\0\0@ \221\2\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0X\361\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81863, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\18\1\0\0\377\377\377\377\0\0\0\0@ \221\2\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0X\361\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81863, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240420, 1179817, 1240144} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\18\1\0\0\377\377\377\377\0\0\0\0@ \221\2\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0X\361\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81863, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\18\1\0\0\377\377\377\377\0\0\0\0@ \221\2\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0X\361\22\0\0\0\0\0" )  ) == 0x0
 01930   896   NtClose  (312, ... ) == 0x0
 01931   896   NtClose  (316, ... ) == 0x0
 01932   896   NtUnmapViewOfSection  (-1, 0x26e0000, ... ) == 0x0
 01933   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01934   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01935   896   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01936   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01937   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01938   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238576, ... ) }, 1238576, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01939   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01940   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01941   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01942   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1238640, ... ) }, 1238640, ... ) == 0x0
 01943   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 316, {status=0x0, info=1}, ) }, 3, 33, ... 316, {status=0x0, info=1}, ) == 0x0
 01944   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01945   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 312, {status=0x0, info=1}, ) }, 5, 96, ... 312, {status=0x0, info=1}, ) == 0x0
 01946   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 312, ... 320, ) == 0x0
 01947   896   NtClose  (312, ... ) == 0x0
 01948   896   NtMapViewOfSection  (320, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x26e0000), 0x0, 1056768, ) == 0x0
 01949   896   NtClose  (320, ... ) == 0x0
 01950   896   NtUnmapViewOfSection  (-1, 0x26e0000, ... ) == 0x0
 01951   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 320, {status=0x0, info=1}, ) }, 5, 96, ... 320, {status=0x0, info=1}, ) == 0x0
 01952   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 320, ... 312, ) == 0x0
 01953   896   NtQuerySection  (312, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01954   896   NtClose  (320, ... ) == 0x0
 01955   896   NtMapViewOfSection  (312, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 01956   896   NtClose  (312, ... ) == 0x0
 01957   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01958   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01959   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01960   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01961   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01962   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01963   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01964   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01965   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01966   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01967   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01968   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01969   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01970   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01971   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01972   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01973   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01974   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01975   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01976   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01977   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01978   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01979   896   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240120, ... ) , 42, 1240120, ... ) == 0x0
 01980   896   NtQueryDefaultUILanguage  (1238804, ...
 01981   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01982   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 01983   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01984   896   NtClose  (-2147481368, ... ) == 0x0
 01985   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 01986   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01987   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01988   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01989   896   NtClose  (-2147481452, ... ) == 0x0
 01990   896   NtClose  (-2147481368, ... ) == 0x0
 01980   896   NtQueryDefaultUILanguage  ... ) == 0x0
 01991   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237644, ... ) }, 1237644, ... ) == 0x0
 01992   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 312, {status=0x0, info=1}, ) }, 5, 96, ... 312, {status=0x0, info=1}, ) == 0x0
 01993   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 312, ... 320, ) == 0x0
 01994   896   NtClose  (312, ... ) == 0x0
 01995   896   NtMapViewOfSection  (320, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x26e0000), 0x0, 4096, ) == 0x0
 01996   896   NtClose  (320, ... ) == 0x0
 01997   896   NtUnmapViewOfSection  (-1, 0x26e0000, ... ) == 0x0
 01998   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237240, ... ) }, 1237240, ... ) == 0x0
 01999   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237984,  (0x80100080, {24, 0, 0x40, 0, 1237984, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 320, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 320, {status=0x0, info=1}, ) == 0x0
 02000   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 320, ... 312, ) == 0x0
 02001   896   NtClose  (320, ... ) == 0x0
 02002   896   NtMapViewOfSection  (312, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x26e0000), {0, 0}, 4096, ) == 0x0
 02003   896   NtClose  (312, ... ) == 0x0
 02004   896   NtUnmapViewOfSection  (-1, 0x26e0000, ... ) == 0x0
 02005   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 312, {status=0x0, info=1}, ) }, 1, 96, ... 312, {status=0x0, info=1}, ) == 0x0
 02006   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 312, ... 320, ) == 0x0
 02007   896   NtMapViewOfSection  (320, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x26e0000), 0x0, 4096, ) == 0x0
 02008   896   NtQueryInformationFile  (312, 1237636, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02009   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02010   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1237936, 1179817, 1237660}  (24, {128, 156, new_msg, 0, 2088850039, 1237936, 1179817, 1237660} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\18\1\0\0@\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0\244\347\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81864, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\18\1\0\0@\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0\244\347\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81864, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1237936, 1179817, 1237660} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\18\1\0\0@\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0\244\347\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81864, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\18\1\0\0@\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0\244\347\22\0\0\0\0\0" )  ) == 0x0
 02011   896   NtClose  (312, ... ) == 0x0
 02012   896   NtClose  (320, ... ) == 0x0
 02013   896   NtUnmapViewOfSection  (-1, 0x26e0000, ... ) == 0x0
 02014   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02015   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 02016   896   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 02017   896   NtUserGetDC  (0, ... ) == 0x1010052
 02018   896   NtQueryVirtualMemory  (-1, 0x7c91ca50, Basic, 28, ... {BaseAddress=0x7c91c000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x60000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02019   896   NtQueryVirtualMemory  (-1, 0x7c9163a8, Basic, 28, ... {BaseAddress=0x7c916000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02020   896   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02021   896   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02022   896   NtContinue  (1237844, 0, ...
 02023   896   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02024   896   NtUnmapViewOfSection  (-1, 0x773d0000, ... ) == 0x0
 02025   896   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02026   896   NtUnmapViewOfSection  (-1, 0x2f00000, ... ) == 0x0
 02027   896   NtClose  (316, ... ) == 0x0
 02028   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "PSAPI.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02029   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\PSAPI.DLL"}, 1242956, ... ) }, 1242956, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02030   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\PSAPI.DLL"}, 1242956, ... ) }, 1242956, ... ) == 0x0
 02031   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\PSAPI.DLL"}, 5, 96, ... 316, {status=0x0, info=1}, ) }, 5, 96, ... 316, {status=0x0, info=1}, ) == 0x0
 02032   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 316, ... 320, ) == 0x0
 02033   896   NtQuerySection  (320, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02034   896   NtClose  (316, ... ) == 0x0
 02035   896   NtMapViewOfSection  (320, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76bf0000), 0x0, 45056, ) == 0x0
 02036   896   NtClose  (320, ... ) == 0x0
 02037   896   NtProtectVirtualMemory  (-1, (0x76bf1000), 236, 4, ... (0x76bf1000), 4096, 32, ) == 0x0
 02038   896   NtProtectVirtualMemory  (-1, (0x76bf1000), 4096, 32, ... (0x76bf1000), 4096, 4, ) == 0x0
 02039   896   NtFlushInstructionCache  (-1, 1992232960, 236, ... ) == 0x0
 02040   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSAPI.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02041   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02042   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 1242956, ... ) }, 1242956, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02043   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 1242956, ... ) }, 1242956, ... ) == 0x0
 02044   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... 320, {status=0x0, info=1}, ) }, 5, 96, ... 320, {status=0x0, info=1}, ) == 0x0
 02045   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 320, ... 316, ) == 0x0
 02046   896   NtQuerySection  (316, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02047   896   NtClose  (320, ... ) == 0x0
 02048   896   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 02049   896   NtClose  (316, ... ) == 0x0
 02050   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02051   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02052   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02053   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02054   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02055   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02056   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02057   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02058   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02059   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02060   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02061   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02062   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02063   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02064   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02065   896   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02066   896   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02067   896   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02068   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02069   896   NtCreateKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 316, 2, ) }, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 316, 2, ) , 0, ... 316, 2, ) == 0x0
 02070   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 320, ) }, ... 320, ) == 0x0
 02071   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02072   896   NtQueryValueKey  (320,  (320, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02073   896   NtQueryValueKey  (316,  (316, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02074   896   NtQueryValueKey  (320,  (320, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02075   896   NtQueryValueKey  (316,  (316, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02076   896   NtQueryValueKey  (320,  (320, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02077   896   NtQueryValueKey  (316,  (316, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02078   896   NtQueryValueKey  (320,  (320, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02079   896   NtQueryValueKey  (316,  (316, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02080   896   NtQueryValueKey  (320,  (320, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02081   896   NtQueryValueKey  (320,  (320, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02082   896   NtQueryValueKey  (320,  (320, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02083   896   NtQueryValueKey  (320,  (320, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02084   896   NtQueryValueKey  (320,  (320, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02085   896   NtQueryValueKey  (320,  (320, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02086   896   NtQueryValueKey  (320,  (320, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02087   896   NtQueryValueKey  (320,  (320, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02088   896   NtQueryValueKey  (320,  (320, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02089   896   NtQueryValueKey  (316,  (316, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02090   896   NtQueryValueKey  (320,  (320, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02091   896   NtQueryValueKey  (320,  (320, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02092   896   NtQueryValueKey  (316,  (316, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02093   896   NtQueryValueKey  (320,  (320, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02094   896   NtQueryValueKey  (316,  (316, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02095   896   NtQueryValueKey  (320,  (320, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02096   896   NtQueryValueKey  (316,  (316, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02097   896   NtQueryValueKey  (320,  (320, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02098   896   NtQueryValueKey  (316,  (316, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02099   896   NtQueryValueKey  (320,  (320, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02100   896   NtQueryValueKey  (316,  (316, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02101   896   NtQueryValueKey  (320,  (320, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02102   896   NtQueryValueKey  (316,  (316, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02103   896   NtQueryValueKey  (320,  (320, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02104   896   NtQueryValueKey  (316,  (316, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02105   896   NtQueryValueKey  (320,  (320, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02106   896   NtQueryValueKey  (320,  (320, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02107   896   NtQueryValueKey  (320,  (320, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02108   896   NtQueryValueKey  (320,  (320, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02109   896   NtQueryValueKey  (320,  (320, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02110   896   NtQueryValueKey  (320,  (320, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02111   896   NtQueryValueKey  (320,  (320, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02112   896   NtQueryValueKey  (320,  (320, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02113   896   NtQueryValueKey  (320,  (320, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02114   896   NtQueryValueKey  (320,  (320, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02115   896   NtQueryValueKey  (320,  (320, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02116   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 312, ) }, ... 312, ) == 0x0
 02117   896   NtQueryValueKey  (312,  (312, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02118   896   NtClose  (312, ... ) == 0x0
 02119   896   NtClose  (316, ... ) == 0x0
 02120   896   NtClose  (320, ... ) == 0x0
 02121   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 320, ) }, ... 320, ) == 0x0
 02122   896   NtQueryValueKey  (320,  (320, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02123   896   NtQueryValueKey  (320,  (320, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02124   896   NtQueryValueKey  (320,  (320, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02125   896   NtClose  (320, ... ) == 0x0
 02126   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts"}, 3, 33, ... 320, {status=0x0, info=1}, ) }, 3, 33, ... 320, {status=0x0, info=1}, ) == 0x0
 02127   896   NtQueryVolumeInformationFile  (320, 1244940, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02128   896   NtClose  (260, ... ) == 0x0
 02129   896   NtSetEvent  (132, ...
 01553  1180   NtWaitForSingleObject  ... ) == 0x0
 02130  1180   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02131  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 02129   896   NtSetEvent  ... 0x0, ) == 0x0
 02132   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02133   896   NtSetEvent  (132, ...
 02131  1180   NtWaitForSingleObject  ... ) == 0x0
 02134  1180   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02135  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 02133   896   NtSetEvent  ... 0x0, ) == 0x0
 02136   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02137   896   NtAllocateVirtualMemory  (-1, 0, 0, 200000, 4096, 4, ... 40894464, 200704, ) == 0x0
 02138   896   NtAllocateVirtualMemory  (-1, 0, 0, 1024, 4096, 4, ... 40763392, 4096, ) == 0x0
 02139   896   NtQueryInformationProcess  (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 02140   896   NtSetEvent  (168, ...
 01446  1600   NtWaitForSingleObject  ... ) == 0x0
 02141  1600   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02142  1600   NtWaitForSingleObject  (168, 0, 0x0, ...
 02140   896   NtSetEvent  ... 0x0, ) == 0x0
 02143   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02144   896   NtSetEvent  (132, ...
 02135  1180   NtWaitForSingleObject  ... ) == 0x0
 02145  1180   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02146  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 02144   896   NtSetEvent  ... 0x0, ) == 0x0
 02147   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02148   896   NtSetEvent  (164, ...
 01601  1372   NtWaitForSingleObject  ... ) == 0x0
 02149  1372   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02150  1372   NtWaitForSingleObject  (164, 0, 0x0, ...
 02148   896   NtSetEvent  ... 0x0, ) == 0x0
 02151   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02152   896   NtSetEvent  (192, ...
 01557  1024   NtWaitForSingleObject  ... ) == 0x0
 02153  1024   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02154  1024   NtWaitForSingleObject  (192, 0, 0x0, ...
 02152   896   NtSetEvent  ... 0x0, ) == 0x0
 02155   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02156   896   NtSetEvent  (140, ...
 01541   428   NtWaitForSingleObject  ... ) == 0x0
 02157   428   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02158   428   NtWaitForSingleObject  (140, 0, 0x0, ...
 02156   896   NtSetEvent  ... 0x0, ) == 0x0
 02159   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02160   896   NtSetEvent  (168, ...
 02142  1600   NtWaitForSingleObject  ... ) == 0x0
 02161  1600   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02162  1600   NtWaitForSingleObject  (168, 0, 0x0, ...
 02160   896   NtSetEvent  ... 0x0, ) == 0x0
 02163   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02164   896   NtSetEvent  (140, ...
 02158   428   NtWaitForSingleObject  ... ) == 0x0
 02165   428   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02166   428   NtWaitForSingleObject  (140, 0, 0x0, ...
 02164   896   NtSetEvent  ... 0x0, ) == 0x0
 02167   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02168   896   NtSetEvent  (192, ...
 02154  1024   NtWaitForSingleObject  ... ) == 0x0
 02169  1024   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02170  1024   NtWaitForSingleObject  (192, 0, 0x0, ...
 02168   896   NtSetEvent  ... 0x0, ) == 0x0
 02171   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02172   896   NtSetEvent  (176, ...
 01649   252   NtWaitForSingleObject  ... ) == 0x0
 02173   252   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02174   252   NtWaitForSingleObject  (176, 0, 0x0, ...
 02172   896   NtSetEvent  ... 0x0, ) == 0x0
 02175   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02176   896   NtSetEvent  (152, ...
 01398   900   NtWaitForSingleObject  ... ) == 0x0
 02177   900   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02178   900   NtWaitForSingleObject  (152, 0, 0x0, ...
 02176   896   NtSetEvent  ... 0x0, ) == 0x0
 02179   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02180   896   NtSetEvent  (132, ...
 02146  1180   NtWaitForSingleObject  ... ) == 0x0
 02181  1180   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02182  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 02180   896   NtSetEvent  ... 0x0, ) == 0x0
 02183   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02184   896   NtSetEvent  (144, ...
 01645  1732   NtWaitForSingleObject  ... ) == 0x0
 02185  1732   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02186  1732   NtWaitForSingleObject  (144, 0, 0x0, ...
 02184   896   NtSetEvent  ... 0x0, ) == 0x0
 02187   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02188   896   NtSetEvent  (168, ...
 02162  1600   NtWaitForSingleObject  ... ) == 0x0
 02189  1600   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02190  1600   NtWaitForSingleObject  (168, 0, 0x0, ...
 02188   896   NtSetEvent  ... 0x0, ) == 0x0
 02191   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02192   896   NtProtectVirtualMemory  (-1, (0x401000), 93076, 64, ... (0x401000), 94208, 128, ) == 0x0
 02193   896   NtSetEvent  (160, ...
 01545  2036   NtWaitForSingleObject  ... ) == 0x0
 02194  2036   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02195  2036   NtWaitForSingleObject  (160, 0, 0x0, ...
 02193   896   NtSetEvent  ... 0x0, ) == 0x0
 02196   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02197   896   NtUserFindWindowEx  (0, 0,  (0, 0, "FilemonClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 02198   896   NtUserFindWindowEx  (0, 0, 0x0,  (0, 0, 0x0, "File Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0
 02199   896   NtUserFindWindowEx  (0, 0,  (0, 0, "PROCMON_WINDOW_CLASS", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 02200   896   NtUserFindWindowEx  (0, 0, 0x0,  (0, 0, 0x0, "Process Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0
 02201   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 41156608, 65536, ) == 0x0
 02202   896   NtQuerySystemInformation  (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0
 02203   896   NtFreeVirtualMemory  (-1, (0x2740000), 0, 32768, ... (0x2740000), 65536, ) == 0x0
 02204   896   NtSetEvent  (144, ...
 02186  1732   NtWaitForSingleObject  ... ) == 0x0
 02205  1732   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02206  1732   NtWaitForSingleObject  (144, 0, 0x0, ...
 02204   896   NtSetEvent  ... 0x0, ) == 0x0
 02207   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02208   896   NtAllocateVirtualMemory  (-1, 0, 0, 1114112, 4096, 4, ... 41156608, 1114112, ) == 0x0
 02209   896   NtFreeVirtualMemory  (-1, (0x2740000), 0, 32768, ... (0x2740000), 1114112, ) == 0x0
 02210   896   NtSetEvent  (136, ...
 01343   928   NtWaitForSingleObject  ... ) == 0x0
 02211   928   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02212   928   NtWaitForSingleObject  (136, 0, 0x0, ...
 02210   896   NtSetEvent  ... 0x0, ) == 0x0
 02213   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02214   896   NtSetEvent  (184, ...
 01525  1096   NtWaitForSingleObject  ... ) == 0x0
 02215  1096   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02216  1096   NtWaitForSingleObject  (184, 0, 0x0, ...
 02214   896   NtSetEvent  ... 0x0, ) == 0x0
 02217   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02218   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 41156608, 1048576, ) == 0x0
 02219   896   NtAllocateVirtualMemory  (-1, 42196992, 0, 8192, 4096, 4, ... 42196992, 8192, ) == 0x0
 02220   896   NtProtectVirtualMemory  (-1, (0x283e000), 4096, 260, ... (0x283e000), 4096, 4, ) == 0x0
 02221   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1244044, 1243988, 1, ... 260, {1252, 860}, ) == 0x0
 02222   896   NtQueryInformationThread  (260, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa1000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 02223   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089917163, 5981457, 5981457, 65535}  (24, {28, 56, new_msg, 0, 2089917163, 5981457, 5981457, 65535} "\0\0\0\0\1\0\1\0\23\230\0\049\220|\4\1\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\049\220|\4\1\0\0\344\4\0\0\\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81865, 0}  (24, {28, 56, new_msg, 0, 2089917163, 5981457, 5981457, 65535} "\0\0\0\0\1\0\1\0\23\230\0\049\220|\4\1\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\049\220|\4\1\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 02224   896   NtResumeThread  (260, ... 1, ) == 0x0
 02225   896   NtProtectVirtualMemory  (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0
 02226   860   NtTestAlert  (... ) == 0x0
 02227   860   NtContinue  (42204464, 1, ...
 02228   860   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02229   860   NtDelayExecution  (0, {-40000000, -1}, ...
 02230   896   NtProtectVirtualMemory  (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0
 02231   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 4, ... 42205184, 4096, ) == 0x0
 02232   896   NtAllocateVirtualMemory  (-1, 0, 0, 8192, 4096, 4, ... 42270720, 8192, ) == 0x0
 02233   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 64, ... 42336256, 65536, ) == 0x0
 02234   896   NtAllocateVirtualMemory  (-1, 0, 0, 3320, 4096, 4, ... 42401792, 4096, ) == 0x0
 02235   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02236   896   NtAllocateVirtualMemory  (-1, 0, 0, 9152, 4096, 4, ... 42401792, 12288, ) == 0x0
 02237   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 12288, ) == 0x0
 02238   896   NtAllocateVirtualMemory  (-1, 0, 0, 620, 4096, 4, ... 42401792, 4096, ) == 0x0
 02239   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02240   896   NtAllocateVirtualMemory  (-1, 0, 0, 3796, 4096, 4, ... 42401792, 4096, ) == 0x0
 02241   896   NtAllocateVirtualMemory  (-1, 0, 0, 228, 4096, 64, ... 42467328, 4096, ) == 0x0
 02242   896   NtAllocateVirtualMemory  (-1, 0, 0, 1820, 4096, 64, ... 42532864, 4096, ) == 0x0
 02243   896   NtAllocateVirtualMemory  (-1, 0, 0, 1798, 4096, 64, ... 42598400, 4096, ) == 0x0
 02244   896   NtAllocateVirtualMemory  (-1, 0, 0, 524, 4096, 64, ... 42663936, 4096, ) == 0x0
 02245   896   NtAllocateVirtualMemory  (-1, 0, 0, 950, 4096, 64, ... 42729472, 4096, ) == 0x0
 02246   896   NtAllocateVirtualMemory  (-1, 0, 0, 1362, 4096, 64, ... 42795008, 4096, ) == 0x0
 02247   896   NtAllocateVirtualMemory  (-1, 0, 0, 526, 4096, 64, ... 42860544, 4096, ) == 0x0
 02248   896   NtAllocateVirtualMemory  (-1, 0, 0, 1835, 4096, 64, ... 42926080, 4096, ) == 0x0
 02249   896   NtAllocateVirtualMemory  (-1, 0, 0, 1589, 4096, 64, ... 42991616, 4096, ) == 0x0
 02250   896   NtAllocateVirtualMemory  (-1, 0, 0, 1043, 4096, 64, ... 43057152, 4096, ) == 0x0
 02251   896   NtAllocateVirtualMemory  (-1, 0, 0, 3566, 4096, 64, ... 43122688, 4096, ) == 0x0
 02252   896   NtAllocateVirtualMemory  (-1, 0, 0, 2007, 4096, 64, ... 43188224, 4096, ) == 0x0
 02253   896   NtAllocateVirtualMemory  (-1, 0, 0, 3108, 4096, 64, ... 43253760, 4096, ) == 0x0
 02254   896   NtAllocateVirtualMemory  (-1, 0, 0, 2167, 4096, 64, ... 43319296, 4096, ) == 0x0
 02255   896   NtAllocateVirtualMemory  (-1, 0, 0, 1792, 4096, 64, ... 43384832, 4096, ) == 0x0
 02256   896   NtAllocateVirtualMemory  (-1, 0, 0, 768, 4096, 64, ... 43450368, 4096, ) == 0x0
 02257   896   NtAllocateVirtualMemory  (-1, 0, 0, 4316, 4096, 64, ... 43515904, 8192, ) == 0x0
 02258   896   NtAllocateVirtualMemory  (-1, 0, 0, 2626, 4096, 64, ... 43581440, 4096, ) == 0x0
 02259   896   NtAllocateVirtualMemory  (-1, 0, 0, 5438, 4096, 64, ... 43646976, 8192, ) == 0x0
 02260   896   NtAllocateVirtualMemory  (-1, 0, 0, 1857, 4096, 64, ... 43712512, 4096, ) == 0x0
 02261   896   NtAllocateVirtualMemory  (-1, 0, 0, 3200, 4096, 64, ... 43778048, 4096, ) == 0x0
 02262   896   NtAllocateVirtualMemory  (-1, 0, 0, 912, 4096, 64, ... 43843584, 4096, ) == 0x0
 02263   896   NtAllocateVirtualMemory  (-1, 0, 0, 3594, 4096, 64, ... 43909120, 4096, ) == 0x0
 02264   896   NtAllocateVirtualMemory  (-1, 0, 0, 4470, 4096, 64, ... 43974656, 8192, ) == 0x0
 02265   896   NtAllocateVirtualMemory  (-1, 0, 0, 1912, 4096, 64, ... 44040192, 4096, ) == 0x0
 02266   896   NtAllocateVirtualMemory  (-1, 0, 0, 946, 4096, 64, ... 44105728, 4096, ) == 0x0
 02267   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02268   896   NtAllocateVirtualMemory  (-1, 0, 0, 2928, 4096, 4, ... 42401792, 4096, ) == 0x0
 02269   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02270   896   NtAllocateVirtualMemory  (-1, 0, 0, 2700, 4096, 4, ... 42401792, 4096, ) == 0x0
 02271   896   NtAllocateVirtualMemory  (-1, 0, 0, 4961, 4096, 64, ... 44171264, 8192, ) == 0x0
 02272   896   NtAllocateVirtualMemory  (-1, 0, 0, 5069, 4096, 64, ... 44236800, 8192, ) == 0x0
 02273   896   NtAllocateVirtualMemory  (-1, 0, 0, 2644, 4096, 64, ... 44302336, 4096, ) == 0x0
 02274   896   NtAllocateVirtualMemory  (-1, 0, 0, 3348, 4096, 64, ... 44367872, 4096, ) == 0x0
 02275   896   NtAllocateVirtualMemory  (-1, 0, 0, 1053, 4096, 64, ... 44433408, 4096, ) == 0x0
 02276   896   NtAllocateVirtualMemory  (-1, 0, 0, 1204, 4096, 64, ... 44498944, 4096, ) == 0x0
 02277   896   NtAllocateVirtualMemory  (-1, 0, 0, 923, 4096, 64, ... 44564480, 4096, ) == 0x0
 02278   896   NtAllocateVirtualMemory  (-1, 0, 0, 3562, 4096, 64, ... 44630016, 4096, ) == 0x0
 02279   896   NtAllocateVirtualMemory  (-1, 0, 0, 678, 4096, 64, ... 44695552, 4096, ) == 0x0
 02280   896   NtAllocateVirtualMemory  (-1, 0, 0, 3524, 4096, 64, ... 44761088, 4096, ) == 0x0
 02281   896   NtAllocateVirtualMemory  (-1, 0, 0, 4392, 4096, 64, ... 44826624, 8192, ) == 0x0
 02282   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02283   896   NtAllocateVirtualMemory  (-1, 0, 0, 1236, 4096, 4, ... 42401792, 4096, ) == 0x0
 02284   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02285   896   NtAllocateVirtualMemory  (-1, 0, 0, 468, 4096, 4, ... 42401792, 4096, ) == 0x0
 02286   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02287   896   NtAllocateVirtualMemory  (-1, 0, 0, 312, 4096, 4, ... 42401792, 4096, ) == 0x0
 02288   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02289   896   NtAllocateVirtualMemory  (-1, 0, 0, 96, 4096, 4, ... 42401792, 4096, ) == 0x0
 02290   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02291   896   NtAllocateVirtualMemory  (-1, 0, 0, 640, 4096, 4, ... 42401792, 4096, ) == 0x0
 02292   896   NtFreeVirtualMemory  (-1, (0x2870000), 0, 32768, ... (0x2870000), 4096, ) == 0x0
 02293   896   NtFreeVirtualMemory  (-1, (0x2700000), 0, 32768, ... (0x2700000), 200704, ) == 0x0
 02294   896   NtFreeVirtualMemory  (-1, (0x26e0000), 0, 32768, ... (0x26e0000), 4096, ) == 0x0
 02295   896   NtFreeVirtualMemory  (-1, (0x2850000), 0, 32768, ... (0x2850000), 8192, ) == 0x0
 02296   896   NtFreeVirtualMemory  (-1, (0x2860000), 0, 32768, ... (0x2860000), 65536, ) == 0x0
 02297   896   NtFreeVirtualMemory  (-1, (0x2840000), 0, 32768, ... (0x2840000), 4096, ) == 0x0
 02298   896   NtSetEvent  (188, ...
 01505  1708   NtWaitForSingleObject  ... ) == 0x0
 02299  1708   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02300  1708   NtWaitForSingleObject  (188, 0, 0x0, ...
 02298   896   NtSetEvent  ... 0x0, ) == 0x0
 02301   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02302   896   NtSetEvent  (140, ...
 02166   428   NtWaitForSingleObject  ... ) == 0x0
 02303   428   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02304   428   NtWaitForSingleObject  (140, 0, 0x0, ...
 02302   896   NtSetEvent  ... 0x0, ) == 0x0
 02305   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02306   896   NtProtectVirtualMemory  (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0
 02307   896   NtProtectVirtualMemory  (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0
 02308   896   NtSetEvent  (152, ...
 02178   900   NtWaitForSingleObject  ... ) == 0x0
 02309   900   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02310   900   NtWaitForSingleObject  (152, 0, 0x0, ...
 02308   896   NtSetEvent  ... 0x0, ) == 0x0
 02311   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02312   896   NtSetEvent  (184, ...
 02216  1096   NtWaitForSingleObject  ... ) == 0x0
 02313  1096   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02314  1096   NtWaitForSingleObject  (184, 0, 0x0, ...
 02312   896   NtSetEvent  ... 0x0, ) == 0x0
 02315   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02316   896   NtProtectVirtualMemory  (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0
 02317   896   NtProtectVirtualMemory  (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0
 02318   896   NtSetEvent  (168, ...
 02190  1600   NtWaitForSingleObject  ... ) == 0x0
 02319  1600   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02320  1600   NtWaitForSingleObject  (168, 0, 0x0, ...
 02318   896   NtSetEvent  ... 0x0, ) == 0x0
 02321   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02322   896   NtSetEvent  (136, ...
 02212   928   NtWaitForSingleObject  ... ) == 0x0
 02323   928   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02324   928   NtWaitForSingleObject  (136, 0, 0x0, ...
 02322   896   NtSetEvent  ... 0x0, ) == 0x0
 02325   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02326   896   NtSetEvent  (132, ...
 02182  1180   NtWaitForSingleObject  ... ) == 0x0
 02327  1180   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02328  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 02326   896   NtSetEvent  ... 0x0, ) == 0x0
 02329   896   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 02330   896   NtQueryVirtualMemory  (-1, 0x436c1e, Basic, 28, ... {BaseAddress=0x436000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0xdb000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02331   896   NtQueryVirtualMemory  (-1, 0x43e1d8, Basic, 28, ... {BaseAddress=0x43e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0xd3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02332   896   NtQueryInformationProcess  (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 02333   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 02334   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02335   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02336   896   NtQueryInformationJobObject  (0, BasicLimit, 48, ... ) == STATUS_ACCESS_DENIED
 02337   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug"}, ... 316, ) }, ... 316, ) == 0x0
 02338   896   NtQueryValueKey  (316,  (316, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) , Partial, 526, ... TitleIdx=0, Type=1, Data= (316, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02339   896   NtQueryValueKey  (316,  (316, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) , Partial, 526, ... TitleIdx=0, Type=1, Data=" (316, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) \0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) == 0x0
 02340   896   NtClose  (316, ... ) == 0x0
 02341   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1239748, ... ) }, 1239748, ... ) == 0x0
 02342   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 316, {status=0x0, info=1}, ) }, 5, 96, ... 316, {status=0x0, info=1}, ) == 0x0
 02343   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 316, ... 312, ) == 0x0
 02344   896   NtClose  (316, ... ) == 0x0
 02345   896   NtMapViewOfSection  (312, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2700000), 0x0, 81920, ) == 0x0
 02346   896   NtClose  (312, ... ) == 0x0
 02347   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02348   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1240056, ... ) }, 1240056, ... ) == 0x0
 02349   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 312, {status=0x0, info=1}, ) }, 5, 96, ... 312, {status=0x0, info=1}, ) == 0x0
 02350   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 312, ... 316, ) == 0x0
 02351   896   NtQuerySection  (316, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02352   896   NtClose  (312, ... ) == 0x0
 02353   896   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x69450000), 0x0, 90112, ) == 0x0
 02354   896   NtClose  (316, ... ) == 0x0
 02355   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "VERSION.dll"}, ... 316, ) }, ... 316, ) == 0x0
 02356   896   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 32768, ) == 0x0
 02357   896   NtClose  (316, ... ) == 0x0
 02358   896   NtProtectVirtualMemory  (-1, (0x77c01000), 304, 4, ... (0x77c01000), 4096, 32, ) == 0x0
 02359   896   NtProtectVirtualMemory  (-1, (0x77c01000), 4096, 32, ... (0x77c01000), 4096, 4, ) == 0x0
 02360   896   NtFlushInstructionCache  (-1, 2009075712, 304, ... ) == 0x0
 02361   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 316, ) }, ... 316, ) == 0x0
 02362   896   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x769c0000), 0x0, 733184, ) == 0x0
 02363   896   NtClose  (316, ... ) == 0x0
 02364   896   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 02365   896   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 02366   896   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 02367   896   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 02368   896   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 02369   896   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 02370   896   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 02371   896   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 02372   896   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 02373   896   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 02374   896   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 02375   896   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 02376   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02377   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINSTA.dll"}, 1239232, ... ) }, 1239232, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02378   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 1239232, ... ) }, 1239232, ... ) == 0x0
 02379   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 5, 96, ... 316, {status=0x0, info=1}, ) }, 5, 96, ... 316, {status=0x0, info=1}, ) == 0x0
 02380   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 316, ... 312, ) == 0x0
 02381   896   NtQuerySection  (312, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02382   896   NtClose  (316, ... ) == 0x0
 02383   896   NtMapViewOfSection  (312, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76360000), 0x0, 65536, ) == 0x0
 02384   896   NtClose  (312, ... ) == 0x0
 02385   896   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 02386   896   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 02387   896   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 02388   896   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 02389   896   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 02390   896   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 02391   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... 312, ) }, ... 312, ) == 0x0
 02392   896   NtMapViewOfSection  (312, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0
 02393   896   NtClose  (312, ... ) == 0x0
 02394   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02395   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02396   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02397   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02398   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02399   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02400   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02401   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02402   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02403   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02404   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02405   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02406   896   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02407   896   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02408   896   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02409   896   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 02410   896   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 02411   896   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 02412   896   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 02413   896   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 02414   896   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 02415   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02416   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WTSAPI32.dll"}, 1239232, ... ) }, 1239232, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02417   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 1239232, ... ) }, 1239232, ... ) == 0x0
 02418   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 5, 96, ... 312, {status=0x0, info=1}, ) }, 5, 96, ... 312, {status=0x0, info=1}, ) == 0x0
 02419   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 312, ... 316, ) == 0x0
 02420   896   NtQuerySection  (316, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02421   896   NtClose  (312, ... ) == 0x0
 02422   896   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f50000), 0x0, 32768, ) == 0x0
 02423   896   NtClose  (316, ... ) == 0x0
 02424   896   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 02425   896   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 02426   896   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 02427   896   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 02428   896   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 02429   896   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 02430   896   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 02431   896   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 02432   896   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 02433   896   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 02434   896   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 02435   896   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 02436   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02437   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1239232, ... ) }, 1239232, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02438   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 1239232, ... ) }, 1239232, ... ) == 0x0
 02439   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 316, {status=0x0, info=1}, ) }, 5, 96, ... 316, {status=0x0, info=1}, ) == 0x0
 02440   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 316, ... 312, ) == 0x0
 02441   896   NtQuerySection  (312, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02442   896   NtClose  (316, ... ) == 0x0
 02443   896   NtMapViewOfSection  (312, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0
 02444   896   NtClose  (312, ... ) == 0x0
 02445   896   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02446   896   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02447   896   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02448   896   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02449   896   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02450   896   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02451   896   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02452   896   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02453   896   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02454   896   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02455   896   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02456   896   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02457   896   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02458   896   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02459   896   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02460   896   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 02461   896   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 02462   896   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 02463   896   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 02464   896   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 02465   896   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 02466   896   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 02467   896   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 02468   896   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 02469   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02470   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02471   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 312, ) }, ... 312, ) == 0x0
 02472   896   NtQueryValueKey  (312,  (312, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02473   896   NtClose  (312, ... ) == 0x0
 02474   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 312, ) }, ... 312, ) == 0x0
 02475   896   NtQueryValueKey  (312,  (312, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02476   896   NtClose  (312, ... ) == 0x0
 02477   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 312, ) }, ... 312, ) == 0x0
 02478   896   NtQueryValueKey  (312,  (312, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 02479   896   NtClose  (312, ... ) == 0x0
 02480   896   NtCreateEvent  (0x1f0003, {24, 72, 0x80, 1237824, 0,  (0x1f0003, {24, 72, 0x80, 1237824, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 312, ) }, 0, 1, ... 312, ) == STATUS_OBJECT_NAME_EXISTS
 02481   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02482   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02483   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02484   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02485   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02486   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02487   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02488   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02489   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02490   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02491   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02492   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02493   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02494   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02495   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02496   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02497   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02498   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02499   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02500   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02501   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02502   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02503   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02504   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02505   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02506   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02507   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02508   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 316, ) == 0x0
 02509   896   NtQueryInformationToken  (316, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02510   896   NtClose  (316, ... ) == 0x0
 02511   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 316, ) }, ... 316, ) == 0x0
 02512   896   NtOpenKey  (0x20019, {24, 316, 0x40, 0, 0,  (0x20019, {24, 316, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 324, ) }, ... 324, ) == 0x0
 02513   896   NtQueryValueKey  (324,  (324, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (324, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 02514   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02515   896   NtQueryValueKey  (324,  (324, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (324, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 02516   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02517   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02518   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02519   896   NtQueryDefaultLocale  (1, 1237576, ... ) == 0x0
 02520   896   NtClose  (324, ... ) == 0x0
 02521   896   NtClose  (316, ... ) == 0x0
 02522   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 316, ) }, ... 316, ) == 0x0
 02523   896   NtQueryValueKey  (316,  (316, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02524   896   NtClose  (316, ... ) == 0x0
 02525   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 316, ) }, ... 316, ) == 0x0
 02526   896   NtQueryValueKey  (316,  (316, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02527   896   NtQueryValueKey  (316,  (316, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02528   896   NtClose  (316, ... ) == 0x0
 02529   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02530   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 316, ) }, ... 316, ) == 0x0
 02531   896   NtQueryValueKey  (316,  (316, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02532   896   NtClose  (316, ... ) == 0x0
 02533   896   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02534   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02535   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02536   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02537   896   NtQueryPerformanceCounter  (... {-1447117244, 16}, {3579545, 0}, ) == 0x0
 02538   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02539   896   NtQueryDefaultLocale  (1, 1239952, ... ) == 0x0
 02540   896   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02541   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 316, ) }, ... 316, ) == 0x0
 02542   896   NtQueryValueKey  (316,  (316, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02543   896   NtClose  (316, ... ) == 0x0
 02544   896   NtUserGetProcessWindowStation  (... ) == 0x1c
 02545   896   NtUserGetObjectInformation  (28, 1, 1239548, 12, 1239560, ... ) == 0x1
 02546   896   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02547   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\WPA\PnP"}, ... 316, ) }, ... 316, ) == 0x0
 02548   896   NtQueryValueKey  (316,  (316, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 02549   896   NtClose  (316, ... ) == 0x0
 02550   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 316, ) }, ... 316, ) == 0x0
 02551   896   NtQueryValueKey  (316,  (316, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02552   896   NtQueryValueKey  (316,  (316, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02553   896   NtClose  (316, ... ) == 0x0
 02554   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 316, ) }, ... 316, ) == 0x0
 02555   896   NtQueryValueKey  (316,  (316, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02556   896   NtQueryValueKey  (316,  (316, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02557   896   NtClose  (316, ... ) == 0x0
 02558   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 316, ) }, ... 316, ) == 0x0
 02559   896   NtQueryValueKey  (316,  (316, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02560   896   NtQueryValueKey  (316,  (316, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02561   896   NtClose  (316, ... ) == 0x0
 02562   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 316, ) }, ... 316, ) == 0x0
 02563   896   NtQueryValueKey  (316,  (316, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02564   896   NtQueryValueKey  (316,  (316, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02565   896   NtClose  (316, ... ) == 0x0
 02566   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 316, ) }, ... 316, ) == 0x0
 02567   896   NtQueryValueKey  (316,  (316, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02568   896   NtQueryValueKey  (316,  (316, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (316, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02569   896   NtClose  (316, ... ) == 0x0
 02570   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 316, ) }, ... 316, ) == 0x0
 02571   896   NtQueryValueKey  (316,  (316, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02572   896   NtQueryValueKey  (316,  (316, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02573   896   NtClose  (316, ... ) == 0x0
 02574   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 316, ) }, ... 316, ) == 0x0
 02575   896   NtQueryValueKey  (316,  (316, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02576   896   NtQueryValueKey  (316,  (316, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (316, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 02577   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 02578   896   NtClose  (316, ... ) == 0x0
 02579   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 316, ) == 0x0
 02580   896   NtCreateMutant  (0x1f0001, 0x0, 0, ... 324, ) == 0x0
 02581   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 328, ) == 0x0
 02582   896   NtCreateMutant  (0x1f0001, 0x0, 0, ... 332, ) == 0x0
 02583   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 336, ) == 0x0
 02584   896   NtCreateMutant  (0x1f0001, 0x0, 0, ... 340, ) == 0x0
 02585   896   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 344, ) }, ... 344, ) == 0x0
 02586   896   NtQueryValueKey  (344,  (344, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02587   896   NtQueryValueKey  (344,  (344, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02588   896   NtQueryValueKey  (344,  (344, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02589   896   NtOpenKey  (0x1, {24, 344, 0x40, 0, 0,  (0x1, {24, 344, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02590   896   NtClose  (344, ... ) == 0x0
 02591   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1239464, ... ) }, 1239464, ... ) == 0x0
 02592   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 344, ) }, ... 344, ) == 0x0
 02593   896   NtQueryValueKey  (344,  (344, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (344, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (344, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02594   896   NtClose  (344, ... ) == 0x0
 02595   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 344, ) }, ... 344, ) == 0x0
 02596   896   NtQueryValueKey  (344,  (344, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (344, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (344, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 02597   896   NtClose  (344, ... ) == 0x0
 02598   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02599   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 344, ) }, ... 344, ) == 0x0
 02600   896   NtQueryValueKey  (344,  (344, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (344, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (344, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 02601   896   NtClose  (344, ... ) == 0x0
 02602   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\faultrep.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02603   896   NtOpenKey  (0x20119, {24, 16, 0x40, 0, 0,  (0x20119, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\PCHealth\ErrorReporting"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02604   896   NtCreateKey  (0x20119, {24, 16, 0x40, 0, 0,  (0x20119, {24, 16, 0x40, 0, 0, "Software\Microsoft\PCHealth\ErrorReporting"}, 0, 0x0, 0, ... 344, 2, ) }, 0, 0x0, 0, ... 344, 2, ) == 0x0
 02605   896   NtOpenKey  (0x10000, {24, 344, 0x40, 0, 0,  (0x10000, {24, 344, 0x40, 0, 0, "DW"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02606   896   NtQueryValueKey  (344,  (344, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02607   896   NtQueryValueKey  (344,  (344, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02608   896   NtQueryValueKey  (344,  (344, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02609   896   NtQueryValueKey  (344,  (344, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02610   896   NtQueryValueKey  (344,  (344, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02611   896   NtQueryValueKey  (344,  (344, "DoTextLog", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02612   896   NtQueryValueKey  (344,  (344, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02613   896   NtQueryValueKey  (344,  (344, "IncludeShutdownErrs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02614   896   NtQueryValueKey  (344,  (344, "NumberOfFaultPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02615   896   NtQueryValueKey  (344,  (344, "NumberOfHangPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02616   896   NtQueryValueKey  (344,  (344, "MaxUserQueueSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02617   896   NtQueryValueKey  (344,  (344, "ForceQueueMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02618   896   NtCreateKey  (0x20119, {24, 344, 0x40, 0, 0,  (0x20119, {24, 344, 0x40, 0, 0, "ExclusionList"}, 0, 0x0, 0, ... 348, 2, ) }, 0, 0x0, 0, ... 348, 2, ) == 0x0
 02619   896   NtCreateKey  (0x20119, {24, 344, 0x40, 0, 0,  (0x20119, {24, 344, 0x40, 0, 0, "InclusionList"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 02620   896   NtClose  (344, ... ) == 0x0
 02621   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 344, ) }, ... 344, ) == 0x0
 02622   896   NtQueryValueKey  (344,  (344, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (344, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02623   896   NtClose  (344, ... ) == 0x0
 02624   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02625   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02626   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1236992, ... ) }, 1236992, ... ) == 0x0
 02627   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\"}, 3, 16417, ... 344, {status=0x0, info=1}, ) }, 3, 16417, ... 344, {status=0x0, info=1}, ) == 0x0
 02628   896   NtQueryDirectoryFile  (344, 0, 0, 0, 1236420, 616, BothDirectory, 1,  (344, 0, 0, 0, 1236420, 616, BothDirectory, 1, "work", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02629   896   NtClose  (344, ... ) == 0x0
 02630   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 344, {status=0x0, info=1}, ) }, 3, 16417, ... 344, {status=0x0, info=1}, ) == 0x0
 02631   896   NtQueryDirectoryFile  (344, 0, 0, 0, 1236420, 616, BothDirectory, 1,  (344, 0, 0, 0, 1236420, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 02632   896   NtClose  (344, ... ) == 0x0
 02633   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02634   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02635   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02636   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02637   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1235640, ... ) }, 1235640, ... ) == 0x0
 02638   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1234412, ... ) }, 1234412, ... ) == 0x0
 02639   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02640   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02641   896   NtQueryValueKey  (348,  (348, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02642   896   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02643   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02644   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02645   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02646   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 344, ) }, ... 344, ) == 0x0
 02647   896   NtQueryValueKey  (344,  (344, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02648   896   NtClose  (344, ... ) == 0x0
 02649   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02650   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 344, ) == 0x0
 02651   896   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 02652   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 356, ) == 0x0
 02653   896   NtQuerySystemTime  (... {1424766664, 29929616}, ) == 0x0
 02654   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 360, ) == 0x0
 02655   896   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02656   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 02657   896   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 02658   896   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 02659   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 364, ) == 0x0
 02660   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 368, ) == 0x0
 02661   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "\321\17\307e\226Z\343\27\203u\202\326E\271\360\356\250\315\4\345(\13I\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02662   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02663   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02664   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02665   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02666   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02667   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02668   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02669   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481368, 2, ) }, 0, 0x0, 0, ... -2147481368, 2, ) == 0x0
 02670   896   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "K6*\256nP\223\221qV\2lj\363\10\232\356\205KY\223]\300Se\202\30r\321L0\3458\234\321\1\17\37~\20\231\14j\265\262$\5M\6\226}\277\223\252o[\273\263\365\212b=`[\317\340\23\216\177\220A\2458\22\222@_R\224\213", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "K6*\256nP\223\221qV\2lj\363\10\232\356\205KY\223]\300Se\202\30r\321L0\3458\234\321\1\17\37~\20\231\14j\265\262$\5M\6\226}\277\223\252o[\273\263\365\212b=`[\317\340\23\216\177\220A\2458\22\222@_R\224\213", 80, ... ) , 80, ... ) == 0x0
 02671   896   NtClose  (-2147481368, ... ) == 0x0
 02661   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\372\353\203\323\341E79B/\306\24\354\230\310A\200 Kz\10\336\320u`Z\302\342\241\244k\347\312\254\356\304\33\275\11D\272}F\353\251\373\262\236v\332\250\255\320Q\266l\221\370\37\242Y\345\245\273K+p\340\374\214jT\245\222Y\336v\17\370#\222\262\233\324\2p\204Q\235\263\177X\243\251\15\27\255\331;&\251:\225\365\364\362.\365\257\3\330\361\263\323\3\102\262\327j\363\203\1\204| E\4\227RH;\313\327\6\361:\263\377\7\0\355N\306\353`\366|\225\255\327OBC\205\21\24\353N\236\333\231NTL\177t\374\262\224t=\304\276\234\212\375-\300\334\337t\201C*\230\3258!\341\37\230\204\276\306\331\345\3GLt#\315-+\34\31e\35MG\206\375\34\303\214\206\1z\342\307\253\375Z\337\256\17\30\264\344\36sU\2\331\31\267\244\300V\210\322=\234\271\352\2750(\26\257\300-\256\35\227", ) , ) == 0x0
 02672   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "\321\17\307e\226Z\343\27\203u\202\326E\271\35\207\20\351\251\351_\261\223\250\315\4\345(\13I\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02673   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02674   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02675   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02676   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02677   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02678   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02679   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02680   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481368, 2, ) }, 0, 0x0, 0, ... -2147481368, 2, ) == 0x0
 02681   896   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "\30S\21\235\0^\24}\31738-\220\350\357zi\303m\255g\206\302\230\6\357\230\216\22\10:a\321\336\343\217=\230\350\250\345o\24\377bx\34\245uZ\334\372\227\375\333mT\320\256\367\332x\230S\311u\264\12\24\177\220\364`\10i\315\201\255\324", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "\30S\21\235\0^\24}\31738-\220\350\357zi\303m\255g\206\302\230\6\357\230\216\22\10:a\321\336\343\217=\230\350\250\345o\24\377bx\34\245uZ\334\372\227\375\333mT\320\256\367\332x\230S\311u\264\12\24\177\220\364`\10i\315\201\255\324", 80, ... ) , 80, ... ) == 0x0
 02682   896   NtClose  (-2147481368, ... ) == 0x0
 02672   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "Q\231d.Z\264\253C\301S\310@S\371v\224\230\322\204k\317,\2\241Rs3\202R\254n\357X\31\233\10\12\333\13\2546\221\212\222\247\360^[\232\376_R\336\326]30\204=.7\223\254\233o<\377\322\235\357A$\226e\346\343]d\222\277\261L\313\306j!6\33o,\235\3355\3517\227{\7\205\220\3\345?\244\351\22|\10\24\253\275R\22\311?| \23\217\21z\35+\303\316\377?\260\205\237\327v\6\300\340\361\370~k\201\1\2611\\0\240\32\23L\273\353\370\276\35\27*I\276\207\257\1J\16-u\273\360\3xM\355\3\223\2270vB\303\314\201\200\337L\260ey\3\345\317A\377]a\35\210'\245\330F\264S\14\303l\27!\233\332\207\211v\363\311\304\177'%\257`\224\244\23\27~\331v\343f\346&\375fr\27\354\242\215\271\3275`\2\13\367\224\31g\340!\347V\310\250\37\16", ) , ) == 0x0
 02683   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "\321\17\307e\226Z\343\27\203u\202\326E\271\35\207\20\351\251\351_\\372\20\351\251\351_\261\223\250\315\4\345(\13I\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02684   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02685   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02686   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02687   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02688   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02689   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02690   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02691   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481368, 2, ) }, 0, 0x0, 0, ... -2147481368, 2, ) == 0x0
 02692   896   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "Z\204Z\237\1\3251k\343iWk\243\370\|7mer\31\326\301O\211m\275`\370\375y\3469\13)g\26\3408\325\316G\214\251\236\24\232Ky\225q\25\356\234\347\235\315\2348\11\266\226\275\4\22\307\212\312\312\271\355\376m4\263e\224<\320\2", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "Z\204Z\237\1\3251k\343iWk\243\370\|7mer\31\326\301O\211m\275`\370\375y\3469\13)g\26\3408\325\316G\214\251\236\24\232Ky\225q\25\356\234\347\235\315\2348\11\266\226\275\4\22\307\212\312\312\271\355\376m4\263e\224<\320\2", 80, ... ) , 80, ... ) == 0x0
 02693   896   NtClose  (-2147481368, ... ) == 0x0
 02683   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\207|\2174\257*\223\24\317\357\307jd#4\212\227\235\272\347\205e\346$#\337GK\255\207m\17L\\371\303h\270\\265\204p\5\311\225\362\353\365\27Af\21\301\373h\315\303op\2268[\307\377\313\7\2424$"!\340\327\276\351-|\267\233\13_\371\311\271\333\330&st\255\236\230\232\336%\202\215}\325.\276[\362\241\243\2268\357E\36R\305\253\353\307\240\221\15Z/\355Y\277\0~_\267cWI\237\22\25\301\354$QYp\250g\352V\23\367\303O\341L\262\305\346\207\331\37\344"\342pU\3676l\343\266\276\257%\7\321.*\25\355\266\200d\350\342\0\327,\20w\263Y\377\377\177\277r\261", ) !\340\327\276\351-|\267\233\13_\371\311\271\333\330&st\255\236\230\232\336%\202\215}\325.\276[\362\241\243\2268\357E\36R\305\253\353\307\240\221\15Z/\355Y\277\0~_\267cWI\237\22\25\301\354$QYp\250g\352V\23\367\303O\341L\262\305\346\207\331\37\344 ... {status=0x0, info=256}, "\207|\2174\257*\223\24\317\357\307jd#4\212\227\235\272\347\205e\346$#\337GK\255\207m\17L\\371\303h\270\\265\204p\5\311\225\362\353\365\27Af\21\301\373h\315\303op\2268[\307\377\313\7\2424$"!\340\327\276\351-|\267\233\13_\371\311\271\333\330&st\255\236\230\232\336%\202\215}\325.\276[\362\241\243\2268\357E\36R\305\253\353\307\240\221\15Z/\355Y\277\0~_\267cWI\237\22\25\301\354$QYp\250g\352V\23\367\303O\341L\262\305\346\207\331\37\344"\342pU\3676l\343\266\276\257%\7\321.*\25\355\266\200d\350\342\0\327,\20w\263Y\377\377\177\277r\261", ) , ) == 0x0
 02694   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "\321\17\307e\226Z\343\27\203u\202\326E\271\35\207\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\261\223\250\315\4\345(\13I\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02695   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02696   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02697   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02698   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02699   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02700   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02701   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02702   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481368, 2, ) }, 0, 0x0, 0, ... -2147481368, 2, ) == 0x0
 02703   896   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "\344\266a\350\200\353S.A\263!\252w\314\216w\25\271\206\266>\212\11\323\327\27\0\367Wj&5,\223z\317I\36bV]\223\353wq\306\240V\333.\262m\216\314\205TZy\354Qbm\256\231en\25\13dM\312L\263E\351\301\260\352L\322", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "\344\266a\350\200\353S.A\263!\252w\314\216w\25\271\206\266>\212\11\323\327\27\0\367Wj&5,\223z\317I\36bV]\223\353wq\306\240V\333.\262m\216\314\205TZy\354Qbm\256\231en\25\13dM\312L\263E\351\301\260\352L\322", 80, ... ) , 80, ... ) == 0x0
 02704   896   NtClose  (-2147481368, ... ) == 0x0
 02694   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "N\3=\305\36\201[\311\15\377c\24\227\226\332\330\337\223\303\331\317\33\4]0\26\333\367\225\200\362\2220\315\10\377\217\243F\21\2269\307\366\243\332Az\210\301/F\6\337\242\276P\342\311\211\303{]G\376\10y>\7&\314-T\362\15\366\353\262J\15\247\24\26+\2077\248\332\304\353\374\332\204\213\352\255\247\301\16hA\275\25R\202\350%\376\302\203\363\247\267\361\3421&\256\333r\271v\303 \201\324, ) , ) == 0x0
 02705   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "\321\17\307e\226Z\343\27\203u\202\326E\271\35\207\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\261\223\250\315\4\345(\13I\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02706   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02707   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02708   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02709   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02710   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02711   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02712   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02713   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481368, 2, ) }, 0, 0x0, 0, ... -2147481368, 2, ) == 0x0
 02714   896   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "#\365-O\300\336\373\3378\224\11\22>N\264!mV0S\376c\27\16\26\375_\5LB\22\202j\0\322\330\246\17t\237\252\24iP*U\344\236\305\224t\355=\251T/\316\242-k\237\13\244_\217J\20=<\20\320*2\214\365=\34\375\276<", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "#\365-O\300\336\373\3378\224\11\22>N\264!mV0S\376c\27\16\26\375_\5LB\22\202j\0\322\330\246\17t\237\252\24iP*U\344\236\305\224t\355=\251T/\316\242-k\237\13\244_\217J\20=<\20\320*2\214\365=\34\375\276<", 80, ... ) , 80, ... ) == 0x0
 02715   896   NtClose  (-2147481368, ... ) == 0x0
 02705   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\237\221u\177u\372k\357\263\25g\214\344T\11$b\1\276&^HP\222K\5\225Az\220Q\252,\257k\243'\16\304\256[\251\332I]\21\223;|\30Q\243q*m\177F9\326\304I\223w:h\272\271\15\325\340\23\232G\317l\311\2651D\366\300Q\316\345\252\356n,\4&\210\271\260OJ\230\341\212\301\351\217\250Y\225\317\22p\17\220\310\346d\355\16\320'G\335\363\347Q\206\21\253\4\25\300E\5_\362\24\22h)\13\363\371Wu\2\250\303wc\274\32\324\26\3311\2G\315\377O\360\3\235g\326\203\375>\201\211\373y\320\21\220 1\376\23\356G\27A\374\24\11\32\326\2s\332M\25\262\221\346\274\24L\363\317\27\327\355@\315\261i6\343z\3110\205\343\256\255\322\275LK\241^_\347<\327O\202w\13\261\206o*\3065\271\310\226\217\301\300\2[\22\236&\217\244\202?\363|\311\304/tl", ) , ) == 0x0
 02716   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "\321\17\307e\226Z\343\27\203u\202\326E\271\35\207\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\261\223\250\315\4\345(\13I\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02717   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02718   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02719   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02720   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02721   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02722   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02723   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02724   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481368, 2, ) }, 0, 0x0, 0, ... -2147481368, 2, ) == 0x0
 02725   896   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "\240\335\335\326\304&+\226\226\33\372\337\330\227\26\252I*6^i\277\372\34\3629\222\24\253\323Y\337\177\3228\261\331\374\20\200\217\375\25B\334Mx<\257\317\3663\260\251i\3545\250\26\17$\340S|r\346\341\36\36\304\271\206\14\375\212\204D\352\362\324", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "\240\335\335\326\304&+\226\226\33\372\337\330\227\26\252I*6^i\277\372\34\3629\222\24\253\323Y\337\177\3228\261\331\374\20\200\217\375\25B\334Mx<\257\317\3663\260\251i\3545\250\26\17$\340S|r\346\341\36\36\304\271\206\14\375\212\204D\352\362\324", 80, ... ) , 80, ... ) == 0x0
 02726   896   NtClose  (-2147481368, ... ) == 0x0
 02716   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\334)\371\223\355\301j\321\13[\206\374\7\312\20\213\346\246\363$\223\235\373\212\362\3227\35Qw\35\32104hQ\10\365\313\353\347\305\267\11\225A\241\253r\25\361\344%\261\272\316^\361\247\\331\37\375\322d, ) , ) == 0x0
 02727   896   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "\321\17\307e\226Z\343\27\203u\202\326E\271\35\207\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\\372\20\351\251\351_\261\223\250\315\4\345(\13I\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02728   896   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02729   896   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02730   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02731   896   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02732   896   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02733   896   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02734   896   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02735   896   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481368, 2, ) }, 0, 0x0, 0, ... -2147481368, 2, ) == 0x0
 02736   896   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "0\4R\373\12*HA\361\320c\245\207\223\31?\317a\346>\205J\3704\304\371\275@y:\334\361\202w9\10\351\2h\277\35\25~t7D\236\200\346"\217\322\261\346\33\245M\257\205\207,\264a\366x6\242\21\12\10\31\270\11k\252\3023\217e\217", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "0\4R\373\12*HA\361\320c\245\207\223\31?\317a\346>\205J\3704\304\371\275@y:\334\361\202w9\10\351\2h\277\35\25~t7D\236\200\346"\217\322\261\346\33\245M\257\205\207,\264a\366x6\242\21\12\10\31\270\11k\252\3023\217e\217", 80, ... ) \217\322\261\346\33\245M\257\205\207,\264a\366x6\242\21\12\10\31\270\11k\252\3023\217e\217", 80, ... ) == 0x0
 02737   896   NtClose  (-2147481368, ... ) == 0x0
 02727   896   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\201N\245&y=\3570\372\202\261ya0\3 \37\341\27\367\11C\300\31\306\327:\310N\354\311\253W\366sM\5}A\177J\360\210\262D\325\312\33R\352\360O\217\37yr\232\11,c\4\322\356\311\14\330\215\242j4oA\3177\37\17c3\177-\354\260G\35\0\367\226\204\\246\257\255\3707-\17\15\275\214\250\275*\342\274\10rh\3456\373\365}y\204\220\344\230\346\200\30\206tbjin\373j?qD\374\273\340re\302-\271\236 L]Q\275\267\250\5\36`\245t\22\223\301 R\320\3606\367\361\213\326\363A\27:\375P\25\370\26\247%\302m\240\347\376\241d \261\36\35(\362\347\26'iv\355\365\351e\275#\17R\324\241#b\26\373PzF\270\224R\251h\361\342e\251J\323\244\177\275?cxH\0=\241\15\321\10!\310\373\317\6Jq\364\31\307\232\224\360%\241/\327_nSa\25", ) , ) == 0x0
 02738   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 372, ) == 0x0
 02739   896   NtConnectPort  ( ("\RPC Control\IcaApi", {12, 2, 1, 0}, 0x0, 0x0, 1234784, 188, ... 376, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1234784, 188, ... 376, 0x0, 0x0, 0x0, 188, ) == 0x0
 02740   896   NtRequestWaitReplyPort  (376, {200, 224, new_msg, 0, 2621478, 1366728, 12, 2}  (376, {200, 224, new_msg, 0, 2621478, 1366728, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\0\260/\24\0\240\332\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\24\0\2\0\0\0\203\200=~\267\245d\27\230\332\24\0h\1\24\0\12\0\0\0\0\0\0\0\230\332\24\0(\0\0\0\240\332\24\0\244m\270\307x\1\24\0(\0\0\0>\265\0\0\0\0\24\0\274\325\22\0\255\0\0\0\0\0\0\0\370_\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\325\22\0\372\31\221|t\335\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1252, 896, 81868, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\260/\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\24\0\2\0\0\0\203\200=~\267\245d\27\230\332\24\0h\1\24\0\12\0\0\0\0\0\0\0\230\332\24\0(\0\0\0\240\332\24\0\244m\270\307x\1\24\0(\0\0\0>\265\0\0\0\0\24\0\274\325\22\0\255\0\0\0\0\0\0\0\370_\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\325\22\0\372\31\221|t\335\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ... {200, 224, reply, 0, 1252, 896, 81868, 0}  (376, {200, 224, new_msg, 0, 2621478, 1366728, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\0\260/\24\0\240\332\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\24\0\2\0\0\0\203\200=~\267\245d\27\230\332\24\0h\1\24\0\12\0\0\0\0\0\0\0\230\332\24\0(\0\0\0\240\332\24\0\244m\270\307x\1\24\0(\0\0\0>\265\0\0\0\0\24\0\274\325\22\0\255\0\0\0\0\0\0\0\370_\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\325\22\0\372\31\221|t\335\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1252, 896, 81868, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\260/\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\24\0\2\0\0\0\203\200=~\267\245d\27\230\332\24\0h\1\24\0\12\0\0\0\0\0\0\0\230\332\24\0(\0\0\0\240\332\24\0\244m\270\307x\1\24\0(\0\0\0>\265\0\0\0\0\24\0\274\325\22\0\255\0\0\0\0\0\0\0\370_\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\325\22\0\372\31\221|t\335\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 02741   896   NtRequestWaitReplyPort  (376, {32, 56, new_msg, 0, 0, 0, 0, 0}  (376, {32, 56, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\0\0\0" ... {124, 148, reply, 0, 1252, 896, 81869, 0} "\2\0\0\0\1\0\0\0\377\17\37\0\377\3\37\0\377\17\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\251\371gh\265\363\263C\206\3\320\225\213\324\252\351\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\k\336\367H\0\2\07\0\2\0\0\0\22\0" )  ... {124, 148, reply, 0, 1252, 896, 81869, 0}  (376, {32, 56, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\0\0\0" ... {124, 148, reply, 0, 1252, 896, 81869, 0} "\2\0\0\0\1\0\0\0\377\17\37\0\377\3\37\0\377\17\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\251\371gh\265\363\263C\206\3\320\225\213\324\252\351\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\k\336\367H\0\2\07\0\2\0\0\0\22\0" )  ) == 0x0
 02742   896   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 02743   896   NtRequestWaitReplyPort  (376, {44, 68, new_msg, 56, 1252, 896, 81869, 0}  (376, {44, 68, new_msg, 56, 1252, 896, 81869, 0} "\1\0\0\0B\2\5\0\377\17\37\0\377\3\37\0\377\17\37\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0H\335\24\0\10\5\0\0" ... {40, 64, reply, 0, 1252, 896, 81870, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\300\364\15\0" )  ... {40, 64, reply, 0, 1252, 896, 81870, 0}  (376, {44, 68, new_msg, 56, 1252, 896, 81869, 0} "\1\0\0\0B\2\5\0\377\17\37\0\377\3\37\0\377\17\37\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0H\335\24\0\10\5\0\0" ... {40, 64, reply, 0, 1252, 896, 81870, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\300\364\15\0" )  ) == 0x0
 02744   896   NtRequestWaitReplyPort  (376, {64, 88, new_msg, 56, 1367088, 1235360, 1367360, 0}  (376, {64, 88, new_msg, 56, 1367088, 1235360, 1367360, 0} "\10\0\0\0@\0\1\1X\2\0\0\230\330\22\0H\335\24\0\264\335\22\0\30\356\220|p\5\221|\1\0\0\0H\335\24\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 896, 81871, 0} "\10\0\0\0@\0\1\1X\2\0\0\230\330\22\0H\335\24\0\264\335\22\0\30\356\220|p\5\221|\1\0\0\0H\335\24\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 1252, 896, 81871, 0}  (376, {64, 88, new_msg, 56, 1367088, 1235360, 1367360, 0} "\10\0\0\0@\0\1\1X\2\0\0\230\330\22\0H\335\24\0\264\335\22\0\30\356\220|p\5\221|\1\0\0\0H\335\24\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 896, 81871, 0} "\10\0\0\0@\0\1\1X\2\0\0\230\330\22\0H\335\24\0\264\335\22\0\30\356\220|p\5\221|\1\0\0\0H\335\24\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02745   896   NtRequestWaitReplyPort  (376, {44, 68, new_msg, 56, 1252, 896, 81870, 0}  (376, {44, 68, new_msg, 56, 1252, 896, 81870, 0} "\1\31\0\0B\2\5\0\200\300\227|p\31\221|\250$\12\0\330\0\0\0\377\377\377\377\0\300\372\177\1\0\0\0H\335\24\0\10\5\0\0" ... {40, 64, reply, 0, 1252, 896, 81872, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\300\364\15\0" )  ... {40, 64, reply, 0, 1252, 896, 81872, 0}  (376, {44, 68, new_msg, 56, 1252, 896, 81870, 0} "\1\31\0\0B\2\5\0\200\300\227|p\31\221|\250$\12\0\330\0\0\0\377\377\377\377\0\300\372\177\1\0\0\0H\335\24\0\10\5\0\0" ... {40, 64, reply, 0, 1252, 896, 81872, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\300\364\15\0" )  ) == 0x0
 02746   896   NtRequestWaitReplyPort  (376, {64, 88, new_msg, 56, 1367088, 1235360, 1367360, 0}  (376, {64, 88, new_msg, 56, 1367088, 1235360, 1367360, 0} "\10\0\0\0@\0\1\1X\2\0\0\230\330\22\0H\335\24\0\264\335\22\0\30\356\220|p\5\221|\1\0\0\0H\335\24\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 896, 81873, 0} "\10\0\0\0@\0\1\1X\2\0\0\230\330\22\0H\335\24\0\264\335\22\0\30\356\220|p\5\221|\1\0\0\0H\335\24\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 1252, 896, 81873, 0}  (376, {64, 88, new_msg, 56, 1367088, 1235360, 1367360, 0} "\10\0\0\0@\0\1\1X\2\0\0\230\330\22\0H\335\24\0\264\335\22\0\30\356\220|p\5\221|\1\0\0\0H\335\24\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 896, 81873, 0} "\10\0\0\0@\0\1\1X\2\0\0\230\330\22\0H\335\24\0\264\335\22\0\30\356\220|p\5\221|\1\0\0\0H\335\24\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02747   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 380, ) }, ... 380, ) == 0x0
 02748   896   NtOpenKey  (0x20019, {24, 380, 0x40, 0, 0,  (0x20019, {24, 380, 0x40, 0, 0, "ActiveComputerName"}, ... 384, ) }, ... 384, ) == 0x0
 02749   896   NtQueryValueKey  (384,  (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02750   896   NtClose  (384, ... ) == 0x0
 02751   896   NtClose  (380, ... ) == 0x0
 02752   896   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 380, ) == 0x0
 02753   896   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 384, ) == 0x0
 02754   896   NtDuplicateObject  (-1, 380, -1, 0x0, 0, 2, ... 388, ) == 0x0
 02755   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02756   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 392, ) == 0x0
 02757   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02758   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02759   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234820,  (0xc0100080, {24, 0, 0x40, 0, 1234820, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 396, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 396, {status=0x0, info=1}, ) == 0x0
 02760   896   NtSetInformationFile  (396, 1234876, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02761   896   NtSetInformationFile  (396, 1234864, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02762   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02763   896   NtWriteFile  (396, 365, 0, 0,  (396, 365, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02764   896   NtReadFile  (396, 365, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (396, 365, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20l+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02765   896   NtFsControlFile  (396, 365, 0x0, 0x0, 0x11c017,  (396, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\336\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20l+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (396, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\336\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20l+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02766   896   NtFsControlFile  (396, 365, 0x0, 0x0, 0x11c017,  (396, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301\1\0\0\0\1\0\0\0,\0.\0\0\341\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48},  (396, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301\1\0\0\0\1\0\0\0,\0.\0\0\341\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301\0\0\0\0", ) , ) == 0x103
 02767   896   NtFsControlFile  (396, 365, 0x0, 0x0, 0x11c017,  (396, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0h\350\24\0\1\0\0\0t\350\24\0 \0\0\0\1\0\0\0\16\0\20\0\200\350\24\0\220\350\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\320\350\24\0\1\0\0\0\1\0\16\0\340\350\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (396, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0h\350\24\0\1\0\0\0t\350\24\0 \0\0\0\1\0\0\0\16\0\20\0\200\350\24\0\220\350\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\320\350\24\0\1\0\0\0\1\0\16\0\340\350\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02768   896   NtClose  (392, ... ) == 0x0
 02769   896   NtClose  (396, ... ) == 0x0
 02770   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02771   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 396, ) == 0x0
 02772   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02773   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02774   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234792,  (0xc0100080, {24, 0, 0x40, 0, 1234792, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 392, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 392, {status=0x0, info=1}, ) == 0x0
 02775   896   NtSetInformationFile  (392, 1234848, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02776   896   NtSetInformationFile  (392, 1234836, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02777   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02778   896   NtWriteFile  (392, 365, 0, 0,  (392, 365, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02779   896   NtReadFile  (392, 365, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (392, 365, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02780   896   NtFsControlFile  (392, 365, 0x0, 0x0, 0x11c017,  (392, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\336\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (392, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\336\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02781   896   NtFsControlFile  (392, 365, 0x0, 0x0, 0x11c017,  (392, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<\1\0\0\0\1\0\0\0,\0.\0\0\341\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48},  (392, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<\1\0\0\0\1\0\0\0,\0.\0\0\341\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<\0\0\0\0", ) , ) == 0x103
 02782   896   NtFsControlFile  (392, 365, 0x0, 0x0, 0x11c017,  (392, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0h\350\24\0\1\0\0\0t\350\24\0 \0\0\0\1\0\0\0\16\0\20\0\200\350\24\0\220\350\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\320\350\24\0\1\0\0\0\1\0\16\0\340\350\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (392, 365, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0h\350\24\0\1\0\0\0t\350\24\0 \0\0\0\1\0\0\0\16\0\20\0\200\350\24\0\220\350\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\320\350\24\0\1\0\0\0\1\0\16\0\340\350\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02783   896   NtClose  (396, ... ) == 0x0
 02784   896   NtClose  (392, ... ) == 0x0
 02785   896   NtOpenProcessToken  (-1, 0x20008, ... 392, ) == 0x0
 02786   896   NtQueryInformationToken  (392, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 02787   896   NtQueryInformationToken  (392, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0
 02788   896   NtOpenDirectoryObject  (0x2, {24, 0, 0x40, 0, 0,  (0x2, {24, 0, 0x40, 0, 0, "\Windows\WindowStations"}, ... 396, ) }, ... 396, ) == 0x0
 02789   896   NtUserOpenWindowStation  ({24, 396, 0x40, 0, 0,  ({24, 396, 0x40, 0, 0, "winsta0"}, 0x37f, ... ) }, 0x37f, ... ) == 0x190
 02790   896   NtClose  (396, ... ) == 0x0
 02791   896   NtUserCloseWindowStation  (400, ...
 02792   896   NtClose  (400, ... ) == 0x0
 02791   896   NtUserCloseWindowStation  ... ) == 0x1
 02793   896   NtClose  (392, ... ) == 0x0
 02794   896   NtCreateEvent  (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 392, ) == 0x0
 02795   896   NtCreateEvent  (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 400, ) == 0x0
 02796   896   NtCreateMutant  (0x1f0001, {24, 0, 0x2, 0, 0, 0x0}, 0, ... 396, ) == 0x0
 02797   896   NtDuplicateObject  (-1, -1, -1, 0x1f0fff, 2, 0, ... 404, ) == 0x0
 02798   896   NtCreateSection  (0xf0007, {24, 0, 0x2, 0, 0, 0x0}, {7248, 0}, 4, 134217728, 0, ... 408, ) == 0x0
 02799   896   NtMapViewOfSection  (408, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x26e0000), {0, 0}, 8192, ) == 0x0
 02800   896   NtQueryDefaultUILanguage  (1235484, ...
 02801   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02802   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 02803   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02804   896   NtClose  (-2147481368, ... ) == 0x0
 02805   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 02806   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02807   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 02808   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02809   896   NtClose  (-2147481452, ... ) == 0x0
 02810   896   NtClose  (-2147481368, ... ) == 0x0
 02800   896   NtQueryDefaultUILanguage  ... ) == 0x0
 02811   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02812   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02813   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1233728, ... ) }, 1233728, ... ) == 0x0
 02814   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1232500, ... ) }, 1232500, ... ) == 0x0
 02815   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02816   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02817   896   NtCreateFile  (0x10100080, {24, 0, 0x40, 0, 1234836,  (0x10100080, {24, 0, 0x40, 0, 1234836, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\11e7_appcompat.txt"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 02818   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1,  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 02819   896   NtClose  (-2147481368, ... ) == 0x0
 02820   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1,  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 02821   896   NtClose  (-2147481368, ... ) == 0x0
 02822   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1,  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 02823   896   NtClose  (-2147481368, ... ) == 0x0
 02817   896   NtCreateFile  ... 412, {status=0x0, info=2}, ) == 0x0
 02824   896   NtClose  (412, ... ) == 0x0
 02825   896   NtCreateSection  (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 412, ) == 0x0
 02826   896   NtMapViewOfSection  (412, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0x2ad0000), 0x0, 4194304, ) == 0x0
 02827   896   NtAllocateVirtualMemory  (-1, 44892160, 0, 1, 4096, 4, ... 44892160, 4096, ) == 0x0
 02828   896   NtAllocateVirtualMemory  (-1, 44896256, 0, 4808, 4096, 4, ... 44896256, 8192, ) == 0x0
 02829   896   NtCreateSection  (0xf0007, 0x0, {33036, 0}, 4, 134217728, 0, ... 416, ) == 0x0
 02830   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02831   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02832   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02833   896   NtClose  (412, ... ) == 0x0
 02834   896   NtUnmapViewOfSection  (-1, 0x2ad0000, ... ) == 0x0
 02835   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02836   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02837   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02838   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02839   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02840   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02841   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02842   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02843   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02844   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02845   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02846   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02847   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02848   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02849   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02850   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02851   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02852   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02853   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02854   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02855   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02856   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02857   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02858   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02859   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02860   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02861   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02862   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02863   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02864   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02865   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02866   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02867   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02868   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02869   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02870   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02871   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02872   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02873   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02874   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02875   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02876   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02877   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02878   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02879   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02880   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02881   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02882   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02883   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02884   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02885   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02886   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02887   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02888   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02889   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02890   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02891   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02892   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02893   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02894   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02895   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02896   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02897   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02898   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 36864, ) == 0x0
 02899   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02900   896   NtClose  (416, ... ) == 0x0
 02901   896   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02902   896   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\u:"}, 3, 96, ... 416, {status=0x0, info=1}, ) }, 3, 96, ... 416, {status=0x0, info=1}, ) == 0x0
 02903   896   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\u:"}, ... 412, ) }, ... 412, ) == 0x0
 02904   896   NtQuerySymbolicLinkObject  (412, ...  (412, ... "\Device\WinDfs\U:0000000000009f43", 66, ) , 66, ) == 0x0
 02905   896   NtClose  (412, ... ) == 0x0
 02906   896   NtQueryVolumeInformationFile  (416, 1234052, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02907   896   NtClose  (416, ... ) == 0x0
 02908   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1232848, ... ) }, 1232848, ... ) == 0x0
 02909   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 416, {status=0x0, info=1}, ) }, 5, 96, ... 416, {status=0x0, info=1}, ) == 0x0
 02910   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 416, ... 412, ) == 0x0
 02911   896   NtClose  (416, ... ) == 0x0
 02912   896   NtMapViewOfSection  (412, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2700000), 0x0, 126976, ) == 0x0
 02913   896   NtClose  (412, ... ) == 0x0
 02914   896   NtUnmapViewOfSection  (-1, 0x2700000, ... ) == 0x0
 02915   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1233156, ... ) }, 1233156, ... ) == 0x0
 02916   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 412, {status=0x0, info=1}, ) }, 5, 96, ... 412, {status=0x0, info=1}, ) == 0x0
 02917   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 412, ... 416, ) == 0x0
 02918   896   NtQuerySection  (416, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02919   896   NtClose  (412, ... ) == 0x0
 02920   896   NtMapViewOfSection  (416, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 02921   896   NtClose  (416, ... ) == 0x0
 02922   896   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 02923   896   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 02924   896   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 02925   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02926   896   NtAllocateVirtualMemory  (-1, 1372160, 0, 12288, 4096, 4, ... 1372160, 12288, ) == 0x0
 02927   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1234544, ... ) }, 1234544, ... ) == 0x0
 02928   896   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1234552,  (0x40100080, {24, 0, 0x40, 0, 1234552, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\11e7_appcompat.txt"}, 0x0, 128, 0, 5, 96, 0, 0, ... }, 0x0, 128, 0, 5, 96, 0, 0, ...
 02929   896   NtClose  (-2147481368, ... ) == 0x0
 02930   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1,  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 02931   896   NtClose  (-2147481368, ... ) == 0x0
 02932   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1,  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 02933   896   NtClose  (-2147481368, ... ) == 0x0
 02934   896   NtQueryDirectoryFile  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1,  (-2147481368, 0, 0, 0, -519315456, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 02935   896   NtClose  (-2147481368, ... ) == 0x0
 02928   896   NtCreateFile  ... 416, {status=0x0, info=3}, ) == 0x0
 02936   896   NtAllocateVirtualMemory  (-1, 1384448, 0, 12288, 4096, 4, ... 1384448, 12288, ) == 0x0
 02937   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 412, {status=0x0, info=1}, ) }, 3, 16417, ... 412, {status=0x0, info=1}, ) == 0x0
 02938   896   NtQueryDirectoryFile  (412, 0, 0, 0, 1233256, 616, BothDirectory, 1,  (412, 0, 0, 0, 1233256, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0
 02939   896   NtWriteFile  (416, 0, 0, 0,  (416, 0, 0, 0, "\377\376", 2, 0x0, 0, ... {status=0x0, info=2}, ) , 2, 0x0, 0, ... {status=0x0, info=2}, ) == 0x0
 02940   896   NtWriteFile  (416, 0, 0, 0,  (416, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \01\0.\00\0 (416, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \0U\0T\0F\0-\01\06\0 (416, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) , 106, 0x0, 0, ... {status=0x0, info=106}, ) == 0x0
 02941   896   NtWriteFile  (416, 0, 0, 0,  (416, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (416, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (416, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) , 122, 0x0, 0, ... {status=0x0, info=122}, ) == 0x0
 02942   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1233636, ... ) }, 1233636, ... ) == 0x0
 02943   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 02944   896   NtQueryDirectoryFile  (420, 0, 0, 0, 1233248, 592, Directory, 1,  (420, 0, 0, 0, 1233248, 592, Directory, 1, "packed.exe", 0, ... {status=0x0, info=84}, ) , 0, ... {status=0x0, info=84}, ) == 0x0
 02945   896   NtClose  (420, ... ) == 0x0
 02946   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02947   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02948   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1232168, ... ) }, 1232168, ... ) == 0x0
 02949   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1230940, ... ) }, 1230940, ... ) == 0x0
 02950   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02951   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02952   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 02953   896   NtQueryInformationFile  (420, 1233724, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02954   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 420, ... 424, ) == 0x0
 02955   896   NtMapViewOfSection  (424, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2ad0000), 0x0, 1290240, ) == 0x0
 02956   896   NtUnmapViewOfSection  (-1, 0x2ad0000, ... ) == 0x0
 02957   896   NtClose  (424, ... ) == 0x0
 02958   896   NtClose  (420, ... ) == 0x0
 02959   896   NtWriteFile  (416, 0, 0, 0,  (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... \01\02\08\07\06\03\04\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... \00\0x\02\0E\0C\08\06\0B\03\02\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... \0W\0I\0N\03\02\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... \00\0x\08\09\07\04\02\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... \00\0x\00\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... \01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... \01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\01\02\08\07\06\03\04\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\02\0E\0C\08\06\0B\03\02\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\08\09\07\04\02\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\01\01\0/\02\02\0/\02\00\00\07\0 \01\08\0:\01\07\0:\01\00\0"\0 \0/\0>\0\15\0\12\0", 420, 0x0, 0, ... , 420, 0x0, 0, ...
 02960   896   NtContinue  (-135750188, 0, ...
 02959   896   NtWriteFile  ... {status=0x0, info=420}, ) == 0x0
 02961   896   NtQueryDirectoryFile  (412, 0, 0, 0, 1387312, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES
 02962   896   NtClose  (412, ... ) == 0x0
 02963   896   NtWriteFile  (416, 0, 0, 0,  (416, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0", 16, 0x0, 0, ... {status=0x0, info=16}, ) , 16, 0x0, 0, ... {status=0x0, info=16}, ) == 0x0
 02964   896   NtClose  (416, ... ) == 0x0
 02965   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1234544, ... ) }, 1234544, ... ) == 0x0
 02966   896   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1234552,  (0x40100080, {24, 0, 0x40, 0, 1234552, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\11e7_appcompat.txt"}, 0x0, 128, 0, 3, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 0, 3, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 02967   896   NtQueryInformationFile  (416, 1234576, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02968   896   NtSetInformationFile  (416, 1234608, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 02969   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 412, {status=0x0, info=1}, ) }, 3, 16417, ... 412, {status=0x0, info=1}, ) == 0x0
 02970   896   NtQueryDirectoryFile  (412, 0, 0, 0, 1233256, 616, BothDirectory, 1,  (412, 0, 0, 0, 1233256, 616, BothDirectory, 1, "kernel32.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 02971   896   NtWriteFile  (416, 0, 0, 0,  (416, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (416, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (416, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) , 126, 0x0, 0, ... {status=0x0, info=126}, ) == 0x0
 02972   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1233608, ... ) }, 1233608, ... ) == 0x0
 02973   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 02974   896   NtQueryDirectoryFile  (420, 0, 0, 0, 1233248, 592, Directory, 1,  (420, 0, 0, 0, 1233248, 592, Directory, 1, "kernel32.dll", 0, ... {status=0x0, info=88}, ) , 0, ... {status=0x0, info=88}, ) == 0x0
 02975   896   NtClose  (420, ... ) == 0x0
 02976   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02977   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02978   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1232168, ... ) }, 1232168, ... ) == 0x0
 02979   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1230940, ... ) }, 1230940, ... ) == 0x0
 02980   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02981   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02982   896   NtQueryDefaultLocale  (1, 1233128, ... ) == 0x0
 02983   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02984   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02985   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1232160, ... ) }, 1232160, ... ) == 0x0
 02986   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1230932, ... ) }, 1230932, ... ) == 0x0
 02987   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02988   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02989   896   NtQueryDefaultLocale  (1, 1233120, ... ) == 0x0
 02990   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 02991   896   NtQueryInformationFile  (420, 1233724, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02992   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 420, ... 424, ) == 0x0
 02993   896   NtMapViewOfSection  (424, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2ad0000), 0x0, 987136, ) == 0x0
 02994   896   NtUnmapViewOfSection  (-1, 0x2ad0000, ... ) == 0x0
 02995   896   NtClose  (424, ... ) == 0x0
 02996   896   NtClose  (420, ... ) == 0x0
 02997   896   NtQueryDefaultUILanguage  (1233080, ...
 02998   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02999   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 03000   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03001   896   NtClose  (-2147481368, ... ) == 0x0
 03002   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 03003   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03004   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 03005   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03006   896   NtClose  (-2147481452, ... ) == 0x0
 03007   896   NtClose  (-2147481368, ... ) == 0x0
 02997   896   NtQueryDefaultUILanguage  ... ) == 0x0
 03008   896   NtWriteFile  (416, 0, 0, 0,  (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \09\08\04\05\07\06\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \00\0x\0F\00\0B\03\03\01\0F\06\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0 (416, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) == 0x0
 03009   896   NtQueryDirectoryFile  (412, 0, 0, 0, 1378608, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES
 03010   896   NtClose  (412, ... ) == 0x0
 03011   896   NtWriteFile  (416, 0, 0, 0,  (416, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0<\0/\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 42, 0x0, 0, ... {status=0x0, info=42}, ) , 42, 0x0, 0, ... {status=0x0, info=42}, ) == 0x0
 03012   896   NtClose  (416, ... ) == 0x0
 03013   896   NtUnmapViewOfSection  (-1, 0x77b40000, ... ) == 0x0
 03014   896   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 03015   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1231816, ... ) }, 1231816, ... ) == 0x0
 03016   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1232552, ... ) }, 1232552, ... ) == 0x0
 03017   896   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 416, {status=0x0, info=1}, ) }, 5, 96, ... 416, {status=0x0, info=1}, ) == 0x0
 03018   896   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 416, ... 412, ) == 0x0
 03019   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03020   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 420, ) }, ... 420, ) == 0x0
 03021   896   NtQueryValueKey  (420,  (420, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03022   896   NtClose  (420, ... ) == 0x0
 03023   896   NtQueryVolumeInformationFile  (416, 1231828, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 03024   896   NtOpenMutant  (0x120001, {24, 72, 0x0, 0, 0,  (0x120001, {24, 72, 0x0, 0, 0, "ShimCacheMutex"}, ... 420, ) }, ... 420, ) == 0x0
 03025   896   NtWaitForSingleObject  (420, 0, {-1000000, -1}, ... ) == 0x0
 03026   896   NtOpenSection  (0x2, {24, 72, 0x0, 0, 0,  (0x2, {24, 72, 0x0, 0, 0, "ShimSharedMemory"}, ... 424, ) }, ... 424, ) == 0x0
 03027   896   NtMapViewOfSection  (424, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2700000), {0, 0}, 57344, ) == 0x0
 03028   896   NtReleaseMutant  (420, ... 0x0, ) == 0x0
 03029   896   NtAllocateVirtualMemory  (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0
 03030   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1229760, ... ) }, 1229760, ... ) == 0x0
 03031   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 428, {status=0x0, info=1}, ) }, 5, 96, ... 428, {status=0x0, info=1}, ) == 0x0
 03032   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 428, ... 432, ) == 0x0
 03033   896   NtClose  (428, ... ) == 0x0
 03034   896   NtMapViewOfSection  (432, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2710000), 0x0, 126976, ) == 0x0
 03035   896   NtClose  (432, ... ) == 0x0
 03036   896   NtUnmapViewOfSection  (-1, 0x2710000, ... ) == 0x0
 03037   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1230068, ... ) }, 1230068, ... ) == 0x0
 03038   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 432, {status=0x0, info=1}, ) }, 5, 96, ... 432, {status=0x0, info=1}, ) == 0x0
 03039   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 432, ... 428, ) == 0x0
 03040   896   NtQuerySection  (428, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03041   896   NtClose  (432, ... ) == 0x0
 03042   896   NtMapViewOfSection  (428, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 03043   896   NtClose  (428, ... ) == 0x0
 03044   896   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 03045   896   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 03046   896   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 03047   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03048   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 428, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 428, {status=0x0, info=1}, ) == 0x0
 03049   896   NtQueryInformationFile  (428, 1230084, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03050   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 428, ... 432, ) == 0x0
 03051   896   NtMapViewOfSection  (432, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2ad0000), 0x0, 1191936, ) == 0x0
 03052   896   NtQueryInformationFile  (428, 1230184, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03053   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03054   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 03055   896   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 03056   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03057   896   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 436, ) }, ... 436, ) == 0x0
 03058   896   NtQueryValueKey  (436,  (436, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (436, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03059   896   NtClose  (436, ... ) == 0x0
 03060   896   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03061   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03062   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1227780, 616, BothDirectory, 1,  (436, 0, 0, 0, 1227780, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 03063   896   NtClose  (436, ... ) == 0x0
 03064   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03065   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03066   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228156, ... ) }, 1228156, ... ) == 0x0
 03067   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03068   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1227584, 616, BothDirectory, 1,  (436, 0, 0, 0, 1227584, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 03069   896   NtClose  (436, ... ) == 0x0
 03070   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03071   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1227584, 616, BothDirectory, 1,  (436, 0, 0, 0, 1227584, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 03072   896   NtClose  (436, ... ) == 0x0
 03073   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03074   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1227584, 616, BothDirectory, 1,  (436, 0, 0, 0, 1227584, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 03075   896   NtClose  (436, ... ) == 0x0
 03076   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03077   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03078   896   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 03079   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03080   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03081   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 436, ) == 0x0
 03082   896   NtQueryInformationToken  (436, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03083   896   NtClose  (436, ... ) == 0x0
 03084   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03085   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03086   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228988, ... ) }, 1228988, ... ) == 0x0
 03087   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03088   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03089   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227856, ... ) }, 1227856, ... ) == 0x0
 03090   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 436, {status=0x0, info=1}, ) }, 5, 96, ... 436, {status=0x0, info=1}, ) == 0x0
 03091   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 436, ... 440, ) == 0x0
 03092   896   NtClose  (436, ... ) == 0x0
 03093   896   NtMapViewOfSection  (440, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2710000), 0x0, 180224, ) == 0x0
 03094   896   NtClose  (440, ... ) == 0x0
 03095   896   NtUnmapViewOfSection  (-1, 0x2710000, ... ) == 0x0
 03096   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227452, ... ) }, 1227452, ... ) == 0x0
 03097   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1228196,  (0x80100080, {24, 0, 0x40, 0, 1228196, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 440, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 440, {status=0x0, info=1}, ) == 0x0
 03098   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 440, ... 436, ) == 0x0
 03099   896   NtClose  (440, ... ) == 0x0
 03100   896   NtMapViewOfSection  (436, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x2710000), {0, 0}, 180224, ) == 0x0
 03101   896   NtClose  (436, ... ) == 0x0
 03102   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03103   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03104   896   NtQueryDefaultLocale  (1, 1228816, ... ) == 0x0
 03105   896   NtQueryVirtualMemory  (-1, 0x2710000, Basic, 28, ... {BaseAddress=0x2710000,AllocationBase=0x2710000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03106   896   NtQueryVirtualMemory  (-1, 0x2710000, Basic, 28, ... {BaseAddress=0x2710000,AllocationBase=0x2710000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03107   896   NtUnmapViewOfSection  (-1, 0x2710000, ... ) == 0x0
 03108   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03109   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03110   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227848, ... ) }, 1227848, ... ) == 0x0
 03111   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 436, {status=0x0, info=1}, ) }, 5, 96, ... 436, {status=0x0, info=1}, ) == 0x0
 03112   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 436, ... 440, ) == 0x0
 03113   896   NtClose  (436, ... ) == 0x0
 03114   896   NtMapViewOfSection  (440, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2710000), 0x0, 180224, ) == 0x0
 03115   896   NtClose  (440, ... ) == 0x0
 03116   896   NtUnmapViewOfSection  (-1, 0x2710000, ... ) == 0x0
 03117   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227444, ... ) }, 1227444, ... ) == 0x0
 03118   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1228188,  (0x80100080, {24, 0, 0x40, 0, 1228188, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 440, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 440, {status=0x0, info=1}, ) == 0x0
 03119   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 440, ... 436, ) == 0x0
 03120   896   NtClose  (440, ... ) == 0x0
 03121   896   NtMapViewOfSection  (436, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x2710000), {0, 0}, 180224, ) == 0x0
 03122   896   NtClose  (436, ... ) == 0x0
 03123   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03124   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03125   896   NtQueryDefaultLocale  (1, 1228808, ... ) == 0x0
 03126   896   NtQueryVirtualMemory  (-1, 0x2710000, Basic, 28, ... {BaseAddress=0x2710000,AllocationBase=0x2710000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03127   896   NtUnmapViewOfSection  (-1, 0x2710000, ... ) == 0x0
 03128   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03129   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03130   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 436, ) == 0x0
 03131   896   NtQueryInformationToken  (436, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03132   896   NtClose  (436, ... ) == 0x0
 03133   896   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03134   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03135   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03136   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1229408, ... ) }, 1229408, ... ) == 0x0
 03137   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03138   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1228836, 616, BothDirectory, 1,  (436, 0, 0, 0, 1228836, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 03139   896   NtClose  (436, ... ) == 0x0
 03140   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03141   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1228836, 616, BothDirectory, 1,  (436, 0, 0, 0, 1228836, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 03142   896   NtClose  (436, ... ) == 0x0
 03143   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03144   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1228836, 616, BothDirectory, 1,  (436, 0, 0, 0, 1228836, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 03145   896   NtClose  (436, ... ) == 0x0
 03146   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03147   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03148   896   NtWaitForSingleObject  (420, 0, {-1000000, -1}, ... ) == 0x0
 03149   896   NtReleaseMutant  (420, ... 0x0, ) == 0x0
 03150   896   NtUnmapViewOfSection  (-1, 0x2ad0000, ... ) == 0x0
 03151   896   NtClose  (432, ... ) == 0x0
 03152   896   NtClose  (428, ... ) == 0x0
 03153   896   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 03154   896   NtOpenProcessToken  (-1, 0xa, ... 428, ) == 0x0
 03155   896   NtQueryInformationToken  (428, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 03156   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03157   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 432, ) }, ... 432, ) == 0x0
 03158   896   NtQueryValueKey  (432,  (432, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (432, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03159   896   NtQueryValueKey  (432,  (432, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (432, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03160   896   NtClose  (432, ... ) == 0x0
 03161   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03162   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 432, ) }, ... 432, ) == 0x0
 03163   896   NtQueryValueKey  (432,  (432, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03164   896   NtClose  (432, ... ) == 0x0
 03165   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03166   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03167   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03168   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03169   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03170   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03171   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03172   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03173   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03174   896   NtQueryDefaultLocale  (1, 1231256, ... ) == 0x0
 03175   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 432, ) }, ... 432, ) == 0x0
 03176   896   NtEnumerateKey  (432, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (432, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 03177   896   NtOpenKey  (0x20019, {24, 432, 0x40, 0, 0,  (0x20019, {24, 432, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 436, ) }, ... 436, ) == 0x0
 03178   896   NtQueryValueKey  (436,  (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 03179   896   NtQueryValueKey  (436,  (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03180   896   NtClose  (436, ... ) == 0x0
 03181   896   NtEnumerateKey  (432, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 03182   896   NtClose  (432, ... ) == 0x0
 03183   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 432, ) }, ... 432, ) == 0x0
 03184   896   NtEnumerateKey  (432, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (432, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 03185   896   NtOpenKey  (0x20019, {24, 432, 0x40, 0, 0,  (0x20019, {24, 432, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 436, ) }, ... 436, ) == 0x0
 03186   896   NtQueryValueKey  (436,  (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 03187   896   NtQueryValueKey  (436,  (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 03188   896   NtQueryValueKey  (436,  (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 03189   896   NtQueryValueKey  (436,  (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03190   896   NtClose  (436, ... ) == 0x0
 03191   896   NtEnumerateKey  (432, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (432, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 03192   896   NtOpenKey  (0x20019, {24, 432, 0x40, 0, 0,  (0x20019, {24, 432, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 436, ) }, ... 436, ) == 0x0
 03193   896   NtQueryValueKey  (436,  (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 03194   896   NtQueryValueKey  (436,  (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 03195   896   NtQueryValueKey  (436,  (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 03196   896   NtQueryValueKey  (436,  (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03197   896   NtClose  (436, ... ) == 0x0
 03198   896   NtEnumerateKey  (432, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (432, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 03199   896   NtOpenKey  (0x20019, {24, 432, 0x40, 0, 0,  (0x20019, {24, 432, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 436, ) }, ... 436, ) == 0x0
 03200   896   NtQueryValueKey  (436,  (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 03201   896   NtQueryValueKey  (436,  (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 03202   896   NtQueryValueKey  (436,  (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 03203   896   NtQueryValueKey  (436,  (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03204   896   NtClose  (436, ... ) == 0x0
 03205   896   NtEnumerateKey  (432, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (432, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 03206   896   NtOpenKey  (0x20019, {24, 432, 0x40, 0, 0,  (0x20019, {24, 432, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 436, ) }, ... 436, ) == 0x0
 03207   896   NtQueryValueKey  (436,  (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 03208   896   NtQueryValueKey  (436,  (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 03209   896   NtQueryValueKey  (436,  (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 03210   896   NtQueryValueKey  (436,  (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03211   896   NtClose  (436, ... ) == 0x0
 03212   896   NtEnumerateKey  (432, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (432, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 03213   896   NtOpenKey  (0x20019, {24, 432, 0x40, 0, 0,  (0x20019, {24, 432, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 436, ) }, ... 436, ) == 0x0
 03214   896   NtQueryValueKey  (436,  (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (436, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 03215   896   NtQueryValueKey  (436,  (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 03216   896   NtQueryValueKey  (436,  (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (436, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 03217   896   NtQueryValueKey  (436,  (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (436, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03218   896   NtClose  (436, ... ) == 0x0
 03219   896   NtEnumerateKey  (432, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 03220   896   NtClose  (432, ... ) == 0x0
 03221   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03222   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03224   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03225   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03226   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03227   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03228   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03229   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03230   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03231   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03232   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03233   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03234   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03235   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03236   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03237   896   NtClose  (432, ... ) == 0x0
 03238   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03239   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03240   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03241   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03242   896   NtClose  (432, ... ) == 0x0
 03243   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03244   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03245   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03246   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03247   896   NtClose  (432, ... ) == 0x0
 03248   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03249   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03250   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03251   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03252   896   NtClose  (432, ... ) == 0x0
 03253   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03254   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03255   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03256   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03257   896   NtClose  (432, ... ) == 0x0
 03258   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03259   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03260   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03261   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03262   896   NtClose  (432, ... ) == 0x0
 03263   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03264   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03265   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03266   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03267   896   NtClose  (432, ... ) == 0x0
 03268   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03269   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03270   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03271   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03272   896   NtClose  (432, ... ) == 0x0
 03273   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03274   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03275   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03276   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03277   896   NtClose  (432, ... ) == 0x0
 03278   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03279   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03280   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03281   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03282   896   NtClose  (432, ... ) == 0x0
 03283   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03284   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03285   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03286   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03287   896   NtClose  (432, ... ) == 0x0
 03288   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03289   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03290   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03291   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03292   896   NtClose  (432, ... ) == 0x0
 03293   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03294   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03295   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03296   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03297   896   NtClose  (432, ... ) == 0x0
 03298   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03299   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03300   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03301   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03302   896   NtClose  (432, ... ) == 0x0
 03303   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03304   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03305   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03306   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03307   896   NtClose  (432, ... ) == 0x0
 03308   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03309   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 432, ) }, ... 432, ) == 0x0
 03310   896   NtQueryValueKey  (432,  (432, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (432, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (432, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 03311   896   NtClose  (432, ... ) == 0x0
 03312   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03313   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 432, ) == 0x0
 03314   896   NtQueryInformationToken  (432, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03315   896   NtClose  (432, ... ) == 0x0
 03316   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03317   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 03318   896   NtOpenProcessToken  (-1, 0xa, ... 432, ) == 0x0
 03319   896   NtDuplicateToken  (432, 0xc, {24, 0, 0x0, 0, 1231688, 0x0}, 0, 2, ... 436, ) == 0x0
 03320   896   NtClose  (432, ... ) == 0x0
 03321   896   NtAccessCheck  (1396048, 436, 0x1, 1231764, 1231816, 56, 1231796, ... (0x1), ) == 0x0
 03322   896   NtClose  (436, ... ) == 0x0
 03323   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 436, ) }, ... 436, ) == 0x0
 03324   896   NtQueryValueKey  (436,  (436, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (436, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03325   896   NtClose  (436, ... ) == 0x0
 03326   896   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 436, ) }, ... 436, ) == 0x0
 03327   896   NtQuerySymbolicLinkObject  (436, ...  (436, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 03328   896   NtClose  (436, ... ) == 0x0
 03329   896   NtQueryVolumeInformationFile  (416, 1229520, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 03330   896   NtQueryInformationFile  (416, 1229636, 528, Name, ... {status=0x0, info=58}, ) == 0x0
 03331   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03332   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03333   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228808, ... ) }, 1228808, ... ) == 0x0
 03334   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03335   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1228236, 616, BothDirectory, 1,  (436, 0, 0, 0, 1228236, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 03336   896   NtClose  (436, ... ) == 0x0
 03337   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03338   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1228236, 616, BothDirectory, 1,  (436, 0, 0, 0, 1228236, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 03339   896   NtClose  (436, ... ) == 0x0
 03340   896   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 436, {status=0x0, info=1}, ) }, 3, 16417, ... 436, {status=0x0, info=1}, ) == 0x0
 03341   896   NtQueryDirectoryFile  (436, 0, 0, 0, 1228236, 616, BothDirectory, 1,  (436, 0, 0, 0, 1228236, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 03342   896   NtClose  (436, ... ) == 0x0
 03343   896   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03344   896   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03345   896   NtQueryInformationFile  (416, 1231676, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03346   896   NtCreateSection  (0xf0005, 0x0, {180224, 0}, 2, 134217728, 416, ... 436, ) == 0x0
 03347   896   NtMapViewOfSection  (436, -1, (0x0), 0, 0, {0, 0}, 180224, 1, 0, 2, ... (0x2710000), {0, 0}, 180224, ) == 0x0
 03348   896   NtClose  (436, ... ) == 0x0
 03349   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03350   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 436, ) == 0x0
 03351   896   NtQueryInformationToken  (436, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03352   896   NtClose  (436, ... ) == 0x0
 03353   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 436, ) }, ... 436, ) == 0x0
 03354   896   NtOpenKey  (0x20019, {24, 436, 0x40, 0, 0,  (0x20019, {24, 436, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 432, ) }, ... 432, ) == 0x0
 03355   896   NtClose  (436, ... ) == 0x0
 03356   896   NtQueryValueKey  (432,  (432, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03357   896   NtQueryValueKey  (432,  (432, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (432, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 03358   896   NtClose  (432, ... ) == 0x0
 03359   896   NtUnmapViewOfSection  (-1, 0x2710000, ... ) == 0x0
 03360   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 40960000, 4096, ) == 0x0
 03361   896   NtAllocateVirtualMemory  (-1, 40960000, 0, 4096, 4096, 4, ... 40960000, 4096, ) == 0x0
 03362   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 432, ) }, ... 432, ) == 0x0
 03363   896   NtQueryValueKey  (432,  (432, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03364   896   NtClose  (432, ... ) == 0x0
 03365   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03366   896   NtQueryInformationToken  (428, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 03367   896   NtQueryInformationToken  (428, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 03368   896   NtClose  (428, ... ) == 0x0
 03369   896   NtQuerySection  (412, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03370   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03371   896   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 03372   896   NtCreateProcessEx  (1233600, 2035711, 0, -1, 4, 412, 0, 0, 0, ... ) == 0x0
 03373   896   NtSetInformationProcess  (428, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0
 03374   896   NtSetInformationProcess  (428, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03375   896   NtQueryInformationProcess  (428, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=276,ParentPid=1252,}, 0x0, ) == 0x0
 03376   896   NtReadVirtualMemory  (428, 0x7ffd6008, 4, ...  (428, 0x7ffd6008, 4, ... "\0\0\00", 0x0, ) , 0x0, ) == 0x0
 03377   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03378   896   NtReadVirtualMemory  (428, 0x30000000, 4096, ...  (428, 0x30000000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0$\206\244\23`\347\312@`\347\312@`\347\312@9\304\331@b\347\312@`\347\313@d\347\312@\210\370\301@a\347\312@\343\373\304@j\347\312@\210\370\300@I\347\312@6\370\331@h\347\312@\272\304\326@i\347\312@\220\370\301@p\347\312@`\347\312@H\346\312@Rich`\347\312@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0N\23\216?\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\24\0\220\2\0\0\240\0\0\0\0\0\0\232t\0\0\0\20\0\0\0\320\3\0\0\0\00\0\20\0\0\0\20\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0@\3\0\0\20\0\0\237*\3\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\327\211\2\0z\1\0\0\00\3\0\244\12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\236\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0\370\0\0\0\0\20\0\0\270\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\222\216\2\0", 4096, ) , 4096, ) == 0x0
 03379   896   NtReadVirtualMemory  (428, 0x30033000, 256, ...  (428, 0x30033000, 256, ... "\0\0\0\0J\23\216?\0\0\0\0\0\0\3\0\5\0\0\0(\0\0\200\13\0\0\0@\0\0\200\20\0\0\0X\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0e\0\0\0p\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\210\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\240\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\270\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\310\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\330\0\0\0\3600\3\0\26\3\0\0\0\0\0\0\0\0\0\0\104\3\0\254\1\0\0\0\0\0\0\0\0\0\0\2645\3\0\360\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\0\310\200\0\0\0\0\14\0\0\0\0\0f\1", 256, ) , 256, ) == 0x0
 03380   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03381   896   NtQueryInformationProcess  (428, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=276,ParentPid=1252,}, 0x0, ) == 0x0
 03382   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1232552, ... ) }, 1232552, ... ) == 0x0
 03383   896   NtAllocateVirtualMemory  (-1, 0, 0, 2428, 4096, 4, ... 41025536, 4096, ) == 0x0
 03384   896   NtAllocateVirtualMemory  (428, 0, 0, 6464, 4096, 4, ... 65536, 8192, ) == 0x0
 03385   896   NtWriteVirtualMemory  (428, 0x10000,  (428, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6464, ... 0x0, ) , 6464, ... 0x0, ) == 0x0
 03386   896   NtAllocateVirtualMemory  (428, 0, 0, 2428, 4096, 4, ... 131072, 4096, ) == 0x0
 03387   896   NtWriteVirtualMemory  (428, 0x20000,  (428, 0x20000, "\0\20\0\0|\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0&\0\10\2\220\2\0\0B\1\0\0\364\3\366\3\230\4\0\0:\0<\0\220\10\0\0N\0P\0\314\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\0<\0\34\11\0\0\36\0 \0X\11\0\0\0\0\2\0x\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2428, ... 0x0, ) , 2428, ... 0x0, ) == 0x0
 03388   896   NtWriteVirtualMemory  (428, 0x7ffd6010,  (428, 0x7ffd6010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 03389   896   NtAllocateVirtualMemory  (428, 0, 0, 388, 4096, 4, ... 196608, 4096, ) == 0x0
 03390   896   NtWriteVirtualMemory  (428, 0x30000,  (428, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\1\0\0\253\355\15\254\210\255\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 388, ... 0x0, ) , 388, ... 0x0, ) == 0x0
 03391   896   NtWriteVirtualMemory  (428, 0x7ffd61e8,  (428, 0x7ffd61e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 03392   896   NtFreeVirtualMemory  (-1, (0x2720000), 0, 32768, ... (0x2720000), 4096, ) == 0x0
 03393   896   NtAllocateVirtualMemory  (428, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0
 03394   896   NtAllocateVirtualMemory  (428, 1302528, 0, 8192, 4096, 4, ... 1302528, 8192, ) == 0x0
 03395   896   NtProtectVirtualMemory  (428, (0x13e000), 4096, 260, ... (0x13e000), 4096, 4, ) == 0x0
 03396   896   NtCreateThread  (0x1f03ff, 0x0, 428, 1233608, 1233272, 1, ... 432, {276, 1584}, ) == 0x0
 03397   896   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 0, 2147344384, 2008285840, 0}  (24, {168, 196, new_msg, 0, 0, 2147344384, 2008285840, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\257\1\0\0\260\1\0\0\24\1\0\00\6\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\326\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\24\0\10 \0\0" ... {168, 196, reply, 0, 1252, 896, 81874, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\254\1\0\0\260\1\0\0\24\1\0\00\6\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\326\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\24\0\10 \0\0" )  ... {168, 196, reply, 0, 1252, 896, 81874, 0}  (24, {168, 196, new_msg, 0, 0, 2147344384, 2008285840, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\257\1\0\0\260\1\0\0\24\1\0\00\6\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\326\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\24\0\10 \0\0" ... {168, 196, reply, 0, 1252, 896, 81874, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\254\1\0\0\260\1\0\0\24\1\0\00\6\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\326\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\24\0\10 \0\0" )  ) == 0x0
 03398   896   NtResumeThread  (432, ... 1, ) == 0x0
 03399   896   NtClose  (416, ... ) == 0x0
 03400   896   NtClose  (412, ... ) == 0x0
 03401   896   NtClose  (432, ... ) == 0x0
 03402   896   NtWaitForMultipleObjects  (2, (400, 428, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 03403   896   NtWaitForSingleObject  (392, 0, {0, 0}, ... ) == 0x102
 03404   896   NtWaitForMultipleObjects  (2, (400, 428, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 03405   896   NtWaitForSingleObject  (392, 0, {0, 0}, ... ) == 0x102
 03406   896   NtWaitForMultipleObjects  (2, (400, 428, ), 1, 0, {1294967296, -1}, ...
 01304  1168   NtDelayExecution  ... ) == 0x0
 03407  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 01380  2016   NtDelayExecution  ... ) == 0x0
 03408  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 01381   596   NtDelayExecution  ... ) == 0x0
 03409   596   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 432, ) == 0x0
 03410   596   NtCallbackReturn  (0, 0, 0, ...
 03411   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 01382   376   NtDelayExecution  ... ) == 0x0
 01383   420   NtDelayExecution  ... ) == 0x0
 01384   384   NtDelayExecution  ... ) == 0x0
 01385  1028   NtDelayExecution  ... ) == 0x0
 01386  2012   NtDelayExecution  ... ) == 0x0
 03412   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03413   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03414   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03415  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03416  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03417   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03418   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03419   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03407  1168   NtDelayExecution  ... ) == 0x0
 03420  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03412   376   NtDelayExecution  ... ) == 0x0
 03421   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03413   420   NtDelayExecution  ... ) == 0x0
 03422   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03414   384   NtDelayExecution  ... ) == 0x0
 03423   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03415  1028   NtDelayExecution  ... ) == 0x0
 03424  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03416  2012   NtDelayExecution  ... ) == 0x0
 03425  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03408  2016   NtDelayExecution  ... ) == 0x0
 03426  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03419   596   NtDelayExecution  ... ) == 0x0
 03427   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03428   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03429   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03430   596   NtDelayExecution  (0, {-20010000, -1}, ...
 02229   860   NtDelayExecution  ... ) == 0x0
 03431   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 412, ) == 0x0
 03432   860   NtCallbackReturn  (0, 0, 0, ...
 03433   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Regmonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03434   860   NtDelayExecution  (0, {-3000000, -1}, ... ) == 0x0
 03435   860   NtUserFindWindowEx  (0, 0,  (0, 0, "18467-41", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03436   860   NtDelayExecution  (0, {-3000000, -1}, ... ) == 0x0
 03437   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Filemonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03438   860   NtDelayExecution  (0, {-40000000, -1}, ...
 03420  1168   NtDelayExecution  ... ) == 0x0
 03439  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03421   376   NtDelayExecution  ... ) == 0x0
 03440   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03422   420   NtDelayExecution  ... ) == 0x0
 03441   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03423   384   NtDelayExecution  ... ) == 0x0
 03442   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03424  1028   NtDelayExecution  ... ) == 0x0
 03443  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03425  2012   NtDelayExecution  ... ) == 0x0
 03444  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03426  2016   NtDelayExecution  ... ) == 0x0
 03445  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03430   596   NtDelayExecution  ... ) == 0x0
 03446   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03447   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03448   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03449   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03406   896   NtWaitForMultipleObjects  ... ) == 0x0
 03450   896   NtWaitForSingleObject  (392, 0, {0, 0}, ... ) == 0x102
 03451   896   NtWaitForMultipleObjects  (2, (400, 428, ), 1, 0, {1294967296, -1}, ...
 03439  1168   NtDelayExecution  ... ) == 0x0
 03452  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03440   376   NtDelayExecution  ... ) == 0x0
 03453   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03441   420   NtDelayExecution  ... ) == 0x0
 03454   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03442   384   NtDelayExecution  ... ) == 0x0
 03455   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03443  1028   NtDelayExecution  ... ) == 0x0
 03456  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03444  2012   NtDelayExecution  ... ) == 0x0
 03457  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03445  2016   NtDelayExecution  ... ) == 0x0
 03458  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03449   596   NtDelayExecution  ... ) == 0x0
 03459   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03460   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03461   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03462   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03438   860   NtDelayExecution  ... ) == 0x0
 03463   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Regmonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03464   860   NtDelayExecution  (0, {-3000000, -1}, ... ) == 0x0
 03465   860   NtUserFindWindowEx  (0, 0,  (0, 0, "18467-41", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03466   860   NtDelayExecution  (0, {-3000000, -1}, ... ) == 0x0
 03467   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Filemonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03468   860   NtDelayExecution  (0, {-40000000, -1}, ...
 03452  1168   NtDelayExecution  ... ) == 0x0
 03469  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03453   376   NtDelayExecution  ... ) == 0x0
 03470   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03454   420   NtDelayExecution  ... ) == 0x0
 03471   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03455   384   NtDelayExecution  ... ) == 0x0
 03472   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03456  1028   NtDelayExecution  ... ) == 0x0
 03473  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03457  2012   NtDelayExecution  ... ) == 0x0
 03474  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03458  2016   NtDelayExecution  ... ) == 0x0
 03475  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03462   596   NtDelayExecution  ... ) == 0x0
 03476   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03477   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03478   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03479   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03469  1168   NtDelayExecution  ... ) == 0x0
 03480  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03470   376   NtDelayExecution  ... ) == 0x0
 03481   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03471   420   NtDelayExecution  ... ) == 0x0
 03482   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03472   384   NtDelayExecution  ... ) == 0x0
 03483   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03473  1028   NtDelayExecution  ... ) == 0x0
 03484  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03474  2012   NtDelayExecution  ... ) == 0x0
 03485  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03475  2016   NtDelayExecution  ... ) == 0x0
 03486  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03479   596   NtDelayExecution  ... ) == 0x0
 03487   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03488   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03489   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03490   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03468   860   NtDelayExecution  ... ) == 0x0
 03491   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Regmonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03492   860   NtDelayExecution  (0, {-3000000, -1}, ... ) == 0x0
 03493   860   NtUserFindWindowEx  (0, 0,  (0, 0, "18467-41", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03494   860   NtDelayExecution  (0, {-3000000, -1}, ...
 03480  1168   NtDelayExecution  ... ) == 0x0
 03495  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03481   376   NtDelayExecution  ... ) == 0x0
 03496   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03482   420   NtDelayExecution  ... ) == 0x0
 03497   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03483   384   NtDelayExecution  ... ) == 0x0
 03498   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03484  1028   NtDelayExecution  ... ) == 0x0
 03499  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03485  2012   NtDelayExecution  ... ) == 0x0
 03500  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03486  2016   NtDelayExecution  ... ) == 0x0
 03501  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03490   596   NtDelayExecution  ... ) == 0x0
 03502   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03503   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03504   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03505   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03451   896   NtWaitForMultipleObjects  ... ) == 0x0
 03506   896   NtWaitForSingleObject  (392, 0, {0, 0}, ... ) == 0x102
 03507   896   NtWaitForMultipleObjects  (2, (400, 428, ), 1, 0, {1294967296, -1}, ...
 03494   860   NtDelayExecution  ... ) == 0x0
 03508   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Filemonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03509   860   NtDelayExecution  (0, {-40000000, -1}, ...
 03495  1168   NtDelayExecution  ... ) == 0x0
 03510  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03496   376   NtDelayExecution  ... ) == 0x0
 03511   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03497   420   NtDelayExecution  ... ) == 0x0
 03512   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03498   384   NtDelayExecution  ... ) == 0x0
 03513   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03499  1028   NtDelayExecution  ... ) == 0x0
 03514  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03500  2012   NtDelayExecution  ... ) == 0x0
 03515  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03501  2016   NtDelayExecution  ... ) == 0x0
 03516  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03505   596   NtDelayExecution  ... ) == 0x0
 03517   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03518   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03519   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03520   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03510  1168   NtDelayExecution  ... ) == 0x0
 03521  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03511   376   NtDelayExecution  ... ) == 0x0
 03522   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03512   420   NtDelayExecution  ... ) == 0x0
 03523   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03513   384   NtDelayExecution  ... ) == 0x0
 03524   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03514  1028   NtDelayExecution  ... ) == 0x0
 03525  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03515  2012   NtDelayExecution  ... ) == 0x0
 03526  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03516  2016   NtDelayExecution  ... ) == 0x0
 03527  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03520   596   NtDelayExecution  ... ) == 0x0
 03528   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03509   860   NtDelayExecution  ... ) == 0x0
 03529   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Regmonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03530   860   NtDelayExecution  (0, {-3000000, -1}, ...
 03531   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03532   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03533   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03530   860   NtDelayExecution  ... ) == 0x0
 03534   860   NtUserFindWindowEx  (0, 0,  (0, 0, "18467-41", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03535   860   NtDelayExecution  (0, {-3000000, -1}, ... ) == 0x0
 03536   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Filemonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03537   860   NtDelayExecution  (0, {-40000000, -1}, ...
 03521  1168   NtDelayExecution  ... ) == 0x0
 03538  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03522   376   NtDelayExecution  ... ) == 0x0
 03539   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03523   420   NtDelayExecution  ... ) == 0x0
 03540   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03524   384   NtDelayExecution  ... ) == 0x0
 03541   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03525  1028   NtDelayExecution  ... ) == 0x0
 03542  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03526  2012   NtDelayExecution  ... ) == 0x0
 03543  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03527  2016   NtDelayExecution  ... ) == 0x0
 03544  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03533   596   NtDelayExecution  ... ) == 0x0
 03545   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03546   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03547   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03548   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03507   896   NtWaitForMultipleObjects  ... ) == 0x0
 03549   896   NtWaitForSingleObject  (392, 0, {0, 0}, ... ) == 0x102
 03550   896   NtWaitForMultipleObjects  (2, (400, 428, ), 1, 0, {1294967296, -1}, ...
 03538  1168   NtDelayExecution  ... ) == 0x0
 03551  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03539   376   NtDelayExecution  ... ) == 0x0
 03552   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03540   420   NtDelayExecution  ... ) == 0x0
 03553   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03541   384   NtDelayExecution  ... ) == 0x0
 03554   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03542  1028   NtDelayExecution  ... ) == 0x0
 03555  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03543  2012   NtDelayExecution  ... ) == 0x0
 03556  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03544  2016   NtDelayExecution  ... ) == 0x0
 03557  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03548   596   NtDelayExecution  ... ) == 0x0
 03558   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03559   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03560   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03561   596   NtDelayExecution  (0, {-20010000, -1}, ...
 03537   860   NtDelayExecution  ... ) == 0x0
 03562   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Regmonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03563   860   NtDelayExecution  (0, {-3000000, -1}, ... ) == 0x0
 03564   860   NtUserFindWindowEx  (0, 0,  (0, 0, "18467-41", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03565   860   NtDelayExecution  (0, {-3000000, -1}, ... ) == 0x0
 03566   860   NtUserFindWindowEx  (0, 0,  (0, 0, "Filemonclass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03567   860   NtDelayExecution  (0, {-40000000, -1}, ...
 03551  1168   NtDelayExecution  ... ) == 0x0
 03568  1168   NtDelayExecution  (0, {-20010000, -1}, ...
 03552   376   NtDelayExecution  ... ) == 0x0
 03569   376   NtDelayExecution  (0, {-20010000, -1}, ...
 03553   420   NtDelayExecution  ... ) == 0x0
 03570   420   NtDelayExecution  (0, {-20010000, -1}, ...
 03554   384   NtDelayExecution  ... ) == 0x0
 03571   384   NtDelayExecution  (0, {-20010000, -1}, ...
 03555  1028   NtDelayExecution  ... ) == 0x0
 03572  1028   NtDelayExecution  (0, {-20010000, -1}, ...
 03556  2012   NtDelayExecution  ... ) == 0x0
 03573  2012   NtDelayExecution  (0, {-20010000, -1}, ...
 03557  2016   NtDelayExecution  ... ) == 0x0
 03574  2016   NtDelayExecution  (0, {-20010000, -1}, ...
 03561   596   NtDelayExecution  ... ) == 0x0
 03575   596   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03576   596   NtUserFindWindowEx  (0, 0,  (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03577   596   NtUserFindWindowEx  (0, 0,  (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 03578   596   NtDelayExecution  (0, {-20010000, -1}, ...