Summary:
NtAddAtom(>) | 1 | NtDelayExecution(>) | 2 | NtContinue(>) | 6 | NtUserFindExistingCursorIcon(>) | 25 |
NtCallbackReturn(>) | 1 | NtGdiCreateSolidBrush(>) | 2 | NtCreateSemaphore(>) | 6 | NtCreateFile(>) | 29 |
NtCreateProcessEx(>) | 1 | NtGdiHfontCreate(>) | 2 | NtSetInformationThread(>) | 6 | NtFreeVirtualMemory(>) | 31 |
NtDuplicateToken(>) | 1 | NtOpenProcess(>) | 2 | NtUserSystemParametersInfo(>) | 6 | NtOpenProcessTokenEx(>) | 32 |
NtGdiCreateBitmap(>) | 1 | NtQueryInformationJobObject(>) | 2 | NtWaitForMultipleObjects(>) | 6 | NtOpenThreadTokenEx(>) | 32 |
NtGdiCreatePatternBrushInternal(>) | 1 | NtReleaseMutant(>) | 2 | NtOpenProcessToken(>) | 7 | NtUserRegisterClassExWOW(>) | 33 |
NtGdiInit(>) | 1 | NtResumeThread(>) | 2 | NtOpenThreadToken(>) | 7 | NtOpenSection(>) | 38 |
NtGdiQueryFontAssocInfo(>) | 1 | NtTestAlert(>) | 2 | NtQueryVolumeInformationFile(>) | 7 | NtQueryDirectoryFile(>) | 38 |
NtGdiSelectBitmap(>) | 1 | NtUserCloseWindowStation(>) | 2 | NtWaitForSingleObject(>) | 7 | NtQueryInformationProcess(>) | 40 |
NtNotifyChangeKey(>) | 1 | NtUserGetObjectInformation(>) | 2 | NtEnumerateKey(>) | 8 | NtQueryInformationToken(>) | 41 |
NtOpenEvent(>) | 1 | NtUserGetProcessWindowStation(>) | 2 | NtFsControlFile(>) | 8 | NtQueryDefaultLocale(>) | 52 |
NtOpenKeyedEvent(>) | 1 | NtGdiCreateCompatibleDC(>) | 3 | NtSetValueKey(>) | 8 | NtUnmapViewOfSection(>) | 56 |
NtOpenMutant(>) | 1 | NtOpenDirectoryObject(>) | 3 | NtSetInformationFile(>) | 9 | NtOpenFile(>) | 57 |
NtQueryInstallUILanguage(>) | 1 | NtOpenSymbolicLinkObject(>) | 3 | NtUserCallNoParam(>) | 9 | NtQueryVirtualMemory(>) | 63 |
NtQueryObject(>) | 1 | NtQueryInformationThread(>) | 3 | NtUserGetWindowDC(>) | 10 | NtQueryAttributesFile(>) | 66 |
NtQuerySystemTime(>) | 1 | NtQueryPerformanceCounter(>) | 3 | NtUserCallOneParam(>) | 11 | NtQuerySystemInformation(>) | 79 |
NtSecureConnectPort(>) | 1 | NtQuerySymbolicLinkObject(>) | 3 | NtWriteFile(>) | 11 | NtCreateSection(>) | 90 |
NtTerminateThread(>) | 1 | NtReadVirtualMemory(>) | 3 | NtCreateKey(>) | 12 | NtMapViewOfSection(>) | 96 |
NtUserGetDC(>) | 1 | NtRegisterThreadTerminatePort(>) | 3 | NtQueryDefaultUILanguage(>) | 12 | NtFlushInstructionCache(>) | 109 |
NtUserGetGUIThreadInfo(>) | 1 | NtSetInformationObject(>) | 3 | NtQueryInformationFile(>) | 12 | NtAllocateVirtualMemory(>) | 116 |
NtUserGetThreadDesktop(>) | 1 | NtUserRegisterWindowMessage(>) | 3 | NtQueryDebugFilterState(>) | 14 | NtQueryValueKey(>) | 158 |
NtUserOpenWindowStation(>) | 1 | NtCreateMutant(>) | 4 | NtQuerySection(>) | 18 | NtOpenKey(>) | 188 |
NtAccessCheck(>) | 2 | NtDuplicateObject(>) | 4 | NtDeviceIoControlFile(>) | 22 | NtProtectVirtualMemory(>) | 220 |
NtConnectPort(>) | 2 | NtReadFile(>) | 4 | NtRequestWaitReplyPort(>) | 22 | NtClose(>) | 384 |
NtCreateIoCompletion(>) | 2 | NtGdiGetStockObject(>) | 5 | NtCreateEvent(>) | 24 | ||
NtCreateThread(>) | 2 | NtWriteVirtualMemory(>) | 5 |
, ) 9\255!\360\30\304\217OB\337sKf%\1\34\353\250\274|8q\317\25\373\22#\221\21\36\300\17A\250\335\242+\255RM\220{\334g\20R\0j\202[\224\344\313D\11g\256\220\17\220u\6E\307\342\335\231\364\12\7\370E\261\300\17\304\272\205\234 \331\316M\377\233\254\302 ... {status=0x0, info=256}, "x7]\347\343\241.qF\320\310#\224\332\306\2\352\307H,&J\301\324=\265\260c\25`\242\27\322/F\356\213\237"9\255!\360\30\304\217OB\337sKf%\1\34\353\250\274|8q\317\25\373\22#\221\21\36\300\17A\250\335\242+\255RM\220{\334g\20R\0j\202[\224\344\313D\11g\256\220\17\220u\6E\307\342\335\231\364\12\7\370E\261\300\17\304\272\205\234 \331\316M\377\233\254\302"vy\27\12\206^\204C\245O\267\355q\314\2539\203a\322U\273\230\177B\340\304(6\346S\21\355>\276\271\201\301.\354\333\342\12\24FOP\2471\25nw9~\6\313\17XH\342\177x>UY1\353\32\352\6j\227\263r\337\341\207S`\246\35\261, ) , ) == 0x0 01719 896 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "u\3357Rt\1\262G\310\37\7\266\377\233\252\16\375\366W\357\306\2\265\375\366W\357\306\2]m)\374O\243\15\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01720 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01721 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01722 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01723 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01724 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01725 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01726 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01727 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482756, 2, ) }, 0, 0x0, 0, ... -2147482756, 2, ) == 0x0 01728 896 NtSetValueKey (-2147482756, (-2147482756, "Seed", 0, 3, "A\246N:>\0\4\226,7b\233m\312#G\212\311\322M\a}\6C\367\327\301/J\210s\246^\325\356\322{+nC\242\326\345>?\232\273\272\371\355\14\306\260\223\0\215Mc\372P l\3\207\240a\263\245\356\270v:\274JB3K", 80, ... ) , 0, 3, (-2147482756, "Seed", 0, 3, "A\246N:>\0\4\226,7b\233m\312#G\212\311\322M\a}\6C\367\327\301/J\210s\246^\325\356\322{+nC\242\326\345>?\232\273\272\371\355\14\306\260\223\0\215Mc\372P l\3\207\240a\263\245\356\270v:\274JB3K", 80, ... ) , 80, ... ) == 0x0 01729 896 NtClose (-2147482756, ... ) == 0x0 01719 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\260\234\2323\350^\225v/O\220\21\240+\243\251<\274\325X"J\202\244\272|\371\232Y,\35\222yj\35\240\25\246\3444\22\242\260\356\253JZ\13Q\337\223/\274\213Ko*\213^\204\0\343\216\17\30K\213)\3\14+\252z\2638\27d6\230\36\310\330\331\7d\2454\341\250\274\302\317v~\307jH'\3561\276\370\16\335\2408\227\210\307uB\272\275\336\321\317]$\37\360\364\13s\1\312U\203\240\254\271\313\5\253\2527\267<\252}W\23T\351\377\333.\6\371\342\322 \350&K\27\321\364\367\365\316\215\326\1c\230 ew\271^bn\26t\2\30\242\313\312\224\210\262`\205\225;i\4\31\242\2429\377*u\35\241\16\335;\320\254\4\353f\31\305]\307\307\370b\33\371Q\233\10\3170\205\325\16\322t\257]7\311\342\363\374\264\243\240S\222\207\224\2\261\17\33\373\303r\230\205\224\6\234\357]:\347\207\210", ) J\202\244\272|\371\232Y,\35\222yj\35\240\25\246\3444\22\242\260\356\253JZ\13Q\337\223/\274\213Ko*\213^\204\0\343\216\17\30K\213)\3\14+\252z\2638\27d6\230\36\310\330\331\7d\2454\341\250\274\302\317v~\307jH'\3561\276\370\16\335\2408\227\210\307uB\272\275\336\321\317]$\37\360\364\13s\1\312U\203\240\254\271\313\5\253\2527\267<\252}W\23T\351\377\333.\6\371\342\322 \350&K\27\321\364\367\365\316\215\326\1c\230 ew\271^bn\26t\2\30\242\313\312\224\210\262`\205\225;i\4\31\242\2429\377*u\35\241\16\335;\320\254\4\353f\31\305]\307\307\370b\33\371Q\233\10\3170\205\325\16\322t\257]7\311\342\363\374\264\243\240S\222\207\224\2\261\17\33\373\303r\230\205\224\6\234\357]:\347\207\210", ) == 0x0 01730 896 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "u\3357Rt\1\262G\310\37\7\266\377\233\252\16\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2]m)\374O\243\15\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01731 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01732 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01733 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01734 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01735 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01736 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01737 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01738 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482756, 2, ) }, 0, 0x0, 0, ... -2147482756, 2, ) == 0x0 01739 896 NtSetValueKey (-2147482756, (-2147482756, "Seed", 0, 3, "\14\1\221\22\253\231\344\255-\3223\276\260\265\316\356\20\207\230\244\20\372G\12i\355Sr\36\32\365\253\304tum\273\202\250\321]\371hc\352Y`\371#\346-\241\364y{\36\250qY\23\14\257\21\371m\242\334RWs\20\314\273y\205\256Q\324t", 80, ... ) , 0, 3, (-2147482756, "Seed", 0, 3, "\14\1\221\22\253\231\344\255-\3223\276\260\265\316\356\20\207\230\244\20\372G\12i\355Sr\36\32\365\253\304tum\273\202\250\321]\371hc\352Y`\371#\346-\241\364y{\36\250qY\23\14\257\21\371m\242\334RWs\20\314\273y\205\256Q\324t", 80, ... ) , 80, ... ) == 0x0 01740 896 NtClose (-2147482756, ... ) == 0x0 01730 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "?\263\224j\2750\252\300\366\246@du#w\200\13:\354\27\204\21\354\244\366N<\340T\343\332H.8\350\330\354\374\0sN\177\15\326\334\356(\27+\36\22\246}\12\23\2Wl)\16\233\326D\334\322\233\241\333\214^m\224\213_\266\367\20\204@,2e\207\213\361DTc\2\372.\340\236\326\355\350`l\273\5\212\365A\246\233e\203\355S\210\311\2701t\313\234\231\222\336\34k\16\374N\200Z\257\337\342\216\366\275\303\371\310\20c7\252\302\302\357\367u}0\7cr@\301\243\273\250?\241\4|:\263h\205\327\277\10\36"\366\351s\23\70\305q\225n\372\232\200\2F\237\353\34<\237\357s\220\200\177g\17\215(g\222;\341\2579\200\12X\235\220\200\265.7^\236\247\336\25\335\310\377\303\227XC\31\3713\214_\254Y[!\34\235\376\361,\307\250\251/\365xOC\340\255\363J\232\234p\233", ) \366\351s\23\70\305q\225n\372\232\200\2F\237\353\34<\237\357s\220\200\177g\17\215(g\222;\341\2579\200\12X\235\220\200\265.7^\236\247\336\25\335\310\377\303\227XC\31\3713\214_\254Y[!\34\235\376\361,\307\250\251/\365xOC\340\255\363J\232\234p\233", ) == 0x0 01741 896 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "u\3357Rt\1\262G\310\37\7\266\377\233\252\16\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2]m)\374O\243\15\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01742 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01743 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01744 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01745 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01746 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01747 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01748 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01749 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482756, 2, ) }, 0, 0x0, 0, ... -2147482756, 2, ) == 0x0 01750 896 NtSetValueKey (-2147482756, (-2147482756, "Seed", 0, 3, "\37\276\374\222\237e\315\35w%\247\24\213%\354\307\207\211\12\344r?\270\332\16C\321a\271\355"\304\363m\234\253w\220\3707\22\244U9g\201 ;@\245\10\H\354yz[3\373\352B\316\274\253\304\313*v\266<\256\265\367\264\340\331\32\342{\266", 80, ... ) , 0, 3, (-2147482756, "Seed", 0, 3, "\37\276\374\222\237e\315\35w%\247\24\213%\354\307\207\211\12\344r?\270\332\16C\321a\271\355"\304\363m\234\253w\220\3707\22\244U9g\201 ;@\245\10\H\354yz[3\373\352B\316\274\253\304\313*v\266<\256\265\367\264\340\331\32\342{\266", 80, ... ) \304\363m\234\253w\220\3707\22\244U9g\201 ;@\245\10\H\354yz[3\373\352B\316\274\253\304\313*v\266<\256\265\367\264\340\331\32\342{\266", 80, ... ) == 0x0 01751 896 NtClose (-2147482756, ... ) == 0x0 01741 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\357\200\276\216\240?\352\3314kC1EO\216\257\237\201O#\345\373@ZHjX\317S/\214sr\37\253\314\365U\204Z\252\327\314\376\354\262\277\311\227<\225M\325{_\346W\273\212\242\25V?\3110\270\2313\370\210\362\311\17Y\260A-\374\236 e-+\310\356\272\340c\213 \315\342t\273\34\20L\323\374\246u\215\363\275\217\247\262\2\10\250\360P\21@;\360\5l\237\316\23+k\206\232B\252s!\321\247\354`\233\3]\222\332CJ5\371\303+\364\213\271~\12WX\324\370\223m\257L\27C\14\216\275\12\340L\222\224\351\314\256X\223\246\216\275.S\4M\340\321\211\310v\220\246\336\216})}\26\272\3617p\325p\316(\363\36&\343_\225\26!%\265\316\216\362\2\231\344\374\331\261\320\251\350\312\353\270\351<\13\333iX\26m\266\215\220\317R\301X\2\3C\234C\240\275\306\3621t\0\366\273*", ) , ) == 0x0 01752 896 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "u\3357Rt\1\262G\310\37\7\266\377\233\252\16\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2]m)\374O\243\15\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01753 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01754 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01755 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01756 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01757 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01758 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01759 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01760 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482756, 2, ) }, 0, 0x0, 0, ... -2147482756, 2, ) == 0x0 01761 896 NtSetValueKey (-2147482756, (-2147482756, "Seed", 0, 3, "\4\367\264\370\237\375\344\236\253X\271\374\222\2271\361\243\224\35\252~\307\10wl\15\327\347\36\365\355;\3561!\327\237A\241\334W\204\236\10<\30#%\201\315AE\307fs\312\277R\304\16\326\347r\351\215\314:\271\231`\327\27\232\372q\376;\22sD", 80, ... ) , 0, 3, (-2147482756, "Seed", 0, 3, "\4\367\264\370\237\375\344\236\253X\271\374\222\2271\361\243\224\35\252~\307\10wl\15\327\347\36\365\355;\3561!\327\237A\241\334W\204\236\10<\30#%\201\315AE\307fs\312\277R\304\16\326\347r\351\215\314:\271\231`\327\27\232\372q\376;\22sD", 80, ... ) , 80, ... ) == 0x0 01762 896 NtClose (-2147482756, ... ) == 0x0 01752 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\33?/\317\346j\26\221VR\222\22!\2G\314h\311\356\322\362\242KL\274\3510W[\211\10\37va\267\320\333LIe\317T\321\212tIqz^\275\246\276T+\35\34\233=\25&\371S(\6y\314R+v\34\353}\236S\353\367MM3\227\342I\242\23\23G7\243?=\11\363\227A\310\306\2309\207:\260\232y\360gb%-+!N\376\217u\353a-\34\23\233\272\264\20y\200\206\275/\25\205g\327\317k\316~\200\265\266\356\265\202B\300\20\5WUK]\370Q;1\360k\10\20\16y\314\320\250CJ\3\355\314\0\37Y\223l\306\315\270YN='\273\266#\376 h;R)\245\310X~\217\16\340\245y\2659K\36\200\20\243x_g\231P\303\216\271\310\247|\350F\367\200#\5hb\330\221\237\2476\230\337'\256N\21S\311\327\33\32\321\301\256\25\326\241'\202n\13IFp\320\374\300", ) , ) == 0x0 01763 896 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "u\3357Rt\1\262G\310\37\7\266\377\233\252\16\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2\265\375\366W\357\306\2]m)\374O\243\15\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01764 896 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01765 896 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01766 896 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01767 896 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01768 896 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01769 896 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01770 896 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01771 896 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482756, 2, ) }, 0, 0x0, 0, ... -2147482756, 2, ) == 0x0 01772 896 NtSetValueKey (-2147482756, (-2147482756, "Seed", 0, 3, "\352\22[\201\376&\2\343};V\377\300[w\16I\274\335\202\246\214\361\16\321y\354\263\247\33Z;G\2220T\321?\270\317x\373j!Tg\240\2709Qz\272\305\340t\263\306\3A\205\377/\242p\343I\354\300\347\33\256\245\10\213H]\241\347\36\241", 80, ... ) , 0, 3, (-2147482756, "Seed", 0, 3, "\352\22[\201\376&\2\343};V\377\300[w\16I\274\335\202\246\214\361\16\321y\354\263\247\33Z;G\2220T\321?\270\317x\373j!Tg\240\2709Qz\272\305\340t\263\306\3A\205\377/\242p\343I\354\300\347\33\256\245\10\213H]\241\347\36\241", 80, ... ) , 80, ... ) == 0x0 01773 896 NtClose (-2147482756, ... ) == 0x0 01763 896 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "s\2054? \|\217Y\33\373!V\317\377\15\270\2674\251\373l"Z\271\351\244\253\237\337GA|2\262\213\350"r\2036\320(\240\312J\367\347\334]*\245\224@\23_X*A\61\270\261@p!z\3633N\353\33\336n\232{Gi$\354P\371q\250\331`\0\215\247\337Z\317i\357\371\350\20\324\333u\210\311\0\177\250\2029\247C)\202\256\304\205\3566\356p\242\370\240\332]\265\277\[0\225J\353\236\335\262cj\3059X\13b\344\24\342D\377\37\13\303/\362\351\231\35\236\3002^b\247m\365\361\17\235Nq\332\5\236~'\251k\372y\240\7x>\257\322\2310\201\22\332\364\246\267b\354\326\342\364\336\223v6\272\321:\333\275[\303\325\342L\323B+\374[\203\205\250\3404w\356\245G\240\263\317\3705\12\371\335\374\326f\3431\24v\306el\360f\373\320p\13\362\372M\364\235(\356A\241", ) Z\271\351\244\253\237\337GA|2\262\213\350 ... {status=0x0, info=256}, "s\2054? \|\217Y\33\373!V\317\377\15\270\2674\251\373l"Z\271\351\244\253\237\337GA|2\262\213\350"r\2036\320(\240\312J\367\347\334]*\245\224@\23_X*A\61\270\261@p!z\3633N\353\33\336n\232{Gi$\354P\371q\250\331`\0\215\247\337Z\317i\357\371\350\20\324\333u\210\311\0\177\250\2029\247C)\202\256\304\205\3566\356p\242\370\240\332]\265\277\[0\225J\353\236\335\262cj\3059X\13b\344\24\342D\377\37\13\303/\362\351\231\35\236\3002^b\247m\365\361\17\235Nq\332\5\236~'\251k\372y\240\7x>\257\322\2310\201\22\332\364\246\267b\354\326\342\364\336\223v6\272\321:\333\275[\303\325\342L\323B+\374[\203\205\250\3404w\356\245G\240\263\317\3705\12\371\335\374\326f\3431\24v\306el\360f\373\320p\13\362\372M\364\235(\356A\241", ) , ) == 0x0 01774 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 208, ) == 0x0 01775 896 NtConnectPort ( ("\RPC Control\IcaApi", {12, 2, 1, 0}, 0x0, 0x0, 1235200, 188, ... 212, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1235200, 188, ... 212, 0x0, 0x0, 0x0, 188, ) == 0x0 01776 896 NtRequestWaitReplyPort (212, {200, 224, new_msg, 0, 2621478, 1413072, 12, 2} (212, {200, 224, new_msg, 0, 2621478, 1413072, 12, 2} "\0\0\25\0\330\1\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\0\300)\25\0\2\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\374W\353\345p/\267\33\240\217\25\0\\1\24\0\12\0\0\0\0\0\0\0\240\217\25\0(\0\0\0\250\217\25\0\306,\355\357\330\1\24\0(\0\0\0*z\0\0\0\0\24\0\\327\22\0\14\0\0\0\0\0\0\0\10H\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\200\327\22\0\372\31\221|\24\337\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1252, 896, 81852, 0} "\7\0\25\0\330\1\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\300)\25\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\374W\353\345p/\267\33\240\217\25\0\\1\24\0\12\0\0\0\0\0\0\0\240\217\25\0(\0\0\0\250\217\25\0\306,\355\357\330\1\24\0(\0\0\0*z\0\0\0\0\24\0\\327\22\0\14\0\0\0\0\0\0\0\10H\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\200\327\22\0\372\31\221|\24\337\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) ... {200, 224, reply, 0, 1252, 896, 81852, 0} (212, {200, 224, new_msg, 0, 2621478, 1413072, 12, 2} "\0\0\25\0\330\1\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\0\300)\25\0\2\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\374W\353\345p/\267\33\240\217\25\0\\1\24\0\12\0\0\0\0\0\0\0\240\217\25\0(\0\0\0\250\217\25\0\306,\355\357\330\1\24\0(\0\0\0*z\0\0\0\0\24\0\\327\22\0\14\0\0\0\0\0\0\0\10H\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\200\327\22\0\372\31\221|\24\337\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1252, 896, 81852, 0} "\7\0\25\0\330\1\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\300)\25\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\374W\353\345p/\267\33\240\217\25\0\\1\24\0\12\0\0\0\0\0\0\0\240\217\25\0(\0\0\0\250\217\25\0\306,\355\357\330\1\24\0(\0\0\0*z\0\0\0\0\24\0\\327\22\0\14\0\0\0\0\0\0\0\10H\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\200\327\22\0\372\31\221|\24\337\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) ) == 0x0 01777 896 NtAllocateVirtualMemory (-1, 1413120, 0, 4096, 4096, 4, ... 1413120, 4096, ) == 0x0 01778 896 NtRequestWaitReplyPort (212, {32, 56, new_msg, 0, 0, 0, 0, 0} (212, {32, 56, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\0\0\0" ... {124, 148, reply, 0, 1252, 896, 81853, 0} "\2\355\202\367\1\0#\370\364\337 \201\0\0\0\0\350Zh\341\2\0\0\0\320\272i\201\0\0\0\0\0\0\0\0\0\0\0\0\251\371gh\265\363\263C\206\3\320\225\213\324\252\351\10\210\300\263\0\0\0\276\2\0\0\276\2\0\0\364G\210\300\0@\250\300\240(\255\201\264\353\202\367R\250S\200\304\353\202\367\4\0\0\0\0\0\0\0\240(\255\201d\206\254\201\7\0\0\0\304\353\202\367\212\0\0\0" ) ... {124, 148, reply, 0, 1252, 896, 81853, 0} (212, {32, 56, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\0\0\0" ... {124, 148, reply, 0, 1252, 896, 81853, 0} "\2\355\202\367\1\0#\370\364\337 \201\0\0\0\0\350Zh\341\2\0\0\0\320\272i\201\0\0\0\0\0\0\0\0\0\0\0\0\251\371gh\265\363\263C\206\3\320\225\213\324\252\351\10\210\300\263\0\0\0\276\2\0\0\276\2\0\0\364G\210\300\0@\250\300\240(\255\201\264\353\202\367R\250S\200\304\353\202\367\4\0\0\0\0\0\0\0\240(\255\201d\206\254\201\7\0\0\0\304\353\202\367\212\0\0\0" ) ) == 0x0 01779 896 NtRequestWaitReplyPort (212, {44, 68, new_msg, 56, 1252, 896, 81853, 0} (212, {44, 68, new_msg, 56, 1252, 896, 81853, 0} "\1\355\0\0B\2\5\0\364\337 \201\0\0\0\0\350Zh\341\2\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0X\222\25\0\10\5\0\0" ... {40, 64, reply, 0, 1252, 896, 81854, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\300\364\15\0" ) ... {40, 64, reply, 0, 1252, 896, 81854, 0} (212, {44, 68, new_msg, 56, 1252, 896, 81853, 0} "\1\355\0\0B\2\5\0\364\337 \201\0\0\0\0\350Zh\341\2\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0X\222\25\0\10\5\0\0" ... {40, 64, reply, 0, 1252, 896, 81854, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\300\364\15\0" ) ) == 0x0 01780 896 NtRequestWaitReplyPort (212, {64, 88, new_msg, 56, 1413440, 1235776, 1413712, 0} (212, {64, 88, new_msg, 56, 1413440, 1235776, 1413712, 0} "\10\0\0\0@\0\1\1\266\1\0\08\332\22\0X\222\25\0T\337\22\0\30\356\220|p\5\221|\1\0\0\0X\222\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 896, 81855, 0} "\10\0\0\0@\0\1\1\266\1\0\08\332\22\0X\222\25\0T\337\22\0\30\356\220|p\5\221|\1\0\0\0X\222\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ... {64, 88, reply, 56, 1252, 896, 81855, 0} (212, {64, 88, new_msg, 56, 1413440, 1235776, 1413712, 0} "\10\0\0\0@\0\1\1\266\1\0\08\332\22\0X\222\25\0T\337\22\0\30\356\220|p\5\221|\1\0\0\0X\222\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 896, 81855, 0} "\10\0\0\0@\0\1\1\266\1\0\08\332\22\0X\222\25\0T\337\22\0\30\356\220|p\5\221|\1\0\0\0X\222\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01781 896 NtRequestWaitReplyPort (212, {44, 68, new_msg, 56, 1252, 896, 81854, 0} (212, {44, 68, new_msg, 56, 1252, 896, 81854, 0} "\1\31\0\0B\2\5\0\200\300\227|p\31\221|\250$\12\0\330\0\0\0\377\377\377\377\0\300\372\177\1\0\0\0X\222\25\0\10\5\0\0" ... {40, 64, reply, 0, 1252, 896, 81856, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\300\364\15\0" ) ... {40, 64, reply, 0, 1252, 896, 81856, 0} (212, {44, 68, new_msg, 56, 1252, 896, 81854, 0} "\1\31\0\0B\2\5\0\200\300\227|p\31\221|\250$\12\0\330\0\0\0\377\377\377\377\0\300\372\177\1\0\0\0X\222\25\0\10\5\0\0" ... {40, 64, reply, 0, 1252, 896, 81856, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\300\364\15\0" ) ) == 0x0 01782 896 NtRequestWaitReplyPort (212, {64, 88, new_msg, 56, 1413440, 1235776, 1413712, 0} (212, {64, 88, new_msg, 56, 1413440, 1235776, 1413712, 0} "\10\0\0\0@\0\1\1\266\1\0\08\332\22\0X\222\25\0T\337\22\0\30\356\220|p\5\221|\1\0\0\0X\222\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 896, 81857, 0} "\10\0\0\0@\0\1\1\266\1\0\08\332\22\0X\222\25\0T\337\22\0\30\356\220|p\5\221|\1\0\0\0X\222\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ... {64, 88, reply, 56, 1252, 896, 81857, 0} (212, {64, 88, new_msg, 56, 1413440, 1235776, 1413712, 0} "\10\0\0\0@\0\1\1\266\1\0\08\332\22\0X\222\25\0T\337\22\0\30\356\220|p\5\221|\1\0\0\0X\222\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 896, 81857, 0} "\10\0\0\0@\0\1\1\266\1\0\08\332\22\0X\222\25\0T\337\22\0\30\356\220|p\5\221|\1\0\0\0X\222\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01783 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 216, ) }, ... 216, ) == 0x0 01784 896 NtOpenKey (0x20019, {24, 216, 0x40, 0, 0, (0x20019, {24, 216, 0x40, 0, 0, "ActiveComputerName"}, ... 220, ) }, ... 220, ) == 0x0 01785 896 NtQueryValueKey (220, (220, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (220, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (220, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0 01786 896 NtClose (220, ... ) == 0x0 01787 896 NtClose (216, ... ) == 0x0 01788 896 NtCreateIoCompletion (0x1f0003, 0x0, 0, ... 216, ) == 0x0 01789 896 NtCreateIoCompletion (0x1f0003, 0x0, -1, ... 220, ) == 0x0 01790 896 NtDuplicateObject (-1, 216, -1, 0x0, 0, 2, ... 224, ) == 0x0 01791 896 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01792 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 228, ) == 0x0 01793 896 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01794 896 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 01795 896 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1235236, (0xc0100080, {24, 0, 0x40, 0, 1235236, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 232, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 232, {status=0x0, info=1}, ) == 0x0 01796 896 NtSetInformationFile (232, 1235292, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0 01797 896 NtSetInformationFile (232, 1235280, 8, Completion, ... {status=0x0, info=0}, ) == 0x0 01798 896 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 01799 896 NtWriteFile (232, 201, 0, 0, (232, 201, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0 01800 896 NtReadFile (232, 201, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, (232, 201, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20l+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0 01801 896 NtFsControlFile (232, 201, 0x0, 0x0, 0x11c017, (232, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\337\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20l+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68}, (232, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\337\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20l+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103 01802 896 NtFsControlFile (232, 201, 0x0, 0x0, 0x11c017, (232, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301\1\0\0\0\1\0\0\0,\0.\0\240\342\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48}, (232, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301\1\0\0\0\1\0\0\0,\0.\0\240\342\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301\0\0\0\0", ) , ) == 0x103 01803 896 NtFsControlFile (232, 201, 0x0, 0x0, 0x11c017, (232, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20{\25\0\1\0\0\0\34{\25\0 \0\0\0\1\0\0\0\16\0\20\0({\25\08{\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\320\235\25\0\1\0\0\0\1\0\16\0\340\235\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180}, (232, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0+l\324\331\240\355$O\265\302\336\15\221\33\235\301", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20{\25\0\1\0\0\0\34{\25\0 \0\0\0\1\0\0\0\16\0\20\0({\25\08{\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\320\235\25\0\1\0\0\0\1\0\16\0\340\235\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103 01804 896 NtClose (228, ... ) == 0x0 01805 896 NtClose (232, ... ) == 0x0 01806 896 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01807 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 232, ) == 0x0 01808 896 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01809 896 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 01810 896 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1235208, (0xc0100080, {24, 0, 0x40, 0, 1235208, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 228, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 228, {status=0x0, info=1}, ) == 0x0 01811 896 NtSetInformationFile (228, 1235264, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0 01812 896 NtSetInformationFile (228, 1235252, 8, Completion, ... {status=0x0, info=0}, ) == 0x0 01813 896 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 01814 896 NtWriteFile (228, 201, 0, 0, (228, 201, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0 01815 896 NtReadFile (228, 201, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, (228, 201, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0 01816 896 NtFsControlFile (228, 201, 0x0, 0x0, 0x11c017, (228, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\337\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68}, (228, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\337\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103 01817 896 NtFsControlFile (228, 201, 0x0, 0x0, 0x11c017, (228, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<\1\0\0\0\1\0\0\0,\0.\0\240\342\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48}, (228, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<\1\0\0\0\1\0\0\0,\0.\0\240\342\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<\0\0\0\0", ) , ) == 0x103 01818 896 NtFsControlFile (228, 201, 0x0, 0x0, 0x11c017, (228, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20{\25\0\1\0\0\0\34{\25\0 \0\0\0\1\0\0\0\16\0\20\0({\25\08{\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\320\235\25\0\1\0\0\0\1\0\16\0\340\235\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180}, (228, 201, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0}mu\16z\340\205F\261\331XV8&?<", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20{\25\0\1\0\0\0\34{\25\0 \0\0\0\1\0\0\0\16\0\20\0({\25\08{\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\320\235\25\0\1\0\0\0\1\0\16\0\340\235\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103 01819 896 NtClose (232, ... ) == 0x0 01820 896 NtClose (228, ... ) == 0x0 01821 896 NtOpenProcessToken (-1, 0x20008, ... 228, ) == 0x0 01822 896 NtQueryInformationToken (228, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL 01823 896 NtQueryInformationToken (228, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0 01824 896 NtOpenDirectoryObject (0x2, {24, 0, 0x40, 0, 0, (0x2, {24, 0, 0x40, 0, 0, "\Windows\WindowStations"}, ... 232, ) }, ... 232, ) == 0x0 01825 896 NtUserOpenWindowStation ({24, 232, 0x40, 0, 0, ({24, 232, 0x40, 0, 0, "winsta0"}, 0x37f, ... ) }, 0x37f, ... ) == 0xec 01826 896 NtClose (232, ... ) == 0x0 01827 896 NtUserCloseWindowStation (236, ... 01828 896 NtClose (236, ... ) == 0x0 01827 896 NtUserCloseWindowStation ... ) == 0x1 01829 896 NtClose (228, ... ) == 0x0 01830 896 NtCreateEvent (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 228, ) == 0x0 01831 896 NtCreateEvent (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 236, ) == 0x0 01832 896 NtCreateMutant (0x1f0001, {24, 0, 0x2, 0, 0, 0x0}, 0, ... 232, ) == 0x0 01833 896 NtDuplicateObject (-1, -1, -1, 0x1f0fff, 2, 0, ... 240, ) == 0x0 01834 896 NtCreateSection (0xf0007, {24, 0, 0x2, 0, 0, 0x0}, {7248, 0}, 4, 134217728, 0, ... 244, ) == 0x0 01835 896 NtMapViewOfSection (244, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b10000), {0, 0}, 8192, ) == 0x0 01836 896 NtQueryDefaultUILanguage (1235900, ... 01837 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01838 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482756, ) == 0x0 01839 896 NtQueryInformationToken (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01840 896 NtClose (-2147482756, ... ) == 0x0 01841 896 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0 01842 896 NtOpenKey (0x80000000, {24, -2147482756, 0x240, 0, 0, (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01843 896 NtOpenKey (0x80000000, {24, -2147482756, 0x640, 0, 0, (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0 01844 896 NtQueryValueKey (-2147481452, (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01845 896 NtClose (-2147481452, ... ) == 0x0 01846 896 NtClose (-2147482756, ... ) == 0x0 01836 896 NtQueryDefaultUILanguage ... ) == 0x0 01847 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01848 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01849 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1234144, ... ) }, 1234144, ... ) == 0x0 01850 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1232916, ... ) }, 1232916, ... ) == 0x0 01851 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01852 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01853 896 NtCreateFile (0x10100080, {24, 0, 0x40, 0, 1235252, (0x10100080, {24, 0, 0x40, 0, 1235252, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\175f_appcompat.txt"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ... 01854 896 NtQueryDirectoryFile (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0 01855 896 NtClose (-2147482756, ... ) == 0x0 01856 896 NtQueryDirectoryFile (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 01857 896 NtClose (-2147482756, ... ) == 0x0 01858 896 NtQueryDirectoryFile (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 01859 896 NtClose (-2147482756, ... ) == 0x0 01853 896 NtCreateFile ... 248, {status=0x0, info=2}, ) == 0x0 01860 896 NtClose (248, ... ) == 0x0 01861 896 NtCreateSection (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 248, ) == 0x0 01862 896 NtMapViewOfSection (248, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0x1c90000), 0x0, 4194304, ) == 0x0 01863 896 NtAllocateVirtualMemory (-1, 29949952, 0, 1, 4096, 4, ... 29949952, 4096, ) == 0x0 01864 896 NtAllocateVirtualMemory (-1, 29954048, 0, 4240, 4096, 4, ... 29954048, 8192, ) == 0x0 01865 896 NtCreateSection (0xf0007, 0x0, {30908, 0}, 4, 134217728, 0, ... 252, ) == 0x0 01866 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01867 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01868 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01869 896 NtClose (248, ... ) == 0x0 01870 896 NtUnmapViewOfSection (-1, 0x1c90000, ... ) == 0x0 01871 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01872 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01873 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01874 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01875 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01876 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01877 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01878 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01879 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01880 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01881 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01882 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01883 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01884 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01885 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01886 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01887 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01888 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01889 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01890 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01891 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01892 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01893 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01894 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01895 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01896 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01897 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01898 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01899 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01900 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01901 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01902 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01903 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01904 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01905 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01906 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01907 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01908 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01909 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01910 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01911 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01912 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01913 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01914 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01915 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01916 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01917 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01918 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01919 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01920 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01921 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01922 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01923 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01924 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01925 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01926 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01927 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01928 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01929 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01930 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 32768, ) == 0x0 01931 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01932 896 NtClose (252, ... ) == 0x0 01933 896 NtQueryInformationProcess (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0 01934 896 NtOpenFile (0x100080, {24, 0, 0x40, 0, 0, (0x100080, {24, 0, 0x40, 0, 0, "\??\u:"}, 3, 96, ... 252, {status=0x0, info=1}, ) }, 3, 96, ... 252, {status=0x0, info=1}, ) == 0x0 01935 896 NtOpenSymbolicLinkObject (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\??\u:"}, ... 248, ) }, ... 248, ) == 0x0 01936 896 NtQuerySymbolicLinkObject (248, ... (248, ... "\Device\WinDfs\U:0000000000009f43", 66, ) , 66, ) == 0x0 01937 896 NtClose (248, ... ) == 0x0 01938 896 NtQueryVolumeInformationFile (252, 1234468, 8, Device, ... {status=0x0, info=8}, ) == 0x0 01939 896 NtClose (252, ... ) == 0x0 01940 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1233264, ... ) }, 1233264, ... ) == 0x0 01941 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0 01942 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 252, ... 248, ) == 0x0 01943 896 NtClose (252, ... ) == 0x0 01944 896 NtMapViewOfSection (248, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1b20000), 0x0, 126976, ) == 0x0 01945 896 NtClose (248, ... ) == 0x0 01946 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01947 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1233572, ... ) }, 1233572, ... ) == 0x0 01948 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 248, {status=0x0, info=1}, ) }, 5, 96, ... 248, {status=0x0, info=1}, ) == 0x0 01949 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 248, ... 252, ) == 0x0 01950 896 NtQuerySection (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01951 896 NtClose (248, ... ) == 0x0 01952 896 NtMapViewOfSection (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0 01953 896 NtClose (252, ... ) == 0x0 01954 896 NtProtectVirtualMemory (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0 01955 896 NtProtectVirtualMemory (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0 01956 896 NtFlushInstructionCache (-1, 2008289280, 524, ... ) == 0x0 01957 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01958 896 NtAllocateVirtualMemory (-1, 1417216, 0, 12288, 4096, 4, ... 1417216, 12288, ) == 0x0 01959 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1234960, ... ) }, 1234960, ... ) == 0x0 01960 896 NtCreateFile (0x40100080, {24, 0, 0x40, 0, 1234968, (0x40100080, {24, 0, 0x40, 0, 1234968, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\175f_appcompat.txt"}, 0x0, 128, 0, 5, 96, 0, 0, ... }, 0x0, 128, 0, 5, 96, 0, 0, ... 01961 896 NtClose (-2147482756, ... ) == 0x0 01962 896 NtQueryDirectoryFile (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0 01963 896 NtClose (-2147482756, ... ) == 0x0 01964 896 NtQueryDirectoryFile (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 01965 896 NtClose (-2147482756, ... ) == 0x0 01966 896 NtQueryDirectoryFile (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, (-2147482756, 0, 0, 0, -518782976, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 01967 896 NtClose (-2147482756, ... ) == 0x0 01960 896 NtCreateFile ... 252, {status=0x0, info=3}, ) == 0x0 01968 896 NtAllocateVirtualMemory (-1, 1429504, 0, 12288, 4096, 4, ... 1429504, 12288, ) == 0x0 01969 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 248, {status=0x0, info=1}, ) }, 3, 16417, ... 248, {status=0x0, info=1}, ) == 0x0 01970 896 NtQueryDirectoryFile (248, 0, 0, 0, 1233672, 616, BothDirectory, 1, (248, 0, 0, 0, 1233672, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0 01971 896 NtWriteFile (252, 0, 0, 0, (252, 0, 0, 0, "\377\376", 2, 0x0, 0, ... {status=0x0, info=2}, ) , 2, 0x0, 0, ... {status=0x0, info=2}, ) == 0x0 01972 896 NtWriteFile (252, 0, 0, 0, (252, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \01\0.\00\0 (252, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \0U\0T\0F\0-\01\06\0 (252, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) , 106, 0x0, 0, ... {status=0x0, info=106}, ) == 0x0 01973 896 NtWriteFile (252, 0, 0, 0, (252, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (252, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (252, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) , 122, 0x0, 0, ... {status=0x0, info=122}, ) == 0x0 01974 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1234052, ... ) }, 1234052, ... ) == 0x0 01975 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work"}, 3, 16417, ... 256, {status=0x0, info=1}, ) }, 3, 16417, ... 256, {status=0x0, info=1}, ) == 0x0 01976 896 NtQueryDirectoryFile (256, 0, 0, 0, 1233664, 592, Directory, 1, (256, 0, 0, 0, 1233664, 592, Directory, 1, "packed.exe", 0, ... {status=0x0, info=84}, ) , 0, ... {status=0x0, info=84}, ) == 0x0 01977 896 NtClose (256, ... ) == 0x0 01978 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01979 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01980 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1232584, ... ) }, 1232584, ... ) == 0x0 01981 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1231356, ... ) }, 1231356, ... ) == 0x0 01982 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01983 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01984 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 256, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 256, {status=0x0, info=1}, ) == 0x0 01985 896 NtQueryInformationFile (256, 1234140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 01986 896 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 256, ... 260, ) == 0x0 01987 896 NtMapViewOfSection (260, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1b20000), 0x0, 212992, ) == 0x0 01988 896 NtUnmapViewOfSection (-1, 0x1b20000, ... ) == 0x0 01989 896 NtClose (260, ... ) == 0x0 01990 896 NtClose (256, ... ) == 0x0 01991 896 NtWriteFile (252, 0, 0, 0, (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \02\01\00\04\03\02\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\06\05\0F\06\0B\07\03\0D\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \0W\0I\0N\03\02\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\00\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\02\00\00\00\0A\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\01\00\04\03\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\06\05\0F\06\0B\07\03\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\02\00\00\00\0A\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\05\0/\02\05\0/\02\00\05\05\0 \01\08\0:\01\00\0:\04\00\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... , 418, 0x0, 0, ... 01992 896 NtContinue (-135750188, 0, ... 01991 896 NtWriteFile ... {status=0x0, info=418}, ) == 0x0 01993 896 NtQueryDirectoryFile (248, 0, 0, 0, 1433648, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES 01994 896 NtClose (248, ... ) == 0x0 01995 896 NtWriteFile (252, 0, 0, 0, (252, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0", 16, 0x0, 0, ... {status=0x0, info=16}, ) , 16, 0x0, 0, ... {status=0x0, info=16}, ) == 0x0 01996 896 NtClose (252, ... ) == 0x0 01997 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1234960, ... ) }, 1234960, ... ) == 0x0 01998 896 NtCreateFile (0x40100080, {24, 0, 0x40, 0, 1234968, (0x40100080, {24, 0, 0x40, 0, 1234968, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\175f_appcompat.txt"}, 0x0, 128, 0, 3, 96, 0, 0, ... 252, {status=0x0, info=1}, ) }, 0x0, 128, 0, 3, 96, 0, 0, ... 252, {status=0x0, info=1}, ) == 0x0 01999 896 NtQueryInformationFile (252, 1234992, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02000 896 NtSetInformationFile (252, 1235024, 8, Position, ... {status=0x0, info=0}, ) == 0x0 02001 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 248, {status=0x0, info=1}, ) }, 3, 16417, ... 248, {status=0x0, info=1}, ) == 0x0 02002 896 NtQueryDirectoryFile (248, 0, 0, 0, 1233672, 616, BothDirectory, 1, (248, 0, 0, 0, 1233672, 616, BothDirectory, 1, "kernel32.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0 02003 896 NtWriteFile (252, 0, 0, 0, (252, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (252, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (252, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) , 126, 0x0, 0, ... {status=0x0, info=126}, ) == 0x0 02004 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1234024, ... ) }, 1234024, ... ) == 0x0 02005 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 3, 16417, ... 256, {status=0x0, info=1}, ) }, 3, 16417, ... 256, {status=0x0, info=1}, ) == 0x0 02006 896 NtQueryDirectoryFile (256, 0, 0, 0, 1233664, 592, Directory, 1, (256, 0, 0, 0, 1233664, 592, Directory, 1, "kernel32.dll", 0, ... {status=0x0, info=88}, ) , 0, ... {status=0x0, info=88}, ) == 0x0 02007 896 NtClose (256, ... ) == 0x0 02008 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02009 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02010 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1232584, ... ) }, 1232584, ... ) == 0x0 02011 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1231356, ... ) }, 1231356, ... ) == 0x0 02012 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02013 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02014 896 NtQueryDefaultLocale (1, 1233544, ... ) == 0x0 02015 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02016 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02017 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1232576, ... ) }, 1232576, ... ) == 0x0 02018 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1231348, ... ) }, 1231348, ... ) == 0x0 02019 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02020 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02021 896 NtQueryDefaultLocale (1, 1233536, ... ) == 0x0 02022 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 256, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 256, {status=0x0, info=1}, ) == 0x0 02023 896 NtQueryInformationFile (256, 1234140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02024 896 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 256, ... 260, ) == 0x0 02025 896 NtMapViewOfSection (260, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1c90000), 0x0, 987136, ) == 0x0 02026 896 NtUnmapViewOfSection (-1, 0x1c90000, ... ) == 0x0 02027 896 NtClose (260, ... ) == 0x0 02028 896 NtClose (256, ... ) == 0x0 02029 896 NtQueryDefaultUILanguage (1233496, ... 02030 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02031 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482756, ) == 0x0 02032 896 NtQueryInformationToken (-2147482756, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02033 896 NtClose (-2147482756, ... ) == 0x0 02034 896 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0 02035 896 NtOpenKey (0x80000000, {24, -2147482756, 0x240, 0, 0, (0x80000000, {24, -2147482756, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02036 896 NtOpenKey (0x80000000, {24, -2147482756, 0x640, 0, 0, (0x80000000, {24, -2147482756, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0 02037 896 NtQueryValueKey (-2147481452, (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02038 896 NtClose (-2147481452, ... ) == 0x0 02039 896 NtClose (-2147482756, ... ) == 0x0 02029 896 NtQueryDefaultUILanguage ... ) == 0x0 02040 896 NtWriteFile (252, 0, 0, 0, (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \09\08\04\05\07\06\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \00\0x\0F\00\0B\03\03\01\0F\06\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0 (252, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) == 0x0 02041 896 NtQueryDirectoryFile (248, 0, 0, 0, 1436168, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES 02042 896 NtClose (248, ... ) == 0x0 02043 896 NtWriteFile (252, 0, 0, 0, (252, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0<\0/\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 42, 0x0, 0, ... {status=0x0, info=42}, ) , 42, 0x0, 0, ... {status=0x0, info=42}, ) == 0x0 02044 896 NtClose (252, ... ) == 0x0 02045 896 NtUnmapViewOfSection (-1, 0x77b40000, ... ) == 0x0 02046 896 NtQueryInformationJobObject (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED 02047 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1232232, ... ) }, 1232232, ... ) == 0x0 02048 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1232968, ... ) }, 1232968, ... ) == 0x0 02049 896 NtOpenFile (0x1000a1, {24, 0, 0x40, 0, 0, (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0 02050 896 NtCreateSection (0xf001f, 0x0, 0x0, 16, 16777216, 252, ... 248, ) == 0x0 02051 896 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02052 896 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 256, ) }, ... 256, ) == 0x0 02053 896 NtQueryValueKey (256, (256, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02054 896 NtClose (256, ... ) == 0x0 02055 896 NtQueryVolumeInformationFile (252, 1232244, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02056 896 NtOpenMutant (0x120001, {24, 48, 0x0, 0, 0, (0x120001, {24, 48, 0x0, 0, 0, "ShimCacheMutex"}, ... 256, ) }, ... 256, ) == 0x0 02057 896 NtWaitForSingleObject (256, 0, {-1000000, -1}, ... ) == 0x0 02058 896 NtOpenSection (0x2, {24, 48, 0x0, 0, 0, (0x2, {24, 48, 0x0, 0, 0, "ShimSharedMemory"}, ... 260, ) }, ... 260, ) == 0x0 02059 896 NtMapViewOfSection (260, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b20000), {0, 0}, 57344, ) == 0x0 02060 896 NtReleaseMutant (256, ... 0x0, ) == 0x0 02061 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1230176, ... ) }, 1230176, ... ) == 0x0 02062 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 264, {status=0x0, info=1}, ) }, 5, 96, ... 264, {status=0x0, info=1}, ) == 0x0 02063 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 264, ... 268, ) == 0x0 02064 896 NtClose (264, ... ) == 0x0 02065 896 NtMapViewOfSection (268, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1b30000), 0x0, 126976, ) == 0x0 02066 896 NtClose (268, ... ) == 0x0 02067 896 NtUnmapViewOfSection (-1, 0x1b30000, ... ) == 0x0 02068 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1230484, ... ) }, 1230484, ... ) == 0x0 02069 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 268, {status=0x0, info=1}, ) }, 5, 96, ... 268, {status=0x0, info=1}, ) == 0x0 02070 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 268, ... 264, ) == 0x0 02071 896 NtQuerySection (264, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02072 896 NtClose (268, ... ) == 0x0 02073 896 NtMapViewOfSection (264, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0 02074 896 NtClose (264, ... ) == 0x0 02075 896 NtProtectVirtualMemory (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0 02076 896 NtProtectVirtualMemory (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0 02077 896 NtFlushInstructionCache (-1, 2008289280, 524, ... ) == 0x0 02078 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02079 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 264, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 264, {status=0x0, info=1}, ) == 0x0 02080 896 NtQueryInformationFile (264, 1230500, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02081 896 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 264, ... 268, ) == 0x0 02082 896 NtMapViewOfSection (268, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1c90000), 0x0, 1191936, ) == 0x0 02083 896 NtQueryInformationFile (264, 1230600, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02084 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02085 896 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 02086 896 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 02087 896 NtOpenKey (0x101, {24, 0, 0x40, 0, 0, (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02088 896 NtOpenKey (0x101, {24, 0, 0x40, 0, 0, (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 272, ) }, ... 272, ) == 0x0 02089 896 NtQueryValueKey (272, (272, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (272, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02090 896 NtClose (272, ... ) == 0x0 02091 896 NtCreateFile (0x120116, {24, 0, 0x40, 0, 0, (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02092 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02093 896 NtQueryDirectoryFile (272, 0, 0, 0, 1228196, 616, BothDirectory, 1, (272, 0, 0, 0, 1228196, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02094 896 NtClose (272, ... ) == 0x0 02095 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02096 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02097 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228572, ... ) }, 1228572, ... ) == 0x0 02098 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02099 896 NtQueryDirectoryFile (272, 0, 0, 0, 1228000, 616, BothDirectory, 1, (272, 0, 0, 0, 1228000, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02100 896 NtClose (272, ... ) == 0x0 02101 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02102 896 NtQueryDirectoryFile (272, 0, 0, 0, 1228000, 616, BothDirectory, 1, (272, 0, 0, 0, 1228000, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02103 896 NtClose (272, ... ) == 0x0 02104 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02105 896 NtQueryDirectoryFile (272, 0, 0, 0, 1228000, 616, BothDirectory, 1, (272, 0, 0, 0, 1228000, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02106 896 NtClose (272, ... ) == 0x0 02107 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02108 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02109 896 NtQueryInformationProcess (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0 02110 896 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02111 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02112 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 272, ) == 0x0 02113 896 NtQueryInformationToken (272, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02114 896 NtClose (272, ... ) == 0x0 02115 896 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02116 896 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02117 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1229404, ... ) }, 1229404, ... ) == 0x0 02118 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02119 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02120 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228272, ... ) }, 1228272, ... ) == 0x0 02121 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 272, {status=0x0, info=1}, ) }, 5, 96, ... 272, {status=0x0, info=1}, ) == 0x0 02122 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 272, ... 276, ) == 0x0 02123 896 NtClose (272, ... ) == 0x0 02124 896 NtMapViewOfSection (276, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1b30000), 0x0, 180224, ) == 0x0 02125 896 NtClose (276, ... ) == 0x0 02126 896 NtUnmapViewOfSection (-1, 0x1b30000, ... ) == 0x0 02127 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227868, ... ) }, 1227868, ... ) == 0x0 02128 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1228612, (0x80100080, {24, 0, 0x40, 0, 1228612, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 276, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 276, {status=0x0, info=1}, ) == 0x0 02129 896 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 276, ... 272, ) == 0x0 02130 896 NtClose (276, ... ) == 0x0 02131 896 NtMapViewOfSection (272, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x1b30000), {0, 0}, 180224, ) == 0x0 02132 896 NtClose (272, ... ) == 0x0 02133 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02134 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02135 896 NtQueryDefaultLocale (1, 1229232, ... ) == 0x0 02136 896 NtQueryVirtualMemory (-1, 0x1b30000, Basic, 28, ... {BaseAddress=0x1b30000,AllocationBase=0x1b30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02137 896 NtQueryVirtualMemory (-1, 0x1b30000, Basic, 28, ... {BaseAddress=0x1b30000,AllocationBase=0x1b30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02138 896 NtUnmapViewOfSection (-1, 0x1b30000, ... ) == 0x0 02139 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02140 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02141 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228264, ... ) }, 1228264, ... ) == 0x0 02142 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 272, {status=0x0, info=1}, ) }, 5, 96, ... 272, {status=0x0, info=1}, ) == 0x0 02143 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 272, ... 276, ) == 0x0 02144 896 NtClose (272, ... ) == 0x0 02145 896 NtMapViewOfSection (276, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1b30000), 0x0, 180224, ) == 0x0 02146 896 NtClose (276, ... ) == 0x0 02147 896 NtUnmapViewOfSection (-1, 0x1b30000, ... ) == 0x0 02148 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227860, ... ) }, 1227860, ... ) == 0x0 02149 896 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1228604, (0x80100080, {24, 0, 0x40, 0, 1228604, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 276, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 276, {status=0x0, info=1}, ) == 0x0 02150 896 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 276, ... 272, ) == 0x0 02151 896 NtClose (276, ... ) == 0x0 02152 896 NtMapViewOfSection (272, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x1b30000), {0, 0}, 180224, ) == 0x0 02153 896 NtClose (272, ... ) == 0x0 02154 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02155 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02156 896 NtQueryDefaultLocale (1, 1229224, ... ) == 0x0 02157 896 NtQueryVirtualMemory (-1, 0x1b30000, Basic, 28, ... {BaseAddress=0x1b30000,AllocationBase=0x1b30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02158 896 NtUnmapViewOfSection (-1, 0x1b30000, ... ) == 0x0 02159 896 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02160 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02161 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 272, ) == 0x0 02162 896 NtQueryInformationToken (272, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02163 896 NtClose (272, ... ) == 0x0 02164 896 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02165 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02166 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02167 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1229824, ... ) }, 1229824, ... ) == 0x0 02168 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02169 896 NtQueryDirectoryFile (272, 0, 0, 0, 1229252, 616, BothDirectory, 1, (272, 0, 0, 0, 1229252, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02170 896 NtClose (272, ... ) == 0x0 02171 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02172 896 NtQueryDirectoryFile (272, 0, 0, 0, 1229252, 616, BothDirectory, 1, (272, 0, 0, 0, 1229252, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02173 896 NtClose (272, ... ) == 0x0 02174 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02175 896 NtQueryDirectoryFile (272, 0, 0, 0, 1229252, 616, BothDirectory, 1, (272, 0, 0, 0, 1229252, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02176 896 NtClose (272, ... ) == 0x0 02177 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02178 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02179 896 NtWaitForSingleObject (256, 0, {-1000000, -1}, ... ) == 0x0 02180 896 NtReleaseMutant (256, ... 0x0, ) == 0x0 02181 896 NtUnmapViewOfSection (-1, 0x1c90000, ... ) == 0x0 02182 896 NtClose (268, ... ) == 0x0 02183 896 NtClose (264, ... ) == 0x0 02184 896 NtOpenThreadToken (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN 02185 896 NtOpenProcessToken (-1, 0xa, ... 264, ) == 0x0 02186 896 NtQueryInformationToken (264, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 02187 896 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02188 896 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 268, ) }, ... 268, ) == 0x0 02189 896 NtQueryValueKey (268, (268, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (268, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 02190 896 NtQueryValueKey (268, (268, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (268, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02191 896 NtClose (268, ... ) == 0x0 02192 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02193 896 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 268, ) }, ... 268, ) == 0x0 02194 896 NtQueryValueKey (268, (268, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02195 896 NtClose (268, ... ) == 0x0 02196 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02197 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02198 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02199 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02200 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02201 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02202 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02203 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02204 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02205 896 NtQueryDefaultLocale (1, 1231672, ... ) == 0x0 02206 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 268, ) }, ... 268, ) == 0x0 02207 896 NtEnumerateKey (268, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (268, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0 02208 896 NtOpenKey (0x20019, {24, 268, 0x40, 0, 0, (0x20019, {24, 268, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 272, ) }, ... 272, ) == 0x0 02209 896 NtQueryValueKey (272, (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0 02210 896 NtQueryValueKey (272, (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02211 896 NtClose (272, ... ) == 0x0 02212 896 NtEnumerateKey (268, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES 02213 896 NtClose (268, ... ) == 0x0 02214 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 268, ) }, ... 268, ) == 0x0 02215 896 NtEnumerateKey (268, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (268, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0 02216 896 NtOpenKey (0x20019, {24, 268, 0x40, 0, 0, (0x20019, {24, 268, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 272, ) }, ... 272, ) == 0x0 02217 896 NtQueryValueKey (272, (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0 02218 896 NtQueryValueKey (272, (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02219 896 NtQueryValueKey (272, (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02220 896 NtQueryValueKey (272, (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02221 896 NtClose (272, ... ) == 0x0 02222 896 NtEnumerateKey (268, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (268, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0 02223 896 NtOpenKey (0x20019, {24, 268, 0x40, 0, 0, (0x20019, {24, 268, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 272, ) }, ... 272, ) == 0x0 02224 896 NtQueryValueKey (272, (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0 02225 896 NtQueryValueKey (272, (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02226 896 NtQueryValueKey (272, (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02227 896 NtQueryValueKey (272, (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02228 896 NtClose (272, ... ) == 0x0 02229 896 NtEnumerateKey (268, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (268, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0 02230 896 NtOpenKey (0x20019, {24, 268, 0x40, 0, 0, (0x20019, {24, 268, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 272, ) }, ... 272, ) == 0x0 02231 896 NtQueryValueKey (272, (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0 02232 896 NtQueryValueKey (272, (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02233 896 NtQueryValueKey (272, (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02234 896 NtQueryValueKey (272, (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02235 896 NtClose (272, ... ) == 0x0 02236 896 NtEnumerateKey (268, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (268, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0 02237 896 NtOpenKey (0x20019, {24, 268, 0x40, 0, 0, (0x20019, {24, 268, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 272, ) }, ... 272, ) == 0x0 02238 896 NtQueryValueKey (272, (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0 02239 896 NtQueryValueKey (272, (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02240 896 NtQueryValueKey (272, (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02241 896 NtQueryValueKey (272, (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02242 896 NtClose (272, ... ) == 0x0 02243 896 NtEnumerateKey (268, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (268, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0 02244 896 NtOpenKey (0x20019, {24, 268, 0x40, 0, 0, (0x20019, {24, 268, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 272, ) }, ... 272, ) == 0x0 02245 896 NtQueryValueKey (272, (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (272, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0 02246 896 NtQueryValueKey (272, (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02247 896 NtQueryValueKey (272, (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (272, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02248 896 NtQueryValueKey (272, (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (272, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02249 896 NtClose (272, ... ) == 0x0 02250 896 NtEnumerateKey (268, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES 02251 896 NtClose (268, ... ) == 0x0 02252 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02253 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02254 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02255 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02256 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02257 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02258 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02259 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02260 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02261 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02262 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02263 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02264 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02265 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02266 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02267 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02268 896 NtClose (268, ... ) == 0x0 02269 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02270 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02271 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02272 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02273 896 NtClose (268, ... ) == 0x0 02274 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02275 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02276 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02277 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02278 896 NtClose (268, ... ) == 0x0 02279 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02280 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02281 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02282 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02283 896 NtClose (268, ... ) == 0x0 02284 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02285 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02286 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02287 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02288 896 NtClose (268, ... ) == 0x0 02289 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02290 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02291 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02292 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02293 896 NtClose (268, ... ) == 0x0 02294 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02295 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02296 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02297 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02298 896 NtClose (268, ... ) == 0x0 02299 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02300 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02301 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02302 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02303 896 NtClose (268, ... ) == 0x0 02304 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02305 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02306 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02307 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02308 896 NtClose (268, ... ) == 0x0 02309 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02310 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02311 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02312 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02313 896 NtClose (268, ... ) == 0x0 02314 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02315 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02316 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02317 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02318 896 NtClose (268, ... ) == 0x0 02319 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02320 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02321 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02322 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02323 896 NtClose (268, ... ) == 0x0 02324 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02325 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02326 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02327 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02328 896 NtClose (268, ... ) == 0x0 02329 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02330 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02331 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02332 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02333 896 NtClose (268, ... ) == 0x0 02334 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02335 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02336 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02337 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02338 896 NtClose (268, ... ) == 0x0 02339 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02340 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 268, ) }, ... 268, ) == 0x0 02341 896 NtQueryValueKey (268, (268, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (268, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (268, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0 02342 896 NtClose (268, ... ) == 0x0 02343 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02344 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 268, ) == 0x0 02345 896 NtQueryInformationToken (268, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02346 896 NtClose (268, ... ) == 0x0 02347 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02348 896 NtOpenThreadToken (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN 02349 896 NtOpenProcessToken (-1, 0xa, ... 268, ) == 0x0 02350 896 NtDuplicateToken (268, 0xc, {24, 0, 0x0, 0, 1232104, 0x0}, 0, 2, ... 272, ) == 0x0 02351 896 NtClose (268, ... ) == 0x0 02352 896 NtAccessCheck (1436072, 272, 0x1, 1232180, 1232232, 56, 1232212, ... (0x1), ) == 0x0 02353 896 NtClose (272, ... ) == 0x0 02354 896 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 272, ) }, ... 272, ) == 0x0 02355 896 NtQueryValueKey (272, (272, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (272, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02356 896 NtClose (272, ... ) == 0x0 02357 896 NtOpenSymbolicLinkObject (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 272, ) }, ... 272, ) == 0x0 02358 896 NtQuerySymbolicLinkObject (272, ... (272, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0 02359 896 NtClose (272, ... ) == 0x0 02360 896 NtQueryVolumeInformationFile (252, 1229936, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02361 896 NtQueryInformationFile (252, 1230052, 528, Name, ... {status=0x0, info=58}, ) == 0x0 02362 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02363 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02364 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1229224, ... ) }, 1229224, ... ) == 0x0 02365 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02366 896 NtQueryDirectoryFile (272, 0, 0, 0, 1228652, 616, BothDirectory, 1, (272, 0, 0, 0, 1228652, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02367 896 NtClose (272, ... ) == 0x0 02368 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02369 896 NtQueryDirectoryFile (272, 0, 0, 0, 1228652, 616, BothDirectory, 1, (272, 0, 0, 0, 1228652, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02370 896 NtClose (272, ... ) == 0x0 02371 896 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 272, {status=0x0, info=1}, ) }, 3, 16417, ... 272, {status=0x0, info=1}, ) == 0x0 02372 896 NtQueryDirectoryFile (272, 0, 0, 0, 1228652, 616, BothDirectory, 1, (272, 0, 0, 0, 1228652, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02373 896 NtClose (272, ... ) == 0x0 02374 896 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02375 896 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02376 896 NtQueryInformationFile (252, 1232092, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02377 896 NtCreateSection (0xf0005, 0x0, {180224, 0}, 2, 134217728, 252, ... 272, ) == 0x0 02378 896 NtMapViewOfSection (272, -1, (0x0), 0, 0, {0, 0}, 180224, 1, 0, 2, ... (0x1b30000), {0, 0}, 180224, ) == 0x0 02379 896 NtClose (272, ... ) == 0x0 02380 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02381 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 272, ) == 0x0 02382 896 NtQueryInformationToken (272, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02383 896 NtClose (272, ... ) == 0x0 02384 896 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 272, ) }, ... 272, ) == 0x0 02385 896 NtOpenKey (0x20019, {24, 272, 0x40, 0, 0, (0x20019, {24, 272, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 268, ) }, ... 268, ) == 0x0 02386 896 NtClose (272, ... ) == 0x0 02387 896 NtQueryValueKey (268, (268, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 02388 896 NtQueryValueKey (268, (268, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (268, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0 02389 896 NtClose (268, ... ) == 0x0 02390 896 NtUnmapViewOfSection (-1, 0x1b30000, ... ) == 0x0 02391 896 NtAllocateVirtualMemory (-1, 0, 0, 4096, 8192, 4, ... 28508160, 4096, ) == 0x0 02392 896 NtAllocateVirtualMemory (-1, 28508160, 0, 4096, 4096, 4, ... 28508160, 4096, ) == 0x0 02393 896 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 268, ) }, ... 268, ) == 0x0 02394 896 NtQueryValueKey (268, (268, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02395 896 NtClose (268, ... ) == 0x0 02396 896 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02397 896 NtQueryInformationToken (264, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0 02398 896 NtQueryInformationToken (264, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0 02399 896 NtClose (264, ... ) == 0x0 02400 896 NtQuerySection (248, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02401 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02402 896 NtQuerySystemInformation (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0 02403 896 NtCreateProcessEx (1234016, 2035711, 0, -1, 4, 248, 0, 0, 0, ... ) == 0x0 02404 896 NtSetInformationProcess (264, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0 02405 896 NtSetInformationProcess (264, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02406 896 NtQueryInformationProcess (264, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd4000,AffinityMask=0x1,BasePriority=8,Pid=1276,ParentPid=1252,}, 0x0, ) == 0x0 02407 896 NtReadVirtualMemory (264, 0x7ffd4008, 4, ... (264, 0x7ffd4008, 4, ... "\0\0\00", 0x0, ) , 0x0, ) == 0x0 02408 896 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02409 896 NtReadVirtualMemory (264, 0x30000000, 4096, ... (264, 0x30000000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0$\206\244\23`\347\312@`\347\312@`\347\312@9\304\331@b\347\312@`\347\313@d\347\312@\210\370\301@a\347\312@\343\373\304@j\347\312@\210\370\300@I\347\312@6\370\331@h\347\312@\272\304\326@i\347\312@\220\370\301@p\347\312@`\347\312@H\346\312@Rich`\347\312@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0N\23\216?\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\24\0\220\2\0\0\240\0\0\0\0\0\0\232t\0\0\0\20\0\0\0\320\3\0\0\0\00\0\20\0\0\0\20\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0@\3\0\0\20\0\0\237*\3\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\327\211\2\0z\1\0\0\00\3\0\244\12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\236\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0\370\0\0\0\0\20\0\0\270\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\222\216\2\0", 4096, ) , 4096, ) == 0x0 02410 896 NtReadVirtualMemory (264, 0x30033000, 256, ... (264, 0x30033000, 256, ... "\0\0\0\0J\23\216?\0\0\0\0\0\0\3\0\5\0\0\0(\0\0\200\13\0\0\0@\0\0\200\20\0\0\0X\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0e\0\0\0p\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\210\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\240\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\270\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\310\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\330\0\0\0\3600\3\0\26\3\0\0\0\0\0\0\0\0\0\0\104\3\0\254\1\0\0\0\0\0\0\0\0\0\0\2645\3\0\360\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\0\310\200\0\0\0\0\14\0\0\0\0\0f\1", 256, ) , 256, ) == 0x0 02411 896 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02412 896 NtQueryInformationProcess (264, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd4000,AffinityMask=0x1,BasePriority=8,Pid=1276,ParentPid=1252,}, 0x0, ) == 0x0 02413 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1232968, ... ) }, 1232968, ... ) == 0x0 02414 896 NtAllocateVirtualMemory (-1, 0, 0, 2428, 4096, 4, ... 28573696, 4096, ) == 0x0 02415 896 NtAllocateVirtualMemory (264, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0 02416 896 NtWriteVirtualMemory (264, 0x10000, (264, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0 02417 896 NtAllocateVirtualMemory (264, 0, 0, 2428, 4096, 4, ... 131072, 4096, ) == 0x0 02418 896 NtWriteVirtualMemory (264, 0x20000, (264, 0x20000, "\0\20\0\0|\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0&\0\10\2\220\2\0\0\16\0\0\0\364\3\366\3\230\4\0\0:\0<\0\220\10\0\0N\0P\0\314\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\0<\0\34\11\0\0\36\0 \0X\11\0\0\0\0\2\0x\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2428, ... 0x0, ) , 2428, ... 0x0, ) == 0x0 02419 896 NtWriteVirtualMemory (264, 0x7ffd4010, (264, 0x7ffd4010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0 02420 896 NtAllocateVirtualMemory (264, 0, 0, 388, 4096, 4, ... 196608, 4096, ) == 0x0 02421 896 NtWriteVirtualMemory (264, 0x30000, (264, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\1\0\0\253\355\15\254\210\255\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 388, ... 0x0, ) , 388, ... 0x0, ) == 0x0 02422 896 NtWriteVirtualMemory (264, 0x7ffd41e8, (264, 0x7ffd41e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0 02423 896 NtFreeVirtualMemory (-1, (0x1b40000), 0, 32768, ... (0x1b40000), 4096, ) == 0x0 02424 896 NtAllocateVirtualMemory (264, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0 02425 896 NtAllocateVirtualMemory (264, 1302528, 0, 8192, 4096, 4, ... 1302528, 8192, ) == 0x0 02426 896 NtProtectVirtualMemory (264, (0x13e000), 4096, 260, ... (0x13e000), 4096, 4, ) == 0x0 02427 896 NtCreateThread (0x1f03ff, 0x0, 264, 1234024, 1233688, 1, ... 268, {1276, 220}, ) == 0x0 02428 896 NtRequestWaitReplyPort (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\13\1\0\0\14\1\0\0\374\4\0\0\334\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0P\330\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\375\177\0\0\0\0\0\0\24\0\10 \0\0" ... {168, 196, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\10\1\0\0\14\1\0\0\374\4\0\0\334\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0P\330\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\375\177\0\0\0\0\0\0\24\0\10 \0\0" ) ... {168, 196, reply, 0, 1252, 896, 81858, 0} (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\13\1\0\0\14\1\0\0\374\4\0\0\334\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0P\330\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\375\177\0\0\0\0\0\0\24\0\10 \0\0" ... {168, 196, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\10\1\0\0\14\1\0\0\374\4\0\0\334\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0P\330\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\375\177\0\0\0\0\0\0\24\0\10 \0\0" ) ) == 0x0 02429 896 NtResumeThread (268, ... 1, ) == 0x0 02430 896 NtClose (252, ... ) == 0x0 02431 896 NtClose (248, ... ) == 0x0 02432 896 NtClose (268, ... ) == 0x0 02433 896 NtWaitForMultipleObjects (2, (236, 264, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02434 896 NtWaitForSingleObject (228, 0, {0, 0}, ... ) == 0x102 02435 896 NtWaitForMultipleObjects (2, (236, 264, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02436 896 NtWaitForSingleObject (228, 0, {0, 0}, ... ) == 0x102 02437 896 NtWaitForMultipleObjects (2, (236, 264, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02438 896 NtWaitForSingleObject (228, 0, {0, 0}, ... ) == 0x102 02439 896 NtWaitForMultipleObjects (2, (236, 264, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02440 896 NtWaitForSingleObject (228, 0, {0, 0}, ... ) == 0x102 02441 896 NtWaitForMultipleObjects (2, (236, 264, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02442 896 NtWaitForSingleObject (228, 0, {0, 0}, ... ) == 0x102 02443 896 NtWaitForMultipleObjects (2, (236, 264, ), 1, 0, {1294967296, -1}, ...