Summary:
NtAccessCheck(>) | 1 | NtReleaseMutant(>) | 1 | NtTerminateProcess(>) | 2 | NtReadFile(>) | 8 |
NtContinue(>) | 1 | NtResumeThread(>) | 1 | NtUnmapViewOfSection(>) | 2 | NtFlushInstructionCache(>) | 9 |
NtCreateFile(>) | 1 | NtSecureConnectPort(>) | 1 | NtCreateSection(>) | 3 | NtMapViewOfSection(>) | 10 |
NtCreateProcessEx(>) | 1 | NtSetContextThread(>) | 1 | NtOpenProcessToken(>) | 3 | NtOpenSection(>) | 11 |
NtCreateThread(>) | 1 | NtSetInformationThread(>) | 1 | NtReadVirtualMemory(>) | 3 | NtQueryDefaultLocale(>) | 11 |
NtDuplicateToken(>) | 1 | NtTestAlert(>) | 1 | NtSetInformationProcess(>) | 3 | NtSetInformationFile(>) | 11 |
NtFsControlFile(>) | 1 | NtWaitForSingleObject(>) | 1 | NtQueryAttributesFile(>) | 4 | NtOpenProcessTokenEx(>) | 19 |
NtGetContextThread(>) | 1 | NtFreeVirtualMemory(>) | 2 | NtQueryVolumeInformationFile(>) | 4 | NtOpenThreadTokenEx(>) | 19 |
NtOpenKeyedEvent(>) | 1 | NtOpenDirectoryObject(>) | 2 | NtRequestWaitReplyPort(>) | 5 | NtProtectVirtualMemory(>) | 19 |
NtOpenMutant(>) | 1 | NtOpenSymbolicLinkObject(>) | 2 | NtQueryInformationFile(>) | 6 | NtQueryInformationToken(>) | 23 |
NtQueryDebugFilterState(>) | 1 | NtOpenThreadToken(>) | 2 | NtQueryInformationProcess(>) | 6 | NtQueryValueKey(>) | 38 |
NtQueryInformationJobObject(>) | 1 | NtQueryDefaultUILanguage(>) | 2 | NtWriteVirtualMemory(>) | 6 | NtClose(>) | 64 |
NtQueryInstallUILanguage(>) | 1 | NtQueryDirectoryFile(>) | 2 | NtQuerySystemInformation(>) | 7 | NtOpenKey(>) | 66 |
NtQueryObject(>) | 1 | NtQuerySection(>) | 2 | NtQueryVirtualMemory(>) | 7 | NtAllocateVirtualMemory(>) | 76 |
NtQueryPerformanceCounter(>) | 1 | NtQuerySymbolicLinkObject(>) | 2 | NtEnumerateKey(>) | 8 | ||
NtRegisterThreadTerminatePort(>) | 1 | NtSetInformationObject(>) | 2 |
\203O\373\335\13>\313"\213g\331\312\311\307\253\59\372\210N\12[v\34\340D\357E\251\304di\347\11\216m}f\237; \354\267!<\311)\221\332\232z8,\242\327\341\2o\\362^\267\330\333\260\213\203\270\261\223,w\6\10\23\0\37\373\21\26\345?y3c\271\306yI\21@\374\212\35\311C$\13\371[\2646t\241J\312+\365\220\304\21\202\204\11", ) \377\356\335{\5\334\206\3345\11ua4\255\14~\207\377e{\275\233\207;pw\23qo\252\357\353Z\37\3471\36`\321W^d[\254\317\263\6I\21\130\324\240]\303\223\330t\15\33\12jy?:\241\207\271\7\352e\21\16k
206\270\200i\317\265fgJ\361s\240(o\216\243wB\350\232>\203O\373\335\13>\313 (16, 0, 0, 0, 1024, 0x0, 0, ... {status=0x0, info=1024}, "\25?\270\256\236\5\5\56\274hr\17YGd\375(.a!Uq\20Fo-\215:p\270-\272\232\20&\37\336\177\315^\202)\233S\307I\257\26\307\217\325I\246WB\216J\306\371\262U\263-\230\15\266(\202@0i\275\306\255_\340!]\323\323\333)\273][GK\276'\363\3140y\363\232\14\165L\274\11jw\220\237\23\23\32P\365<\14<\34)u\203\4\374\4\223\246\310\206\375\346\321\376\244\10\324D~\354Du\317X@\5\302@\357\36\345\266\327\247\26\17y\243\331iX\27\311\265\271\244G`\324\355\327U1\1\226\204.\304\267\343mw^\300\360\33\266\270\272\264\344\2224\332\310\232\15\316\202<\24\345N\363\275Z\350\321\231\367a\350\240\252\324\202\334,\353\326\203&\242'\340\212\322\24cP\336\274\20\231;\206r\23C\234\254\276\326\357\277\373\3403\213\371C1\332@\244\323\204f\243\365!\276\2\253\245iq:\252\233\323\320\20\342\313#V\315\365\247,=1Kuz\201\4W\23\344\35"\377\356\335{\5\334\206\3345\11ua4\255\14~\207\377e{\275\233\207;pw\23qo\252\357\353Z\37\3471\36`\321W^d[\254\317\263\6I\21\130\324\240]\303\223\330t\15\33\12jy?:\241\207\271\7\352e\21\16k
\203O\373\335\13>\313"\213g\331\312\311\307\253\59\372\210N\12[v\34\340D\357E\251\304di\347\11\216m}f\237; \354\267!<\311)\221\332\232z8,\242\327\341\2o\\362^\267\330\333\260\213\203\270\261\223,w\6\10\23\0\37\373\21\26\345?y3c\271\306yI\21@\374\212\35\311C$\13\371[\2646t\241J\312+\365\220\304\21\202\204\11", ) , ) == 0x0 00162 1736 NtSetInformationFile (16, 1034072, 8, Position, ... {status=0x0, info=0}, ) == 0x0 00163 1736 NtReadFile (16, 0, 0, 0, 4608, 0x0, 0, ... {status=0x0, info=4608}, (16, 0, 0, 0, 4608, 0x0, 0, ... {status=0x0, info=4608}, "\225e\355\10\5\5\5\356\360\11bJZ\310\355\6\5\5\5\360b\300\362\4\4\4\10\342\206\360\5u\11\5\210\302'\11\5\5\5\216\242'\11\5\5\24\212j\10\5\5\222\2123\11\5\5U\4\232R\24\5\5\216\212+\11\5\5\220\375\222bcXU\4\232N\24\5\5\216\212R\12\5\5\222bpX\\4\232N\24\5\5\216\212V\12\5\5\222J|\4\345[nwyzfqFqqth\5[nwyzfqKwjj\5\220\2426\12\5\5\20\340y\17\220\10\214\212:\12\5\5\216\10\222\272n\12\5\5\210C\5\24\211&\6\5\5o\11m\5\25\5\5m\5\35\5\5o\5\4\232R\12\5\5\216\212[\6\5\5\220K\11\12\23\6\5\5o\11m\5\25\5\5Uo\5\4\232R\12\5\5\216\212W\6\5\5[\220#\10\242'\11\5\5\4\272[\6\5\5\4{\11UX\355s\12\5\5\270\5\205\0\5zc\3\212\361\5\5\5\220C\10\302'\11\5\5\4<\313\14\310\4\334\224\14UV[X\220\315\210\356\13\220\272W\6\5\58\340\20\316y3}1\261A\355y\17\360\5A\356y\11HN\360\360\220\13\360\5\205C\5z\370)\5\306\305\350\310\216\13\210\310\12\210\313\11\210\356\12\360\323`c^]\360\15\5\5\5\5\5\5\5\5\220\315\220C\10\302'\11\5\5\220\272W\6\5\5\306\376\7\370\252\220\315\210\346\10\370\251cm\5\205\5\5o\5\4\272W\6\5\5\4\232V\12\5\5\210\313\15\210C\5\24\212#\4\4\4m\5\205\5\5o\5\4\272[\6\5\5\4\232V\12\5\5\220\2426\12\5\5\20\340y\15\220\10\214\212:\12\5\5\220\232'\11\5\5\220\2122\12\5\50\325y~\220\307\306\355\258\340\220\272>\12\5\5\10\272'\11\5\5\210C\5", ) , ) == 0x0 00164 1736 NtQueryInformationJobObject (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED 00165 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1239840, ... ) }, 1239840, ... ) == 0x0 00166 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1240576, ... ) }, 1240576, ... ) == 0x0 00167 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 28, ) }, ... 28, ) == 0x0 00168 1736 NtQueryValueKey (28, (28, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00169 1736 NtClose (28, ... ) == 0x0 00170 1736 NtOpenFile (0x1000a1, {24, 0, 0x40, 0, 0, (0x1000a1, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00171 1736 NtCreateSection (0xf001f, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0 00172 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00173 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 36, ) }, ... 36, ) == 0x0 00174 1736 NtQueryValueKey (36, (36, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00175 1736 NtClose (36, ... ) == 0x0 00176 1736 NtQueryVolumeInformationFile (28, 1239852, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00177 1736 NtFsControlFile (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0 00178 1736 NtOpenDirectoryObject (0x2000f, {24, 0, 0x40, 0, 0, (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 36, ) }, ... 36, ) == 0x0 00179 1736 NtOpenMutant (0x120001, {24, 36, 0x0, 0, 0, (0x120001, {24, 36, 0x0, 0, 0, "ShimCacheMutex"}, ... 40, ) }, ... 40, ) == 0x0 00180 1736 NtWaitForSingleObject (40, 0, {-1000000, -1}, ... ) == 0x0 00181 1736 NtOpenSection (0x2, {24, 36, 0x0, 0, 0, (0x2, {24, 36, 0x0, 0, 0, "ShimSharedMemory"}, ... 44, ) }, ... 44, ) == 0x0 00182 1736 NtMapViewOfSection (44, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x390000), {0, 0}, 57344, ) == 0x0 00183 1736 NtQueryInformationFile (28, 1239816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0 00184 1736 NtQueryInformationFile (28, 1239856, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 00185 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00186 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 48, ) == 0x0 00187 1736 NtQueryInformationToken (48, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00188 1736 NtClose (48, ... ) == 0x0 00189 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00190 1736 NtReleaseMutant (40, ... 0x0, ) == 0x0 00191 1736 NtOpenThreadToken (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN 00192 1736 NtOpenProcessToken (-1, 0xa, ... 48, ) == 0x0 00193 1736 NtQueryInformationToken (48, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 00194 1736 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00195 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 52, ) }, ... 52, ) == 0x0 00196 1736 NtQueryValueKey (52, (52, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (52, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00197 1736 NtQueryValueKey (52, (52, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (52, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00198 1736 NtClose (52, ... ) == 0x0 00199 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.DLL"}, ... 52, ) }, ... 52, ) == 0x0 00200 1736 NtMapViewOfSection (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0 00201 1736 NtClose (52, ... ) == 0x0 00202 1736 NtProtectVirtualMemory (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0 00203 1736 NtProtectVirtualMemory (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0 00204 1736 NtFlushInstructionCache (-1, 2010976256, 1700, ... ) == 0x0 00205 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 52, ) }, ... 52, ) == 0x0 00206 1736 NtMapViewOfSection (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0 00207 1736 NtClose (52, ... ) == 0x0 00208 1736 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00209 1736 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00210 1736 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00211 1736 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00212 1736 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00213 1736 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00214 1736 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00215 1736 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00216 1736 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00217 1736 NtProtectVirtualMemory (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0 00218 1736 NtProtectVirtualMemory (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0 00219 1736 NtFlushInstructionCache (-1, 2010976256, 1700, ... ) == 0x0 00220 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00221 1736 NtAllocateVirtualMemory (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0 00222 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00223 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 52, ) }, ... 52, ) == 0x0 00224 1736 NtQueryValueKey (52, (52, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (52, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00225 1736 NtQueryValueKey (52, (52, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (52, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00226 1736 NtClose (52, ... ) == 0x0 00227 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 52, ) }, ... 52, ) == 0x0 00228 1736 NtQueryValueKey (52, (52, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00229 1736 NtClose (52, ... ) == 0x0 00230 1736 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 52, ) }, ... 52, ) == 0x0 00231 1736 NtSetInformationObject (52, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0 00232 1736 NtOpenKey (0x20019, {24, 52, 0x40, 0, 0, (0x20019, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00233 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00234 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00235 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00236 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 56, ) }, ... 56, ) == 0x0 00237 1736 NtQueryValueKey (56, (56, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00238 1736 NtClose (56, ... ) == 0x0 00239 1736 NtQueryDefaultUILanguage (2090319928, ... 00240 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00241 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147481380, ) == 0x0 00242 1736 NtQueryInformationToken (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00243 1736 NtClose (-2147481380, ... ) == 0x0 00244 1736 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0 00245 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x240, 0, 0, (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00246 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x640, 0, 0, (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0 00247 1736 NtQueryValueKey (-2147481388, (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00248 1736 NtClose (-2147481388, ... ) == 0x0 00249 1736 NtClose (-2147481380, ... ) == 0x0 00239 1736 NtQueryDefaultUILanguage ... ) == 0x0 00250 1736 NtQueryInstallUILanguage (2090319930, ... ) == 0x0 00251 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00252 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00253 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00254 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00255 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00256 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00257 1736 NtAllocateVirtualMemory (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0 00258 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00259 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00260 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00261 1736 NtQueryDefaultLocale (1, 1239280, ... ) == 0x0 00262 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 56, ) }, ... 56, ) == 0x0 00263 1736 NtEnumerateKey (56, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (56, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0 00264 1736 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 60, ) }, ... 60, ) == 0x0 00265 1736 NtQueryValueKey (60, (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0 00266 1736 NtQueryValueKey (60, (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00267 1736 NtClose (60, ... ) == 0x0 00268 1736 NtEnumerateKey (56, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES 00269 1736 NtClose (56, ... ) == 0x0 00270 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 56, ) }, ... 56, ) == 0x0 00271 1736 NtEnumerateKey (56, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (56, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0 00272 1736 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 60, ) }, ... 60, ) == 0x0 00273 1736 NtQueryValueKey (60, (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0 00274 1736 NtQueryValueKey (60, (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 00275 1736 NtQueryValueKey (60, (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 00276 1736 NtQueryValueKey (60, (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00277 1736 NtClose (60, ... ) == 0x0 00278 1736 NtEnumerateKey (56, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (56, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0 00279 1736 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 60, ) }, ... 60, ) == 0x0 00280 1736 NtQueryValueKey (60, (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0 00281 1736 NtQueryValueKey (60, (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 00282 1736 NtQueryValueKey (60, (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 00283 1736 NtQueryValueKey (60, (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00284 1736 NtClose (60, ... ) == 0x0 00285 1736 NtEnumerateKey (56, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (56, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0 00286 1736 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 60, ) }, ... 60, ) == 0x0 00287 1736 NtQueryValueKey (60, (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0 00288 1736 NtQueryValueKey (60, (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 00289 1736 NtQueryValueKey (60, (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 00290 1736 NtQueryValueKey (60, (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00291 1736 NtClose (60, ... ) == 0x0 00292 1736 NtEnumerateKey (56, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (56, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0 00293 1736 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 60, ) }, ... 60, ) == 0x0 00294 1736 NtQueryValueKey (60, (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0 00295 1736 NtQueryValueKey (60, (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 00296 1736 NtQueryValueKey (60, (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 00297 1736 NtQueryValueKey (60, (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00298 1736 NtClose (60, ... ) == 0x0 00299 1736 NtEnumerateKey (56, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (56, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0 00300 1736 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 60, ) }, ... 60, ) == 0x0 00301 1736 NtQueryValueKey (60, (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (60, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0 00302 1736 NtQueryValueKey (60, (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 00303 1736 NtQueryValueKey (60, (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (60, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 00304 1736 NtQueryValueKey (60, (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (60, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00305 1736 NtClose (60, ... ) == 0x0 00306 1736 NtEnumerateKey (56, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES 00307 1736 NtClose (56, ... ) == 0x0 00308 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00309 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00310 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00311 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00312 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00313 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00314 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00315 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00316 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00317 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00318 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00319 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00320 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00321 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00322 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00323 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00324 1736 NtClose (56, ... ) == 0x0 00325 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00326 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00327 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00328 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00329 1736 NtClose (56, ... ) == 0x0 00330 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00331 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00332 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00333 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00334 1736 NtClose (56, ... ) == 0x0 00335 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00336 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00337 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00338 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00339 1736 NtClose (56, ... ) == 0x0 00340 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00341 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00342 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00343 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00344 1736 NtClose (56, ... ) == 0x0 00345 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00346 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00347 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00348 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00349 1736 NtClose (56, ... ) == 0x0 00350 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00351 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00352 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00353 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00354 1736 NtClose (56, ... ) == 0x0 00355 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00356 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00357 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00358 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00359 1736 NtClose (56, ... ) == 0x0 00360 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00361 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00362 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00363 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00364 1736 NtClose (56, ... ) == 0x0 00365 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00366 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00367 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00368 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00369 1736 NtClose (56, ... ) == 0x0 00370 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00371 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00372 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00373 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00374 1736 NtClose (56, ... ) == 0x0 00375 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00376 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00377 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00378 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00379 1736 NtClose (56, ... ) == 0x0 00380 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00381 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00382 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00383 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00384 1736 NtClose (56, ... ) == 0x0 00385 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00386 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00387 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00388 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00389 1736 NtClose (56, ... ) == 0x0 00390 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00391 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00392 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00393 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00394 1736 NtClose (56, ... ) == 0x0 00395 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00396 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 56, ) }, ... 56, ) == 0x0 00397 1736 NtQueryValueKey (56, (56, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (56, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (56, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0 00398 1736 NtClose (56, ... ) == 0x0 00399 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00400 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00401 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00402 1736 NtClose (56, ... ) == 0x0 00403 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00404 1736 NtOpenThreadToken (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN 00405 1736 NtOpenProcessToken (-1, 0xa, ... 56, ) == 0x0 00406 1736 NtDuplicateToken (56, 0xc, {24, 0, 0x0, 0, 1239712, 0x0}, 0, 2, ... 60, ) == 0x0 00407 1736 NtClose (56, ... ) == 0x0 00408 1736 NtAccessCheck (1333504, 60, 0x1, 1239788, 1239840, 56, 1239820, ... (0x1), ) == 0x0 00409 1736 NtClose (60, ... ) == 0x0 00410 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 60, ) }, ... 60, ) == 0x0 00411 1736 NtQueryValueKey (60, (60, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (60, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00412 1736 NtClose (60, ... ) == 0x0 00413 1736 NtOpenSymbolicLinkObject (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\??\U:"}, ... 60, ) }, ... 60, ) == 0x0 00414 1736 NtQuerySymbolicLinkObject (60, ... (60, ... "\Device\WinDfs\U:0000000000009f43", 66, ) , 66, ) == 0x0 00415 1736 NtClose (60, ... ) == 0x0 00416 1736 NtQueryVolumeInformationFile (28, 1237544, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00417 1736 NtQueryInformationFile (28, 1237660, 528, Name, ... {status=0x0, info=72}, ) == 0x0 00418 1736 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00419 1736 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00420 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\UNC\missouri\binaries\work\packed.exe"}, 1236832, ... ) }, 1236832, ... ) == 0x0 00421 1736 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\UNC\missouri\binaries\"}, 3, 16417, ... 60, {status=0x0, info=1}, ) }, 3, 16417, ... 60, {status=0x0, info=1}, ) == 0x0 00422 1736 NtQueryDirectoryFile (60, 0, 0, 0, 1236260, 616, BothDirectory, 1, (60, 0, 0, 0, 1236260, 616, BothDirectory, 1, "work", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 00423 1736 NtClose (60, ... ) == 0x0 00424 1736 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\UNC\missouri\binaries\work\"}, 3, 16417, ... 60, {status=0x0, info=1}, ) }, 3, 16417, ... 60, {status=0x0, info=1}, ) == 0x0 00425 1736 NtQueryDirectoryFile (60, 0, 0, 0, 1236260, 616, BothDirectory, 1, (60, 0, 0, 0, 1236260, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0 00426 1736 NtClose (60, ... ) == 0x0 00427 1736 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00428 1736 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00429 1736 NtQueryInformationFile (28, 1239700, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 00430 1736 NtCreateSection (0xf0005, 0x0, {55808, 0}, 2, 134217728, 28, ... 60, ) == 0x0 00431 1736 NtMapViewOfSection (60, -1, (0x0), 0, 0, {0, 0}, 55808, 1, 0, 2, ... (0x3a0000), {0, 0}, 57344, ) == 0x0 00432 1736 NtClose (60, ... ) == 0x0 00433 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00434 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 60, ) == 0x0 00435 1736 NtQueryInformationToken (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00436 1736 NtClose (60, ... ) == 0x0 00437 1736 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 60, ) }, ... 60, ) == 0x0 00438 1736 NtOpenKey (0x20019, {24, 60, 0x40, 0, 0, (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 56, ) }, ... 56, ) == 0x0 00439 1736 NtClose (60, ... ) == 0x0 00440 1736 NtQueryValueKey (56, (56, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00441 1736 NtQueryValueKey (56, (56, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (56, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0 00442 1736 NtClose (56, ... ) == 0x0 00443 1736 NtUnmapViewOfSection (-1, 0x3a0000, ... ) == 0x0 00444 1736 NtAllocateVirtualMemory (-1, 0, 0, 4096, 8192, 4, ... 3801088, 4096, ) == 0x0 00445 1736 NtAllocateVirtualMemory (-1, 3801088, 0, 4096, 4096, 4, ... 3801088, 4096, ) == 0x0 00446 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 56, ) }, ... 56, ) == 0x0 00447 1736 NtQueryValueKey (56, (56, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00448 1736 NtClose (56, ... ) == 0x0 00449 1736 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00450 1736 NtQueryInformationToken (48, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0 00451 1736 NtQueryInformationToken (48, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0 00452 1736 NtClose (48, ... ) == 0x0 00453 1736 NtQuerySection (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00454 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00455 1736 NtQuerySystemInformation (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0 00456 1736 NtCreateProcessEx (1241624, 2035711, 0, -1, 0, 32, 0, 0, 0, ... ) == 0x0 00457 1736 NtQueryInformationProcess (48, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd8000,AffinityMask=0x1,BasePriority=8,Pid=1744,ParentPid=1636,}, 0x0, ) == 0x0 00458 1736 NtReadVirtualMemory (48, 0x7ffd8008, 4, ... (48, 0x7ffd8008, 4, ... "\0\0@\0", 0x0, ) , 0x0, ) == 0x0 00459 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00460 1736 NtAllocateVirtualMemory (-1, 1335296, 0, 8192, 4096, 4, ... 1335296, 8192, ) == 0x0 00461 1736 NtReadVirtualMemory (48, 0x400000, 4096, ... (48, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\327\304\327\262\223\245\271\341\223\245\271\341\223\245\271\341\20\255\344\341\220\245\271\341\223\245\270\341\323\245\271\341\226\251\346\341\333\245\271\341\226\251\266\341\237\245\271\341\226\251\331\341\227\245\271\341\226\251\343\341\222\245\271\341Rich\223\245\271\341\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0\230\237\334G\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0t\0\0\02\0\0\0\0\0\0\351\36\0\0\0\20\0\0\0\220\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\320\0\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0X\236\0\0(\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\235\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\220\0\0\4\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\355r\0\0\0\20\0\0\0t\0\0\0\4\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0 00462 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00463 1736 NtQueryInformationProcess (48, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd8000,AffinityMask=0x1,BasePriority=8,Pid=1744,ParentPid=1636,}, 0x0, ) == 0x0 00464 1736 NtAllocateVirtualMemory (-1, 0, 0, 2324, 4096, 4, ... 3866624, 4096, ) == 0x0 00465 1736 NtAllocateVirtualMemory (48, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0 00466 1736 NtWriteVirtualMemory (48, 0x10000, (48, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0 00467 1736 NtAllocateVirtualMemory (48, 0, 0, 2324, 4096, 4, ... 131072, 4096, ) == 0x0 00468 1736 NtWriteVirtualMemory (48, 0x20000, (48, 0x20000, "\0\20\0\0\24\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0\26\0\10\2\220\2\0\0\0\0\0\0\334\3\336\3\230\4\0\0$\0&\0x\10\0\0$\0&\0\240\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310\10\0\0\36\0 \0\360\10\0\0\0\0\2\0\20\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2324, ... 0x0, ) , 2324, ... 0x0, ) == 0x0 00469 1736 NtWriteVirtualMemory (48, 0x7ffd8010, (48, 0x7ffd8010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0 00470 1736 NtWriteVirtualMemory (48, 0x7ffd81e8, (48, 0x7ffd81e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0 00471 1736 NtFreeVirtualMemory (-1, (0x3b0000), 0, 32768, ... (0x3b0000), 4096, ) == 0x0 00472 1736 NtAllocateVirtualMemory (48, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0 00473 1736 NtAllocateVirtualMemory (48, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0 00474 1736 NtProtectVirtualMemory (48, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0 00475 1736 NtCreateThread (0x1f03ff, 0x0, 48, 1241632, 1241296, 1, ... 56, {1744, 1268}, ) == 0x0 00476 1736 NtRequestWaitReplyPort (24, {168, 196, new_msg, 0, 3866682, 3997756, 0, 0} (24, {168, 196, new_msg, 0, 3866682, 3997756, 0, 0} "\0\0\0\0\0\0\1\0F\0G\0H\0I\03\0\0\08\0\0\0\320\6\0\0\364\4\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Z\0[\0\244\365\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\22\0\250\232\203|" ... {168, 196, reply, 0, 1636, 1736, 75472, 0} "\0\0\0\0\0\0\1\0\0\0\0\0H\0I\00\0\0\08\0\0\0\320\6\0\0\364\4\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Z\0[\0\244\365\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\22\0\250\232\203|" ) ... {168, 196, reply, 0, 1636, 1736, 75472, 0} (24, {168, 196, new_msg, 0, 3866682, 3997756, 0, 0} "\0\0\0\0\0\0\1\0F\0G\0H\0I\03\0\0\08\0\0\0\320\6\0\0\364\4\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Z\0[\0\244\365\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\22\0\250\232\203|" ... {168, 196, reply, 0, 1636, 1736, 75472, 0} "\0\0\0\0\0\0\1\0\0\0\0\0H\0I\00\0\0\08\0\0\0\320\6\0\0\364\4\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Z\0[\0\244\365\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\22\0\250\232\203|" ) ) == 0x0 00477 1736 NtClose (28, ... ) == 0x0 00478 1736 NtClose (32, ... ) == 0x0 00479 1736 NtGetContextThread (56, 1244112, ... ) == 0x0 00480 1736 NtReadVirtualMemory (48, 0x7ffd8008, 4, ... (48, 0x7ffd8008, 4, ... "\0\0@\0", 4, ) , 4, ) == 0x0 00481 1736 NtQueryVirtualMemory (48, 0x400000, Basic, 28, ... {BaseAddress=0x400000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x2,Type=0x1000000,}, 28, ) == 0x0 00482 1736 NtQueryVirtualMemory (48, 0x401000, Basic, 28, ... {BaseAddress=0x401000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x8000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 00483 1736 NtQueryVirtualMemory (48, 0x409000, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x1000000,}, 28, ) == 0x0 00484 1736 NtQueryVirtualMemory (48, 0x40b000, Basic, 28, ... {BaseAddress=0x40b000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x2000,State=0x1000,Protect=0x8,Type=0x1000000,}, 28, ) == 0x0 00485 1736 NtQueryVirtualMemory (48, 0x40d000, Basic, 28, ... {BaseAddress=0x40d000,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x7c4f3000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0 00486 1736 NtUnmapViewOfSection (48, 0x400000, ... ) == 0x0 00487 1736 NtAllocateVirtualMemory (48, 4194304, 0, 303104, 12288, 64, ... 4194304, 303104, ) == 0x0 00488 1736 NtProtectVirtualMemory (48, (0x7ffd8008), 4, 64, ... (0x7ffd8000), 4096, 4, ) == 0x0 00489 1736 NtProtectVirtualMemory (48, (0x7ffd8000), 4096, 4, ... (0x7ffd8000), 4096, 64, ) == 0x0 00490 1736 NtWriteVirtualMemory (48, 0x7ffd8008, (48, 0x7ffd8008, "\0\0@\0", 4, ... 4, ) , 4, ... 4, ) == 0x0 00491 1736 NtFlushInstructionCache (48, 2147319816, 4, ... ) == 0x0 00492 1736 NtSetContextThread (56, 1243032, ... ) == 0x0 00493 1736 NtProtectVirtualMemory (48, (0x400000), 303104, 64, ... (0x400000), 303104, 64, ) == 0x0 00494 1736 NtProtectVirtualMemory (48, (0x400000), 303104, 64, ... (0x400000), 303104, 64, ) == 0x0 00495 1736 NtWriteVirtualMemory (48, 0x400000, (48, 0x400000, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\200\326PP\304\267>\3\304\267>\3\304\267>\3\327\277c\3\306\267>\3G\277c\3\316\267>\3>\224'\3\301\267>\3\304\267?\3\231\267>\3\301\273^\3\311\267>\3\301\273d\3\305\267>\3Rich\304\267>\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\5\0\312\34\274G\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0:\0\0\0\10\4\0\0\0\0\0\1p\4\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\240\4\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\254\177\4\0\260\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0T\177\4\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0.text\0\0\0\0@\0\0\0\20\0\0\0"\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 303104, ... 303104, ) \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 303104, ... 303104, ) == 0x0 00496 1736 NtFlushInstructionCache (48, 4194304, 303104, ... ) == 0x0 00497 1736 NtResumeThread (56, ... 1, ) == 0x0 00498 1736 NtTerminateProcess (0, 0, ... ) == 0x0 00499 1736 NtFreeVirtualMemory (-1, (0x3a0000), 4096, 32768, ... (0x3a0000), 4096, ) == 0x0 00500 1736 NtRequestWaitReplyPort (24, {20, 48, new_msg, 0, 2089917247, 2090320088, 2089917163, 4231564} (24, {20, 48, new_msg, 0, 2089917247, 2090320088, 2089917163, 4231564} "\0\0\0\0\3\0\1\0\0\360\375\177\300\37$\0\0\0\0\0" ... {20, 48, reply, 0, 1636, 1736, 75473, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\300\37$\0\0\0\0\0" ) ... {20, 48, reply, 0, 1636, 1736, 75473, 0} (24, {20, 48, new_msg, 0, 2089917247, 2090320088, 2089917163, 4231564} "\0\0\0\0\3\0\1\0\0\360\375\177\300\37$\0\0\0\0\0" ... {20, 48, reply, 0, 1636, 1736, 75473, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\300\37$\0\0\0\0\0" ) ) == 0x0 00501 1736 NtTerminateProcess (-1, 0, ...