Summary:


NtAccessCheck(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtFlushInstructionCache(>) 
 10 
NtFsControlFile(>) 
 45 

NtAddAtom(>) 
 1 
NtGdiHfontCreate(>) 
 2 
NtUserGetWindowDC(>) 
 10 
NtOpenSection(>) 
 45 

NtCallbackReturn(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtClearEvent(>) 
 11 
NtOpenThreadToken(>) 
 45 

NtCreateThread(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtQueryVolumeInformationFile(>) 
 11 
NtSetValueKey(>) 
 45 

NtGdiCreateBitmap(>) 
 1 
NtQuerySystemTime(>) 
 2 
NtUserCallOneParam(>) 
 11 
NtQueryInformationToken(>) 
 48 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 2 
NtUserSystemParametersInfo(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 48 

NtGdiInit(>) 
 1 
NtTestAlert(>) 
 2 
NtCreateSemaphore(>) 
 12 
NtSetInformationProcess(>) 
 51 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserCreateWindowEx(>) 
 2 
NtEnumerateKey(>) 
 12 
NtQueryInformationProcess(>) 
 54 

NtGdiSelectBitmap(>) 
 1 
NtUserGetObjectInformation(>) 
 2 
NtOpenProcessToken(>) 
 12 
NtRequestWaitReplyPort(>) 
 54 

NtOpenKeyedEvent(>) 
 1 
NtUserMessageCall(>) 
 2 
NtQueryDefaultUILanguage(>) 
 12 
NtAllocateVirtualMemory(>) 
 55 

NtOpenProcess(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtSetEvent(>) 
 12 
NtReleaseMutant(>) 
 57 

NtOpenSymbolicLinkObject(>) 
 1 
NtUserGetMessage(>) 
 3 
NtOpenProcessTokenEx(>) 
 16 
NtSetInformationFile(>) 
 59 

NtQueryEvent(>) 
 1 
NtUserRegisterWindowMessage(>) 
 4 
NtOpenThreadTokenEx(>) 
 16 
NtUserRegisterClassExWOW(>) 
 64 

NtQueryInformationThread(>) 
 1 
NtDuplicateToken(>) 
 5 
NtWriteFile(>) 
 16 
NtMapViewOfSection(>) 
 65 

NtQueryObject(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtConnectPort(>) 
 18 
NtCreateEvent(>) 
 66 

NtQuerySymbolicLinkObject(>) 
 1 
NtNotifyChangeKey(>) 
 5 
NtQuerySection(>) 
 19 
NtCreateKey(>) 
 79 

NtQueryTimerResolution(>) 
 1 
NtQuerySecurityObject(>) 
 5 
NtReadFile(>) 
 19 
NtQueryDefaultLocale(>) 
 99 

NtResumeThread(>) 
 1 
NtSetInformationObject(>) 
 5 
NtUnmapViewOfSection(>) 
 21 
NtOpenFile(>) 
 108 

NtSecureConnectPort(>) 
 1 
NtCreateMutant(>) 
 6 
NtProtectVirtualMemory(>) 
 25 
NtQueryAttributesFile(>) 
 134 

NtUserGetDC(>) 
 1 
NtDuplicateObject(>) 
 6 
NtQuerySystemInformation(>) 
 25 
NtQueryVirtualMemory(>) 
 147 

NtUserGetGUIThreadInfo(>) 
 1 
NtFreeVirtualMemory(>) 
 6 
NtQueryDirectoryFile(>) 
 28 
NtEnumerateValueKey(>) 
 231 

NtUserGetProcessWindowStation(>) 
 1 
NtOpenEvent(>) 
 7 
NtQueryDebugFilterState(>) 
 29 
NtOpenKey(>) 
 326 

NtUserGetThreadDesktop(>) 
 1 
NtReleaseSemaphore(>) 
 7 
NtSetInformationThread(>) 
 29 
NtQueryValueKey(>) 
 525 

NtUserSetProp(>) 
 1 
NtUserCallNoParam(>) 
 7 
NtCreateSection(>) 
 34 
NtWaitForSingleObject(>) 
 553 

NtUserSetTimer(>) 
 1 
NtQueryKey(>) 
 8 
NtUserGetClassInfo(>) 
 37 
NtClose(>) 
 567 

NtContinue(>) 
 2 
NtDeleteValueKey(>) 
 9 
NtCreateFile(>) 
 42 
NtDeviceIoControlFile(>) 
 739 

NtCreateIoCompletion(>) 
 2 
NtOpenMutant(>) 
 9 
NtQueryInformationFile(>) 
 44 

Trace:
 00001   448   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   448   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   448   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   448   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   448   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   448   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   448   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   448   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   448   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   448   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   448   NtClose  (12, ... ) == 0x0
 00014   448   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   448   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   448   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   448   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   448   NtClose  (16, ... ) == 0x0
 00021   448   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   448   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   448   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   448   NtClose  (16, ... ) == 0x0
 00026   448   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   448   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   448   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   448   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   448   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 432, 448, 1502, 0} "\240\25\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 432, 448, 1502, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 432, 448, 1502, 0} "\240\25\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   448   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   448   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   448   NtClose  (16, ... ) == 0x0
 00036   448   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   448   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   448   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   448   NtClose  (28, ... ) == 0x0
 00041   448   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   448   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   448   NtClose  (28, ... ) == 0x0
 00045   448   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   448   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   448   NtClose  (28, ... ) == 0x0
 00049   448   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   448   NtClose  (28, ... ) == 0x0
 00052   448   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   448   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   448   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   448   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 432, 448, 1505, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 432, 448, 1505, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 432, 448, 1505, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00057   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0
 00058   448   NtClose  (28, ... ) == 0x0
 00059   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 00061   448   NtClose  (28, ... ) == 0x0
 00062   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   448   NtClose  (28, ... ) == 0x0
 00065   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00067   448   NtClose  (28, ... ) == 0x0
 00068   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00070   448   NtClose  (28, ... ) == 0x0
 00071   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00072   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00073   448   NtClose  (28, ... ) == 0x0
 00074   448   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00075   448   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00076   448   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00077   448   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00078   448   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00079   448   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00080   448   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00081   448   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00082   448   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00083   448   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00084   448   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00085   448   NtClose  (28, ... ) == 0x0
 00086   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00087   448   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00088   448   NtClose  (28, ... ) == 0x0
 00089   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00090   448   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00091   448   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00092   448   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00093   448   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00094   448   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 28, ) }, ... 28, ) == 0x0
 00095   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00096   448   NtClose  (28, ... ) == 0x0
 00097   448   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00098   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00099   448   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\31\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 432, 448, 1507, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 432, 448, 1507, 0}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\31\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 432, 448, 1507, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00100   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00101   448   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4e0000), 0x0, 1060864, ) == 0x0
 00102   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00103   448   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00104   448   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482060, ) == 0x0
 00105   448   NtQueryInformationToken  (-2147482060, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00106   448   NtQueryInformationToken  (-2147482060, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00107   448   NtClose  (-2147482060, ... ) == 0x0
 00108   448   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00109   448   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00110   448   NtDuplicateObject  (-1, 36, -1, 0x0, 0, 2, ... 44, ) == 0x0
 00111   448   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482060, ) }, ... -2147482060, ) == 0x0
 00112   448   NtQueryValueKey  (-2147482060,  (-2147482060, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00113   448   NtClose  (-2147482060, ... ) == 0x0
 00114   448   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482060, ) }, ... -2147482060, ) == 0x0
 00115   448   NtQueryValueKey  (-2147482060,  (-2147482060, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00116   448   NtClose  (-2147482060, ... ) == 0x0
 00117   448   NtQueryDefaultLocale  (0, -136508916, ... ) == 0x0
 00118   448   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00119   448   NtUserCallNoParam  (24, ... ) == 0x0
 00120   448   NtGdiCreateCompatibleDC  (0, ...
 00121   448   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00120   448   NtGdiCreateCompatibleDC  ... ) == 0x16010322
 00122   448   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00123   448   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00124   448   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x13050402
 00125   448   NtGdiCreateSolidBrush  (0, 0, ...
 00126   448   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00125   448   NtGdiCreateSolidBrush  ... ) == 0xe100408
 00127   448   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00128   448   NtGdiCreateCompatibleDC  (0, ... ) == 0x36010415
 00129   448   NtGdiSelectBitmap  (906036245, 319095810, ... ) == 0x185000f
 00130   448   NtUserGetThreadDesktop  (448, 0, ... ) == 0x28
 00131   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 48, ) }, ... 48, ) == 0x0
 00132   448   NtQueryValueKey  (48,  (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00133   448   NtClose  (48, ... ) == 0x0
 00134   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00135   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810cc017
 00136   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00137   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810cc01c
 00138   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00139   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810cc01e
 00140   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00141   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810c8002
 00142   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00143   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810cc018
 00144   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00145   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810cc01a
 00146   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00147   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ...
 00148   448   NtAllocateVirtualMemory  (-1, 6320128, 0, 4096, 4096, 32, ... 6320128, 4096, ) == 0x0
 00147   448   NtUserRegisterClassExWOW  ... ) == 0x810cc01d
 00149   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00150   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... ) == 0x810cc026
 00151   448   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00152   448   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810cc019
 00153   448   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc020
 00154   448   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc022
 00155   448   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc023
 00156   448   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc024
 00157   448   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc025
 00158   448   NtCallbackReturn  (0, 0, 0, ...
 00159   448   NtGdiInit  (... ) == 0x1
 00160   448   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00161   448   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00162   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 48, ) }, ... 48, ) == 0x0
 00163   448   NtQueryValueKey  (48,  (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00164   448   NtQueryValueKey  (48,  (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00165   448   NtClose  (48, ... ) == 0x0
 00166   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 48, ) }, ... 48, ) == 0x0
 00167   448   NtQueryValueKey  (48,  (48, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00168   448   NtClose  (48, ... ) == 0x0
 00169   448   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 48, ) }, ... 48, ) == 0x0
 00170   448   NtSetInformationObject  (48, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00171   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00172   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00173   448   NtTestAlert  (... ) == 0x0
 00174   448   NtContinue  (1244464, 1, ...
 00175   448   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401440,}, 4, ... ) == 0x0
 00176   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244716,  (0x80100080, {24, 0, 0x40, 0, 1244716, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 96, 0, 0, ... 52, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 52, {status=0x0, info=1}, ) == 0x0
 00177   448   NtClose  (52, ... ) == 0x0
 00178   448   NtProtectVirtualMemory  (-1, (0x402000), 19456, 64, ... (0x402000), 20480, 32, ) == 0x0
 00179   448   NtProtectVirtualMemory  (-1, (0x402000), 19456, 32, ... (0x402000), 20480, 64, ) == 0x0
 00180   448   NtProtectVirtualMemory  (-1, (0x408000), 25088, 64, ... (0x408000), 28672, 8, ) == 0x0
 00181   448   NtProtectVirtualMemory  (-1, (0x408000), 25088, 8, ... (0x408000), 28672, 64, ) == 0x0
 00182   448   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00183   448   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00184   448   NtClose  (52, ... ) == 0x0
 00185   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00186   448   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0
 00187   448   NtClose  (52, ... ) == 0x0
 00188   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00189   448   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0
 00190   448   NtClose  (52, ... ) == 0x0
 00191   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00192   448   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0
 00193   448   NtClose  (52, ... ) == 0x0
 00194   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00195   448   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00196   448   NtClose  (52, ... ) == 0x0
 00197   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 52, ) }, ... 52, ) == 0x0
 00198   448   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 00199   448   NtClose  (52, ... ) == 0x0
 00200   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00201   448   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00202   448   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00203   448   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00204   448   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00205   448   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00206   448   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1240840, 0,  (0x1f0003, {24, 52, 0x80, 1240840, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 00207   448   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 56, ) }, ... 56, ) == 0x0
 00208   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00209   448   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00210   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 60, ) }, ... 60, ) == 0x0
 00211   448   NtQueryValueKey  (60,  (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00212   448   NtClose  (60, ... ) == 0x0
 00213   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00214   448   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00215   448   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00216   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00217   448   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00218   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 60, ) }, ... 60, ) == 0x0
 00219   448   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00220   448   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00221   448   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00222   448   NtClose  (60, ... ) == 0x0
 00223   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 60, ) }, ... 60, ) == 0x0
 00224   448   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00225   448   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00226   448   NtClose  (60, ... ) == 0x0
 00227   448   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00228   448   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 00229   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00230   448   NtOpenKey  (0x9, {24, 48, 0x40, 0, 0,  (0x9, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00231   448   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00232   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00233   448   NtAllocateVirtualMemory  (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0
 00234   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00235   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 60, ) == 0x0
 00236   448   NtQueryInformationToken  (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00237   448   NtClose  (60, ... ) == 0x0
 00238   448   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 60, ) }, ... 60, ) == 0x0
 00239   448   NtSetInformationObject  (60, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00240   448   NtCreateKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 64, 2, ) }, 0, 0x0, 0, ... 64, 2, ) == 0x0
 00241   448   NtQueryDefaultUILanguage  (1239076, ...
 00242   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00243   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482060, ) == 0x0
 00244   448   NtQueryInformationToken  (-2147482060, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00245   448   NtClose  (-2147482060, ... ) == 0x0
 00246   448   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482060, ) }, ... -2147482060, ) == 0x0
 00247   448   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00248   448   NtOpenKey  (0x80000000, {24, -2147482060, 0x640, 0, 0,  (0x80000000, {24, -2147482060, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482072, ) }, ... -2147482072, ) == 0x0
 00249   448   NtQueryValueKey  (-2147482072,  (-2147482072, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00250   448   NtClose  (-2147482072, ... ) == 0x0
 00251   448   NtClose  (-2147482060, ... ) == 0x0
 00241   448   NtQueryDefaultUILanguage  ... ) == 0x0
 00252   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00253   448   NtQueryInstallUILanguage  (2012047340, ... ) == 0x0
 00254   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00255   448   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 72, ) == 0x0
 00256   448   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x360000), 0x0, 593920, ) == 0x0
 00257   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00258   448   NtQueryDefaultUILanguage  (2013024600, ...
 00259   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00260   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482060, ) == 0x0
 00261   448   NtQueryInformationToken  (-2147482060, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00262   448   NtClose  (-2147482060, ... ) == 0x0
 00263   448   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482060, ) }, ... -2147482060, ) == 0x0
 00264   448   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   448   NtOpenKey  (0x80000000, {24, -2147482060, 0x640, 0, 0,  (0x80000000, {24, -2147482060, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482072, ) }, ... -2147482072, ) == 0x0
 00266   448   NtQueryValueKey  (-2147482072,  (-2147482072, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00267   448   NtClose  (-2147482072, ... ) == 0x0
 00268   448   NtClose  (-2147482060, ... ) == 0x0
 00258   448   NtQueryDefaultUILanguage  ... ) == 0x0
 00269   448   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 00270   448   NtQueryDefaultLocale  (1, 1237112, ... ) == 0x0
 00271   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00272   448   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1518, 0} " S\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 432, 448, 1518, 0}  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1518, 0} " S\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" )  ) == 0x0
 00273   448   NtClose  (68, ... ) == 0x0
 00274   448   NtClose  (72, ... ) == 0x0
 00275   448   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00276   448   NtUnmapViewOfSection  (-1, 0x12ead0, ... ) == STATUS_NOT_MAPPED_VIEW
 00277   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00278   448   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00279   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00280   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00281   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1235652, ... ) }, 1235652, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00282   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00283   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00284   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00285   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236244, ... ) }, 1236244, ... ) == 0x0
 00286   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 72, {status=0x0, info=1}, ) }, 3, 33, ... 72, {status=0x0, info=1}, ) == 0x0
 00287   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00288   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00289   448   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00290   448   NtClose  (68, ... ) == 0x0
 00291   448   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x900000), 0x0, 921600, ) == 0x0
 00292   448   NtClose  (76, ... ) == 0x0
 00293   448   NtUnmapViewOfSection  (-1, 0x900000, ... ) == 0x0
 00294   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 76, {status=0x0, info=1}, ) }, 5, 96, ... 76, {status=0x0, info=1}, ) == 0x0
 00295   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 76, ... 68, ) == 0x0
 00296   448   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00297   448   NtOpenProcessToken  (-1, 0x8, ... 80, ) == 0x0
 00298   448   NtQueryInformationToken  (80, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00299   448   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00300   448   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 84, ) }, ... 84, ) == 0x0
 00301   448   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00302   448   NtClose  (84, ... ) == 0x0
 00303   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00304   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00305   448   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00306   448   NtClose  (84, ... ) == 0x0
 00307   448   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00308   448   NtClose  (80, ... ) == 0x0
 00309   448   NtClose  (76, ... ) == 0x0
 00310   448   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0
 00311   448   NtClose  (68, ... ) == 0x0
 00312   448   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00313   448   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00314   448   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00315   448   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00316   448   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00317   448   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00318   448   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00319   448   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00320   448   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00321   448   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00322   448   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00323   448   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00324   448   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00325   448   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00326   448   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00327   448   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00328   448   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00329   448   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00330   448   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00331   448   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00332   448   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00333   448   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1237428, ... ) , 42, 1237428, ... ) == 0x0
 00334   448   NtQueryDefaultUILanguage  (1236144, ...
 00335   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00336   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482060, ) == 0x0
 00337   448   NtQueryInformationToken  (-2147482060, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00338   448   NtClose  (-2147482060, ... ) == 0x0
 00339   448   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482060, ) }, ... -2147482060, ) == 0x0
 00340   448   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00341   448   NtOpenKey  (0x80000000, {24, -2147482060, 0x640, 0, 0,  (0x80000000, {24, -2147482060, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482072, ) }, ... -2147482072, ) == 0x0
 00342   448   NtQueryValueKey  (-2147482072,  (-2147482072, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00343   448   NtClose  (-2147482072, ... ) == 0x0
 00344   448   NtClose  (-2147482060, ... ) == 0x0
 00334   448   NtQueryDefaultUILanguage  ... ) == 0x0
 00345   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00346   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1234996, ... ) }, 1234996, ... ) == 0x0
 00347   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00348   448   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00349   448   NtClose  (68, ... ) == 0x0
 00350   448   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x360000), 0x0, 4096, ) == 0x0
 00351   448   NtClose  (76, ... ) == 0x0
 00352   448   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00353   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1234636, ... ) }, 1234636, ... ) == 0x0
 00354   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1235336,  (0x80100080, {24, 0, 0x40, 0, 1235336, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) == 0x0
 00355   448   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 76, ... 68, ) == 0x0
 00356   448   NtClose  (76, ... ) == 0x0
 00357   448   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x360000), {0, 0}, 4096, ) == 0x0
 00358   448   NtClose  (68, ... ) == 0x0
 00359   448   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00360   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00361   448   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 76, ) == 0x0
 00362   448   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x360000), 0x0, 4096, ) == 0x0
 00363   448   NtQueryInformationFile  (68, 1234956, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 00364   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00365   448   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1519, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 432, 448, 1519, 0}  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1519, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" )  ) == 0x0
 00366   448   NtClose  (68, ... ) == 0x0
 00367   448   NtClose  (76, ... ) == 0x0
 00368   448   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00369   448   NtUnmapViewOfSection  (-1, 0x12df5c, ... ) == STATUS_NOT_MAPPED_VIEW
 00370   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00371   448   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00372   448   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 00373   448   NtUserGetDC  (0, ... ) == 0x1010051
 00374   448   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 00375   448   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 00376   448   NtUserSystemParametersInfo  (66, 12, 1237448, 0, ... ) == 0x1
 00377   448   NtOpenProcessToken  (-1, 0x8, ... 76, ) == 0x0
 00378   448   NtAccessCheck  (1343968, 76, 0x1, 1236852, 1236796, 56, 1236880, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00379   448   NtClose  (76, ... ) == 0x0
 00380   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 76, ) }, ... 76, ) == 0x0
 00381   448   NtQueryValueKey  (76,  (76, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   448   NtClose  (76, ... ) == 0x0
 00383   448   NtUserSystemParametersInfo  (41, 500, 1236948, 0, ... ) == 0x1
 00384   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 76, ) }, ... 76, ) == 0x0
 00385   448   NtQueryValueKey  (76,  (76, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00386   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 68, ) }, ... 68, ) == 0x0
 00387   448   NtQueryValueKey  (68,  (68, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00388   448   NtClose  (68, ... ) == 0x0
 00389   448   NtClose  (76, ... ) == 0x0
 00390   448   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 00391   448   NtUserSystemParametersInfo  (4130, 0, 1237472, 0, ... ) == 0x1
 00392   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 76, ) }, ... 76, ) == 0x0
 00393   448   NtEnumerateValueKey  (76, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00394   448   NtClose  (76, ... ) == 0x0
 00395   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00396   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc03b
 00397   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc03d
 00398   448   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00399   448   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810cc03f
 00400   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00401   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc041
 00402   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00403   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc043
 00404   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc045
 00405   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00406   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc047
 00407   448   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00408   448   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810cc049
 00409   448   NtUserGetClassInfo  (1905590272, 1237368, 1237320, 1237396, 0, ... ) == 0xc049
 00410   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00411   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc04b
 00412   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00413   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc04d
 00414   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00415   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc04f
 00416   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc051
 00417   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00418   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc053
 00419   448   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00420   448   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810cc055
 00421   448   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810cc057
 00422   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00423   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc059
 00424   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10013
 00425   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc05b
 00426   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00427   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc05d
 00428   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00429   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc05f
 00430   448   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00431   448   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810cc017
 00432   448   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00433   448   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810cc019
 00434   448   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10013
 00435   448   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810cc018
 00436   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00437   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc01a
 00438   448   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00439   448   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ...
 00440   448   NtAllocateVirtualMemory  (-1, 6324224, 0, 4096, 4096, 32, ... 6324224, 4096, ) == 0x0
 00439   448   NtUserRegisterClassExWOW  ... ) == 0x810cc01c
 00441   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00442   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc01e
 00443   448   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00444   448   NtUserRegisterClassExWOW  (1237264, 1237344, 1237328, 1237360, 0, 384, 0, ... ) == 0x810cc01b
 00445   448   NtUserFindExistingCursorIcon  (1236748, 1236764, 1237332, ... ) == 0x10011
 00446   448   NtUserRegisterClassExWOW  (1237260, 1237340, 1237324, 1237356, 0, 384, 0, ... ) == 0x810cc068
 00447   448   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00448   448   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810cc06a
 00449   448   NtCreateKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 76, 2, ) }, 0, 0x0, 0, ... 76, 2, ) == 0x0
 00450   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "mpr.dll"}, ... 68, ) }, ... 68, ) == 0x0
 00451   448   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 69632, ) == 0x0
 00452   448   NtClose  (68, ... ) == 0x0
 00453   448   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 68, ) == 0x0
 00454   448   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 80, ) == 0x0
 00455   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 84, ) }, ... 84, ) == 0x0
 00456   448   NtNotifyChangeKey  (84, 80, 0, 0, 2011390432, 4, 0, 0, 0, 1, ... ) == 0x103
 00457   448   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00458   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 88, ) == 0x0
 00459   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 92, ) == 0x0
 00460   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00461   448   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 8339456, ) == 0x0
 00462   448   NtClose  (96, ... ) == 0x0
 00463   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SYSTEM\Setup"}, ... 96, ) }, ... 96, ) == 0x0
 00464   448   NtQueryValueKey  (96,  (96, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00465   448   NtClose  (96, ... ) == 0x0
 00466   448   NtQueryDefaultUILanguage  (1239064, ...
 00467   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00468   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482060, ) == 0x0
 00469   448   NtQueryInformationToken  (-2147482060, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00470   448   NtClose  (-2147482060, ... ) == 0x0
 00471   448   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482060, ) }, ... -2147482060, ) == 0x0
 00472   448   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00473   448   NtOpenKey  (0x80000000, {24, -2147482060, 0x640, 0, 0,  (0x80000000, {24, -2147482060, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482072, ) }, ... -2147482072, ) == 0x0
 00474   448   NtQueryValueKey  (-2147482072,  (-2147482072, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00475   448   NtClose  (-2147482072, ... ) == 0x0
 00476   448   NtClose  (-2147482060, ... ) == 0x0
 00466   448   NtQueryDefaultUILanguage  ... ) == 0x0
 00477   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00478   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 96, {status=0x0, info=1}, ) }, 1, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00479   448   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 96, ... 100, ) == 0x0
 00480   448   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x900000), 0x0, 8323072, ) == 0x0
 00481   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00482   448   NtQueryDefaultLocale  (1, 1237100, ... ) == 0x0
 00483   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00484   448   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1520, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 432, 448, 1520, 0}  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1520, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" )  ) == 0x0
 00485   448   NtClose  (96, ... ) == 0x0
 00486   448   NtClose  (100, ... ) == 0x0
 00487   448   NtUnmapViewOfSection  (-1, 0x900000, ... ) == 0x0
 00488   448   NtUnmapViewOfSection  (-1, 0x12eac4, ... ) == STATUS_NOT_MAPPED_VIEW
 00489   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00490   448   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00491   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00492   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00493   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236184, ... ) }, 1236184, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00495   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00496   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00497   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236776, ... ) }, 1236776, ... ) == 0x0
 00498   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 100, {status=0x0, info=1}, ) }, 3, 33, ... 100, {status=0x0, info=1}, ) == 0x0
 00499   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00500   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00501   448   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00502   448   NtClose  (96, ... ) == 0x0
 00503   448   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {432, 0}, ... 96, ) == 0x0
 00504   448   NtQueryInformationProcess  (96, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00505   448   NtClose  (96, ... ) == 0x0
 00506   448   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00507   448   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00508   448   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00509   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 96, ) }, ... 96, ) == 0x0
 00510   448   NtQueryValueKey  (96,  (96, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00511   448   NtClose  (96, ... ) == 0x0
 00512   448   NtUserSystemParametersInfo  (41, 500, 1238640, 0, ... ) == 0x1
 00513   448   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00514   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00515   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00516   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc03b
 00517   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00518   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc03d
 00519   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00520   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00521   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc03f
 00522   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00523   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00524   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc041
 00525   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00526   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00527   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc043
 00528   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00529   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc045
 00530   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00531   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00532   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc047
 00533   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00534   448   NtUserFindExistingCursorIcon  (1238428, 1238444, 1239012, ... ) == 0x10011
 00535   448   NtUserRegisterClassExWOW  (1238880, 1238960, 1238944, 1238976, 0, 384, 0, ... ) == 0x810cc049
 00536   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00537   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00538   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc04b
 00539   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00540   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00541   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc04d
 00542   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00543   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00544   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc04f
 00545   448   NtUserGetClassInfo  (1999896576, 1239052, 1239004, 1239080, 0, ... ) == 0x0
 00546   448   NtUserRegisterClassExWOW  (1238888, 1238968, 1238952, 1238984, 0, 384, 0, ... ) == 0x810cc051
 00547   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00548   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00549   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc053
 00550   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00551   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00552   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc055
 00553   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc057
 00554   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00555   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00556   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc059
 00557   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00558   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10013
 00559   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc05b
 00560   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00561   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00562   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc05d
 00563   448   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00564   448   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00565   448   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810cc05f
 00566   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03b
 00567   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03d
 00568   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03f
 00569   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc041
 00570   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc043
 00571   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc045
 00572   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc047
 00573   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc049
 00574   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04b
 00575   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04d
 00576   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04f
 00577   448   NtUserGetClassInfo  (1999896576, 1240804, 1240756, 1240832, 0, ... ) == 0xc051
 00578   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc053
 00579   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc055
 00580   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc059
 00581   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05b
 00582   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05d
 00583   448   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05f
 00584   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00585   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00586   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00587   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == 0x0
 00588   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 5, 96, ... 96, {status=0x0, info=1}, ) }, 5, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00589   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 96, ... 104, ) == 0x0
 00590   448   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00591   448   NtClose  (96, ... ) == 0x0
 00592   448   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0
 00593   448   NtClose  (104, ... ) == 0x0
 00594   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00595   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00596   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00597   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == 0x0
 00598   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00599   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 104, ... 96, ) == 0x0
 00600   448   NtQuerySection  (96, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00601   448   NtClose  (104, ... ) == 0x0
 00602   448   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00603   448   NtClose  (96, ... ) == 0x0
 00604   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00605   448   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00606   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 96, ) }, ... 96, ) == 0x0
 00607   448   NtQueryValueKey  (96,  (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00608   448   NtQueryValueKey  (96,  (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00609   448   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 104, ) == 0x0
 00610   448   NtOpenKey  (0x2000000, {24, 96, 0x40, 0, 0,  (0x2000000, {24, 96, 0x40, 0, 0, "Protocol_Catalog9"}, ... 108, ) }, ... 108, ) == 0x0
 00611   448   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 00612   448   NtNotifyChangeKey  (108, 104, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 00613   448   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 00614   448   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "00000019"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00615   448   NtQueryValueKey  (108,  (108, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) }, 16, ) == 0x0
 00616   448   NtQueryValueKey  (108,  (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 00617   448   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "Catalog_Entries"}, ... 112, ) }, ... 112, ) == 0x0
 00618   448   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00619   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000001"}, ... 116, ) }, ... 116, ) == 0x0
 00620   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00621   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00622   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00623   448   NtClose  (116, ... ) == 0x0
 00624   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000002"}, ... 116, ) }, ... 116, ) == 0x0
 00625   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00626   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00627   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00628   448   NtClose  (116, ... ) == 0x0
 00629   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000003"}, ... 116, ) }, ... 116, ) == 0x0
 00630   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00631   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00632   448   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 00633   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00634   448   NtClose  (116, ... ) == 0x0
 00635   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000004"}, ... 116, ) }, ... 116, ) == 0x0
 00636   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00637   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00638   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00639   448   NtClose  (116, ... ) == 0x0
 00640   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000005"}, ... 116, ) }, ... 116, ) == 0x0
 00641   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00642   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00643   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00644   448   NtClose  (116, ... ) == 0x0
 00645   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000006"}, ... 116, ) }, ... 116, ) == 0x0
 00646   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00647   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00648   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00649   448   NtClose  (116, ... ) == 0x0
 00650   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000007"}, ... 116, ) }, ... 116, ) == 0x0
 00651   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00652   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00653   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00654   448   NtClose  (116, ... ) == 0x0
 00655   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000008"}, ... 116, ) }, ... 116, ) == 0x0
 00656   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00657   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00658   448   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 00659   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00660   448   NtClose  (116, ... ) == 0x0
 00661   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000009"}, ... 116, ) }, ... 116, ) == 0x0
 00662   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00663   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00664   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00665   448   NtClose  (116, ... ) == 0x0
 00666   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000010"}, ... 116, ) }, ... 116, ) == 0x0
 00667   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00668   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00669   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\0\260\1\0\0\300\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00670   448   NtClose  (116, ... ) == 0x0
 00671   448   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000011"}, ... 116, ) }, ... 116, ) == 0x0
 00672   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00673   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00674   448   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\243\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\243\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0p\0\0\0\244\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\2\0\0\260\1\0\0\300\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\245\2\0\0\260\1\0\0\300\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\246\2\0\0\260\1\0\0\300\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\246\2\0\0\260\1\0\0\300\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0p\0\0\0\247\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0`\0\0\0D\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\250\237\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\243\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\243\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0p\0\0\0\244\2\0\0\260\1\0\0\300\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\2\0\0\260\1\0\0\300\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\245\2\0\0\260\1\0\0\300\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\246\2\0\0\260\1\0\0\300\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\246\2\0\0\260\1\0\0\300\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0p\0\0\0\247\2\0\0\260\1\0\0\300\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0`\0\0\0D\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\250\237\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) }, 900, ) == 0x0
 00675   448   NtClose  (116, ... ) == 0x0
 00676   448   NtClose  (112, ... ) == 0x0
 00677   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 00678   448   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 112, ) == 0x0
 00679   448   NtOpenKey  (0x2000000, {24, 96, 0x40, 0, 0,  (0x2000000, {24, 96, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 116, ) }, ... 116, ) == 0x0
 00680   448   NtQueryValueKey  (116,  (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00681   448   NtNotifyChangeKey  (116, 112, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 00682   448   NtQueryValueKey  (116,  (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00683   448   NtOpenKey  (0x2000000, {24, 116, 0x40, 0, 0,  (0x2000000, {24, 116, 0x40, 0, 0, "00000004"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00684   448   NtQueryValueKey  (116,  (116, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 00685   448   NtOpenKey  (0x2000000, {24, 116, 0x40, 0, 0,  (0x2000000, {24, 116, 0x40, 0, 0, "Catalog_Entries"}, ... 120, ) }, ... 120, ) == 0x0
 00686   448   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 00687   448   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000001"}, ... 124, ) }, ... 124, ) == 0x0
 00688   448   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00689   448   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00690   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00691   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00692   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00693   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00694   448   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00695   448   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00696   448   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00697   448   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00698   448   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00699   448   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00700   448   NtClose  (124, ... ) == 0x0
 00701   448   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000002"}, ... 124, ) }, ... 124, ) == 0x0
 00702   448   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00703   448   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00704   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00705   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00706   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00707   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00708   448   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 00709   448   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00710   448   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 00711   448   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00712   448   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00713   448   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00714   448   NtClose  (124, ... ) == 0x0
 00715   448   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000003"}, ... 124, ) }, ... 124, ) == 0x0
 00716   448   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00717   448   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00718   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00719   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00720   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00721   448   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00722   448   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 00723   448   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00724   448   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 00725   448   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00726   448   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00727   448   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00728   448   NtClose  (124, ... ) == 0x0
 00729   448   NtClose  (120, ... ) == 0x0
 00730   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 00731   448   NtClose  (96, ... ) == 0x0
 00732   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00733   448   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00734   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 96, ) }, ... 96, ) == 0x0
 00735   448   NtQueryValueKey  (96,  (96, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00736   448   NtClose  (96, ... ) == 0x0
 00737   448   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 96, ) == 0x0
 00738   448   NtSetInformationProcess  (-1, PriorityClass, {process info, class 18, size 2}, 3277056, ... ) == 0x0
 00739   448   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "mtx_cv_cv_v2.0"}, 0, ... 120, ) }, 0, ... 120, ) == 0x0
 00740   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cvrss.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00741   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cvrss.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00742   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00743   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00744   448   NtClose  (124, ... ) == 0x0
 00745   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00746   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00747   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0", 72, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0", 72, ... , 72, ...
 00748   448   NtSetInformationFile  (-2147482884, -136509644, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00749   448   NtSetInformationFile  (-2147482884, -136509736, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00750   448   NtSetInformationFile  (-2147482884, -136510140, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00747   448   NtSetValueKey  ... ) == 0x0
 00751   448   NtClose  (124, ... ) == 0x0
 00752   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acrmon32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00753   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acrmon32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00754   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00755   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00756   448   NtClose  (124, ... ) == 0x0
 00757   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00758   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 84, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 84, ) }, 84, ) == 0x0
 00759   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 148, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 148, ... , 148, ...
 00760   448   NtSetInformationFile  (-2147482884, -136510032, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00759   448   NtSetValueKey  ... ) == 0x0
 00761   448   NtClose  (124, ... ) == 0x0
 00762   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00763   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00764   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00765   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00766   448   NtClose  (124, ... ) == 0x0
 00767   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00768   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 160, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 160, ) }, 160, ) == 0x0
 00769   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0", 220, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0", 220, ... , 220, ...
 00770   448   NtSetInformationFile  (-2147482884, -136510032, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00769   448   NtSetValueKey  ... ) == 0x0
 00771   448   NtClose  (124, ... ) == 0x0
 00772   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00773   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00774   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00775   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00776   448   NtClose  (124, ... ) == 0x0
 00777   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00778   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 232, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 232, ) }, 232, ) == 0x0
 00779   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 296, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 296, ... ) , 296, ... ) == 0x0
 00780   448   NtClose  (124, ... ) == 0x0
 00781   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00782   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00783   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00784   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00785   448   NtClose  (124, ... ) == 0x0
 00786   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00787   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 308, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 308, ) }, 308, ) == 0x0
 00788   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 372, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 372, ... ) , 372, ... ) == 0x0
 00789   448   NtClose  (124, ... ) == 0x0
 00790   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wcescom32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00791   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wcescom32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00792   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00793   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00794   448   NtClose  (124, ... ) == 0x0
 00795   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00796   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 384, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 384, ) }, 384, ) == 0x0
 00797   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 450, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 450, ... ) , 450, ... ) == 0x0
 00798   448   NtClose  (124, ... ) == 0x0
 00799   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Userenv.dll"}, ... 124, ) }, ... 124, ) == 0x0
 00800   448   NtMapViewOfSection  (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 00801   448   NtClose  (124, ... ) == 0x0
 00802   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 124, ) }, ... 124, ) == 0x0
 00803   448   NtQueryValueKey  (124,  (124, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00804   448   NtClose  (124, ... ) == 0x0
 00805   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 124, ) }, ... 124, ) == 0x0
 00806   448   NtQueryValueKey  (124,  (124, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00807   448   NtClose  (124, ... ) == 0x0
 00808   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 124, ) }, ... 124, ) == 0x0
 00809   448   NtQueryValueKey  (124,  (124, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 00810   448   NtClose  (124, ... ) == 0x0
 00811   448   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1240992, 0,  (0x1f0003, {24, 52, 0x80, 1240992, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 124, ) }, 0, 1, ... 124, ) == STATUS_OBJECT_NAME_EXISTS
 00812   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00813   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00814   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00815   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00816   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00817   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00818   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00819   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00820   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00821   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00822   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00823   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00824   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00825   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00826   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00827   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00828   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00829   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00830   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00831   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00832   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00833   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00834   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00835   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00836   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00837   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00838   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00839   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 128, ) == 0x0
 00840   448   NtQueryInformationToken  (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00841   448   NtClose  (128, ... ) == 0x0
 00842   448   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 128, ) }, ... 128, ) == 0x0
 00843   448   NtOpenKey  (0x20019, {24, 128, 0x40, 0, 0,  (0x20019, {24, 128, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 132, ) }, ... 132, ) == 0x0
 00844   448   NtQueryValueKey  (132,  (132, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 00845   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00846   448   NtQueryValueKey  (132,  (132, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 00847   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00848   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00849   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00850   448   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00851   448   NtClose  (132, ... ) == 0x0
 00852   448   NtClose  (128, ... ) == 0x0
 00853   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00854   448   NtQueryValueKey  (128,  (128, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00855   448   NtClose  (128, ... ) == 0x0
 00856   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00857   448   NtQueryValueKey  (128,  (128, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00858   448   NtQueryValueKey  (128,  (128, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00859   448   NtClose  (128, ... ) == 0x0
 00860   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00861   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00862   448   NtQueryValueKey  (128,  (128, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00863   448   NtClose  (128, ... ) == 0x0
 00864   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00865   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 128, ) }, ... 128, ) == 0x0
 00866   448   NtQueryValueKey  (128,  (128, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (128, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 00867   448   NtClose  (128, ... ) == 0x0
 00868   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 128, ) }, ... 128, ) == 0x0
 00869   448   NtQueryValueKey  (128,  (128, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 00870   448   NtClose  (128, ... ) == 0x0
 00871   448   NtClose  (124, ... ) == 0x0
 00872   448   NtUnmapViewOfSection  (-1, 0x75a70000, ... ) == 0x0
 00873   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Task Manager.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00874   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Task Manager.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00875   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00876   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00877   448   NtClose  (124, ... ) == 0x0
 00878   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00879   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 462, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 462, ) }, 462, ) == 0x0
 00880   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 622, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 622, ... , 622, ...
 00881   448   NtSetInformationFile  (-2147482884, -136510032, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00880   448   NtSetValueKey  ... ) == 0x0
 00882   448   NtClose  (124, ... ) == 0x0
 00883   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskman.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00884   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskman.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00885   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00886   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00887   448   NtClose  (124, ... ) == 0x0
 00888   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00889   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0z\2\0\0z\3\0\0\260\1\0\0\300\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0"}, 634, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0z\2\0\0z\3\0\0\260\1\0\0\300\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0"}, 634, ) }, 634, ) == 0x0
 00890   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 784, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 784, ... ) , 784, ... ) == 0x0
 00891   448   NtClose  (124, ... ) == 0x0
 00892   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\mmedia.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00893   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\mmedia.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00894   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00895   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00896   448   NtClose  (124, ... ) == 0x0
 00897   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00898   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\34\3\0\0\203\3\0\0\260\1\0\0\300\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0"}, 796, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\34\3\0\0\203\3\0\0\260\1\0\0\300\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0"}, 796, ) }, 796, ) == 0x0
 00899   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 944, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 944, ... , 944, ...
 00900   448   NtSetInformationFile  (-2147482884, -136510032, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00899   448   NtSetValueKey  ... ) == 0x0
 00901   448   NtClose  (124, ... ) == 0x0
 00902   448   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winamp.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00903   448   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winamp.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00904   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00905   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00906   448   NtClose  (124, ... ) == 0x0
 00907   448   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00908   448   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\274\3\0\0\215\3\0\0\260\1\0\0\300\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0"}, 956, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\274\3\0\0\215\3\0\0\260\1\0\0\300\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0"}, 956, ) }, 956, ) == 0x0
 00909   448   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 1104, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 1104, ... ) , 1104, ... ) == 0x0
 00910   448   NtClose  (124, ... ) == 0x0
 00911   448   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 124, 2, ) }, 0, 0x0, 0, ... 124, 2, ) == 0x0
 00912   448   NtDeleteValueKey  (124,  (124, "ATI", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00913   448   NtDeleteValueKey  (124,  (124, "Acrobat", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00914   448   NtDeleteValueKey  (124,  (124, "Acrobat Update", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00915   448   NtDeleteValueKey  (124,  (124, "Acrobat Read", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00916   448   NtDeleteValueKey  (124,  (124, "rasman", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00917   448   NtDeleteValueKey  (124,  (124, "ActiveSync", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00918   448   NtClose  (124, ... ) == 0x0
 00919   448   NtUserRegisterClassExWOW  (1244088, 1244164, 1244180, 1244152, 0, 386, 0, ... ) == 0x810cc0cb
 00920   448   NtUserCreateWindowEx  (-2147483648, 1244072, 1243884, "-2147483648, 0, 0, 1, 1, 0, 0, 0, 0, 1073742848, 0, ...
 00921   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1240268, ... ) }, 1240268, ... ) == 0x0
 00922   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 124, {status=0x0, info=1}, ) }, 5, 96, ... 124, {status=0x0, info=1}, ) == 0x0
 00923   448   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 124, ... 128, ) == 0x0
 00924   448   NtClose  (124, ... ) == 0x0
 00925   448   NtMapViewOfSection  (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x380000), 0x0, 204800, ) == 0x0
 00926   448   NtClose  (128, ... ) == 0x0
 00927   448   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 00928   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1240584, ... ) }, 1240584, ... ) == 0x0
 00929   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0
 00930   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 128, ... 124, ) == 0x0
 00931   448   NtQuerySection  (124, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00932   448   NtClose  (128, ... ) == 0x0
 00933   448   NtMapViewOfSection  (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 212992, ) == 0x0
 00934   448   NtClose  (124, ... ) == 0x0
 00935   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00936   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00937   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00938   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00939   448   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00940   448   NtClose  (124, ... ) == 0x0
 00941   448   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 124, ) }, ... 124, ) == 0x0
 00942   448   NtOpenKey  (0x1, {24, 124, 0x40, 0, 0,  (0x1, {24, 124, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 128, ) }, ... 128, ) == 0x0
 00943   448   NtQueryValueKey  (128,  (128, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00944   448   NtClose  (128, ... ) == 0x0
 00945   448   NtClose  (124, ... ) == 0x0
 00946   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00947   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00948   448   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00949   448   NtClose  (124, ... ) == 0x0
 00950   448   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 124, ) }, ... 124, ) == 0x0
 00951   448   NtOpenKey  (0x1, {24, 124, 0x40, 0, 0,  (0x1, {24, 124, 0x40, 0, 0, "Control Panel\Desktop"}, ... 128, ) }, ... 128, ) == 0x0
 00952   448   NtQueryValueKey  (128,  (128, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00953   448   NtClose  (128, ... ) == 0x0
 00954   448   NtClose  (124, ... ) == 0x0
 00955   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00956   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00957   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == 0x0
 00958   448   NtUserGetProcessWindowStation  (... ) == 0x24
 00959   448   NtUserGetObjectInformation  (36, 2, 0, 0, 1242380, ... ) == 0x0
 00960   448   NtUserGetObjectInformation  (36, 2, 1370248, 16, 1242380, ... ) == 0x1
 00961   448   NtUserGetGUIThreadInfo  (448, 1242336, ... ) == 0x1
 00962   448   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1242156, 64, ... 124, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1242156, 64, ... 124, 0x0, 0x0, 0x0, 64, ) == 0x0
 00963   448   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 432, 448, 1522, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 432, 448, 1522, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 432, 448, 1522, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00964   448   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 432, 448, 1523, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 432, 448, 1523, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 432, 448, 1523, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00965   448   NtUserCallNoParam  (29, ...
 00966   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239628, ... ) }, 1239628, ... ) == 0x0
 00965   448   NtUserCallNoParam  ... ) == 0x0
 00967   448   NtUserSystemParametersInfo  (41, 0, 1524225160, 0, ... ) == 0x1
 00968   448   NtGdiHfontCreate  (1241708, 356, 0, 0, 1344040, ... ) == 0x110a0417
 00969   448   NtGdiHfontCreate  (1241708, 356, 0, 0, 1344032, ... ) == 0x90a0409
 00970   448   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 432, 448, 1524, 0} "\0\0\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 432, 448, 1524, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 432, 448, 1524, 0} "\0\0\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00971   448   NtMapViewOfSection  (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x380000), {0, 0}, 331776, ) == 0x0
 00972   448   NtAllocateVirtualMemory  (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0
 00973   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00974   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00975   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00976   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00977   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00978   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00979   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00980   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00981   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00982   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00983   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00984   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00985   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00986   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00987   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00988   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00989   448   NtUserGetWindowDC  (0, ... ) == 0x1010054
 00990   448   NtGdiCreatePatternBrushInternal  (59048369, 0, 0, ... ) == 0xc1003fd
 00991   448   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00992   448   NtUserCallNoParam  (29, ...
 00993   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239072, ... ) }, 1239072, ... ) == 0x0
 00992   448   NtUserCallNoParam  ... ) == 0x0
 00994   448   NtUserCallNoParam  (29, ...
 00995   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239068, ... ) }, 1239068, ... ) == 0x0
 00994   448   NtUserCallNoParam  ... ) == 0x0
 00996   448   NtUserMessageCall  (0x30064, WM_NCCREATE, 0x0, 0x12f618, 0, 670, 1, ... ) == 0x1
 00997   448   NtUserMessageCall  (0x30064, WM_NCCALCSIZE, 0x0, 0x12f64c, 0, 670, 1, ... ) == 0x0
 00998   448   NtUserSetProp  (196708, 43288, -1, ... ) == 0x1
 00999   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1240540,  (0x80100080, {24, 0, 0x40, 0, 1240540, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0
 01000   448   NtQueryInformationFile  (132, 1241476, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01001   448   NtQueryInformationFile  (132, 1241448, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01002   448   NtQueryInformationFile  (132, 1241400, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01003   448   NtAllocateVirtualMemory  (-1, 1372160, 0, 8192, 4096, 4, ... 1372160, 8192, ) == 0x0
 01004   448   NtQueryInformationFile  (132, 1371280, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01005   448   NtQueryInformationFile  (132, 1239944, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01006   448   NtQueryInformationFile  (132, 1239788, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01007   448   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1239796,  (0x40110080, {24, 0, 0x40, 0, 1239796, "\??\C:\WINDOWS\System32\qmedia.exe"}, 0x0, 32, 0, 2, 100, 0, 0, ... 136, {status=0x0, info=2}, ) }, 0x0, 32, 0, 2, 100, 0, 0, ... 136, {status=0x0, info=2}, ) == 0x0
 01008   448   NtQueryVolumeInformationFile  (136, 1239168, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01009   448   NtQueryInformationFile  (136, 1239128, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01010   448   NtQueryVolumeInformationFile  (132, 1239168, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01011   448   NtSetInformationFile  (136, 1238956, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01012   448   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 132, ... 140, ) == 0x0
 01013   448   NtMapViewOfSection  (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3e0000), {0, 0}, 49152, ) == 0x0
 01014   448   NtClose  (140, ... ) == 0x0
 01015   448   NtWriteFile  (136, 0, 0, 0,  (136, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\23\267z\336W\326\24\215W\326\24\215W\326\24\215D\336I\215U\326\24\215\324\336I\215U\326\24\215\255\365\15\215T\326\24\215W\326\25\215g\326\24\215R\332t\215\\326\24\215R\332N\215V\326\24\215RichW\326\24\215\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\204v$F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0R\0\0\0|\0\0\0\0\0\0@\24\0\0\0\20\0\0\0p\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\1\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\340q\0\0P\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0p\0\0\314\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0CODE\0\0\0\0\301\4\0\0\0\20\0\0\0\6\0\0\0\4\0\0\0\0\0\0", 48640, 0x0, 0, ... {status=0x0, info=48640}, ) , 48640, 0x0, 0, ... {status=0x0, info=48640}, ) == 0x0
 01016   448   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01017   448   NtSetInformationFile  (136, 1241400, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01018   448   NtClose  (132, ... ) == 0x0
 01019   448   NtClose  (136, ... ) == 0x0
 01020   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Userenv.dll"}, ... 136, ) }, ... 136, ) == 0x0
 01021   448   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 01022   448   NtClose  (136, ... ) == 0x0
 01023   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01024   448   NtQueryValueKey  (136,  (136, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01025   448   NtClose  (136, ... ) == 0x0
 01026   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01027   448   NtQueryValueKey  (136,  (136, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01028   448   NtClose  (136, ... ) == 0x0
 01029   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 136, ) }, ... 136, ) == 0x0
 01030   448   NtQueryValueKey  (136,  (136, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 01031   448   NtClose  (136, ... ) == 0x0
 01032   448   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1238492, 0,  (0x1f0003, {24, 52, 0x80, 1238492, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 136, ) }, 0, 1, ... 136, ) == STATUS_OBJECT_NAME_EXISTS
 01033   448   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 01034   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01035   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01036   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01037   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01038   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01039   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01040   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01041   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01042   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01043   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01044   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01045   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01046   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01047   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01048   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01049   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01050   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01051   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01052   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01053   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01054   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01055   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01056   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01057   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01058   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01059   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01060   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01061   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 132, ) == 0x0
 01062   448   NtQueryInformationToken  (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01063   448   NtClose  (132, ... ) == 0x0
 01064   448   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 132, ) }, ... 132, ) == 0x0
 01065   448   NtOpenKey  (0x20019, {24, 132, 0x40, 0, 0,  (0x20019, {24, 132, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 140, ) }, ... 140, ) == 0x0
 01066   448   NtQueryValueKey  (140,  (140, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (140, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 01067   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01068   448   NtQueryValueKey  (140,  (140, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (140, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 01069   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01070   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01071   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01072   448   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01073   448   NtClose  (140, ... ) == 0x0
 01074   448   NtClose  (132, ... ) == 0x0
 01075   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01076   448   NtQueryValueKey  (132,  (132, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01077   448   NtClose  (132, ... ) == 0x0
 01078   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01079   448   NtQueryValueKey  (132,  (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01080   448   NtQueryValueKey  (132,  (132, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01081   448   NtClose  (132, ... ) == 0x0
 01082   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01083   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01084   448   NtQueryValueKey  (132,  (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01085   448   NtClose  (132, ... ) == 0x0
 01086   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01087   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 132, ) }, ... 132, ) == 0x0
 01088   448   NtQueryValueKey  (132,  (132, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 01089   448   NtClose  (132, ... ) == 0x0
 01090   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 132, ) }, ... 132, ) == 0x0
 01091   448   NtQueryValueKey  (132,  (132, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 01092   448   NtClose  (132, ... ) == 0x0
 01093   448   NtClose  (136, ... ) == 0x0
 01094   448   NtUnmapViewOfSection  (-1, 0x75a70000, ... ) == 0x0
 01095   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239732,  (0x80100080, {24, 0, 0x40, 0, 1239732, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 136, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 136, {status=0x0, info=1}, ) == 0x0
 01096   448   NtQueryInformationFile  (136, 1240668, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01097   448   NtQueryInformationFile  (136, 1240640, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01098   448   NtQueryInformationFile  (136, 1240592, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01099   448   NtQueryInformationFile  (136, 1371584, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01100   448   NtQueryInformationFile  (136, 1239136, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01101   448   NtQueryInformationFile  (136, 1238980, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01102   448   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1238988,  (0x40110080, {24, 0, 0x40, 0, 1238988, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\icq.exe"}, 0x0, 32, 0, 2, 100, 0, 0, ... 132, {status=0x0, info=2}, ) }, 0x0, 32, 0, 2, 100, 0, 0, ... 132, {status=0x0, info=2}, ) == 0x0
 01103   448   NtQueryVolumeInformationFile  (132, 1238360, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01104   448   NtQueryInformationFile  (132, 1238320, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01105   448   NtQueryVolumeInformationFile  (136, 1238360, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01106   448   NtSetInformationFile  (132, 1238148, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01107   448   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 136, ... 140, ) == 0x0
 01108   448   NtMapViewOfSection  (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3e0000), {0, 0}, 49152, ) == 0x0
 01109   448   NtClose  (140, ... ) == 0x0
 01110   448   NtWriteFile  (132, 0, 0, 0,  (132, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\23\267z\336W\326\24\215W\326\24\215W\326\24\215D\336I\215U\326\24\215\324\336I\215U\326\24\215\255\365\15\215T\326\24\215W\326\25\215g\326\24\215R\332t\215\\326\24\215R\332N\215V\326\24\215RichW\326\24\215\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\204v$F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0R\0\0\0|\0\0\0\0\0\0@\24\0\0\0\20\0\0\0p\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\1\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\340q\0\0P\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0p\0\0\314\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0CODE\0\0\0\0\301\4\0\0\0\20\0\0\0\6\0\0\0\4\0\0\0\0\0\0", 48640, 0x0, 0, ... {status=0x0, info=48640}, ) , 48640, 0x0, 0, ... {status=0x0, info=48640}, ) == 0x0
 01111   448   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01112   448   NtSetInformationFile  (132, 1240592, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01113   448   NtClose  (136, ... ) == 0x0
 01114   448   NtClose  (132, ... ) == 0x0
 01115   448   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 132, 2, ) }, 0, 0x0, 0, ... 132, 2, ) == 0x0
 01116   448   NtSetValueKey  (132,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 0, 1,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 520, ...
 01117   448   NtSetInformationFile  (-2147482848, -136513084, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01118   448   NtSetInformationFile  (-2147482848, -136513176, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01119   448   NtSetInformationFile  (-2147482848, -136513484, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01116   448   NtSetValueKey  ... ) == 0x0
 01120   448   NtClose  (132, ... ) == 0x0
 01121   448   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 132, 2, ) }, 0, 0x0, 0, ... 132, 2, ) == 0x0
 01122   448   NtSetValueKey  (132,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 0, 1,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 520, ...
 01123   448   NtSetInformationFile  (-2147482740, -136513084, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01124   448   NtSetInformationFile  (-2147482740, -136513120, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01125   448   NtSetInformationFile  (-2147482740, -136513176, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01126   448   NtSetInformationFile  (-2147482740, -136513484, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01127   448   NtSetInformationFile  (-2147482740, -136513532, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01122   448   NtSetValueKey  ... ) == 0x0
 01128   448   NtClose  (132, ... ) == 0x0
 01129   448   NtUserSetTimer  (196708, 101, 2000, 0, ... ) == 0x65
 01130   448   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9437184, 1048576, ) == 0x0
 01131   448   NtAllocateVirtualMemory  (-1, 10477568, 0, 8192, 4096, 4, ... 10477568, 8192, ) == 0x0
 01132   448   NtProtectVirtualMemory  (-1, (0x9fe000), 4096, 260, ... (0x9fe000), 4096, 4, ) == 0x0
 01133   448   NtCreateThread  (0x1f03ff, 0x0, -1, 1240860, 1241576, 1, ... 132, {432, 588}, ) == 0x0
 01134   448   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=432,Tid=588,}, 0x0, ) == 0x0
 01135   448   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132}  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\0\260\1\0\0L\2\0\0" ... {28, 56, reply, 0, 432, 448, 1525, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\0\260\1\0\0L\2\0\0" )  ... {28, 56, reply, 0, 432, 448, 1525, 0}  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\0\260\1\0\0L\2\0\0" ... {28, 56, reply, 0, 432, 448, 1525, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\0\260\1\0\0L\2\0\0" )  ) == 0x0
 01136   448   NtResumeThread  (132, ... 1, ) == 0x0
 00920   448   NtUserCreateWindowEx  ... ) == 0x30064
 01137   448   NtUserGetMessage  (0, 0, 0, ...
 01138   588   NtTestAlert  (... ) == 0x0
 01139   588   NtContinue  (10485040, 1, ...
 01140   588   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01141   588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 136, ) == 0x0
 01142   588   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01143   588   NtAllocateVirtualMemory  (-1, 10473472, 0, 4096, 4096, 260, ... 10473472, 4096, ) == 0x0
 01144   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10481004, ... ) }, 10481004, ... ) == 0x0
 01145   588   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 140, {status=0x0, info=1}, ) }, 5, 96, ... 140, {status=0x0, info=1}, ) == 0x0
 01146   588   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 140, ... 144, ) == 0x0
 01147   588   NtClose  (140, ... ) == 0x0
 01148   588   NtMapViewOfSection  (144, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa00000), 0x0, 229376, ) == 0x0
 01149   588   NtClose  (144, ... ) == 0x0
 01150   588   NtUnmapViewOfSection  (-1, 0xa00000, ... ) == 0x0
 01151   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10481320, ... ) }, 10481320, ... ) == 0x0
 01152   588   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 144, {status=0x0, info=1}, ) }, 5, 96, ... 144, {status=0x0, info=1}, ) == 0x0
 01153   588   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 144, ... 140, ) == 0x0
 01154   588   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01155   588   NtClose  (144, ... ) == 0x0
 01156   588   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 241664, ) == 0x0
 01157   588   NtClose  (140, ... ) == 0x0
 01158   588   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01159   588   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01160   588   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 140, ) == 0x0
 01161   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10480648, ... ) }, 10480648, ... ) == 0x0
 01162   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... 144, ) }, ... 144, ) == 0x0
 01163   588   NtQueryValueKey  (144,  (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) , Partial, 144, ... TitleIdx=0, Type=7, Data= (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) }, 42, ) == 0x0
 01164   588   NtQueryValueKey  (144,  (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) , Partial, 144, ... TitleIdx=0, Type=7, Data= (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) }, 42, ) == 0x0
 01165   588   NtClose  (144, ... ) == 0x0
 01166   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... 144, ) }, ... 144, ) == 0x0
 01167   588   NtQueryValueKey  (144,  (144, "Mapping", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01168   588   NtQueryValueKey  (144,  (144, "Mapping", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01169   588   NtQueryValueKey  (144,  (144, "Mapping", Partial, 152, ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) , Partial, 152, ... TitleIdx=0, Type=3, Data= (144, "Mapping", Partial, 152, ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01170   588   NtClose  (144, ... ) == 0x0
 01171   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... 144, ) }, ... 144, ) == 0x0
 01172   588   NtQueryValueKey  (144,  (144, "MinSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "MinSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01173   588   NtQueryValueKey  (144,  (144, "MaxSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "MaxSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01174   588   NtQueryValueKey  (144,  (144, "UseDelayedAcceptance", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "UseDelayedAcceptance", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01175   588   NtQueryValueKey  (144,  (144, "HelperDllName", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "HelperDllName", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01176   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 10481568, ... ) }, 10481568, ... ) == 0x0
 01177   588   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 01178   588   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 148, ... 152, ) == 0x0
 01179   588   NtClose  (148, ... ) == 0x0
 01180   588   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3e0000), 0x0, 20480, ) == 0x0
 01181   588   NtClose  (152, ... ) == 0x0
 01182   588   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01183   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 10481884, ... ) }, 10481884, ... ) == 0x0
 01184   588   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 01185   588   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 152, ... 148, ) == 0x0
 01186   588   NtQuerySection  (148, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01187   588   NtClose  (152, ... ) == 0x0
 01188   588   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 01189   588   NtClose  (148, ... ) == 0x0
 01190   588   NtClose  (144, ... ) == 0x0
 01191   588   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 10484084, 75, ... }, 0x0, 0, 3, 3, 0, 10484084, 75, ...
 01192   588   NtClose  (-2147482060, ... ) == 0x0
 01191   588   NtCreateFile  ... 144, {status=0x0, info=0}, ) == 0x0
 01193   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x1207b,  (144, 140, 0x0, 0x0, 0x1207b, "\7\0\0\0\340\0\0\0\30\361\24\0\17\346\367w", 16, 16, ... {status=0x0, info=16}, "\7\0\0\0B\0\0\0\0 \0\0pw\14\201", ) , 16, 16, ... {status=0x0, info=16},  (144, 140, 0x0, 0x0, 0x1207b, "\7\0\0\0\340\0\0\0\30\361\24\0\17\346\367w", 16, 16, ... {status=0x0, info=16}, "\7\0\0\0B\0\0\0\0 \0\0pw\14\201", ) , ) == 0x0
 01194   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x1207b,  (144, 140, 0x0, 0x0, 0x1207b, "\6\0\0\0B\0\0\0\0 \0\0pw\14\201", 16, 16, ... {status=0x0, info=16}, "\6\0\0\0B\0\0\0\0 \0\0pw\14\201", ) , 16, 16, ... {status=0x0, info=16},  (144, 140, 0x0, 0x0, 0x1207b, "\6\0\0\0B\0\0\0\0 \0\0pw\14\201", 16, 16, ... {status=0x0, info=16}, "\6\0\0\0B\0\0\0\0 \0\0pw\14\201", ) , ) == 0x0
 01195   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12047,  (144, 140, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\353\3\0\0\11\6\2\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\30\361\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... {status=0x0, info=0}, "", ) , 248, 16, ... {status=0x0, info=0}, "", ) == 0x0
 01196   588   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01197   588   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 01198   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01199   588   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01200   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01201   588   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01202   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == 0x0
 01203   588   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 01204   588   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 152, ) == 0x0
 01205   588   NtQuerySection  (152, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01206   588   NtClose  (148, ... ) == 0x0
 01207   588   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 151552, ) == 0x0
 01208   588   NtClose  (152, ... ) == 0x0
 01209   588   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 152, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 152, 2, ) , 0, ... 152, 2, ) == 0x0
 01210   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 148, ) }, ... 148, ) == 0x0
 01211   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   588   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DNS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01213   588   NtQueryValueKey  (148,  (148, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01214   588   NtQueryValueKey  (152,  (152, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01215   588   NtQueryValueKey  (148,  (148, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01216   588   NtQueryValueKey  (152,  (152, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01217   588   NtQueryValueKey  (148,  (148, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   588   NtQueryValueKey  (152,  (152, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01219   588   NtQueryValueKey  (148,  (148, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01220   588   NtQueryValueKey  (152,  (152, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01221   588   NtQueryValueKey  (148,  (148, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01222   588   NtQueryValueKey  (148,  (148, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01223   588   NtQueryValueKey  (148,  (148, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01224   588   NtQueryValueKey  (148,  (148, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01225   588   NtQueryValueKey  (148,  (148, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01226   588   NtQueryValueKey  (148,  (148, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01227   588   NtQueryValueKey  (148,  (148, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01228   588   NtQueryValueKey  (152,  (152, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01229   588   NtQueryValueKey  (148,  (148, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01230   588   NtQueryValueKey  (148,  (148, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01231   588   NtQueryValueKey  (152,  (152, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01232   588   NtQueryValueKey  (148,  (148, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01233   588   NtQueryValueKey  (152,  (152, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01234   588   NtQueryValueKey  (148,  (148, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01235   588   NtQueryValueKey  (152,  (152, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01236   588   NtQueryValueKey  (148,  (148, "RegistrationOverwritesInConflict", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01237   588   NtQueryValueKey  (152,  (152, "DisableReplaceAddressesInConflicts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01238   588   NtQueryValueKey  (148,  (148, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01239   588   NtQueryValueKey  (152,  (152, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01240   588   NtQueryValueKey  (148,  (148, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01241   588   NtQueryValueKey  (152,  (152, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01242   588   NtQueryValueKey  (148,  (148, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01243   588   NtQueryValueKey  (152,  (152, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01244   588   NtQueryValueKey  (148,  (148, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01245   588   NtQueryValueKey  (152,  (152, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01246   588   NtQueryValueKey  (148,  (148, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01247   588   NtQueryValueKey  (148,  (148, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01248   588   NtQueryValueKey  (148,  (148, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01249   588   NtQueryValueKey  (148,  (148, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01250   588   NtQueryValueKey  (148,  (148, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01251   588   NtQueryValueKey  (148,  (148, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01252   588   NtQueryValueKey  (148,  (148, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01253   588   NtQueryValueKey  (148,  (148, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01254   588   NtQueryValueKey  (148,  (148, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01255   588   NtQueryValueKey  (148,  (148, "UseMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01256   588   NtQueryValueKey  (148,  (148, "MulticastOnNameError", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01257   588   NtQueryValueKey  (148,  (148, "UseDotLocalDomain", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01258   588   NtQueryValueKey  (148,  (148, "ListenOnMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01259   588   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 156, ) }, ... 156, ) == 0x0
 01260   588   NtQueryValueKey  (156,  (156, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (156, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01261   588   NtClose  (156, ... ) == 0x0
 01262   588   NtClose  (152, ... ) == 0x0
 01263   588   NtClose  (148, ... ) == 0x0
 01264   588   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 148, ) }, ... 148, ) == 0x0
 01265   588   NtQueryValueKey  (148,  (148, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01266   588   NtQueryValueKey  (148,  (148, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01267   588   NtQueryValueKey  (148,  (148, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01268   588   NtClose  (148, ... ) == 0x0
 01269   588   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01270   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01271   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 148, ) }, ... 148, ) == 0x0
 01272   588   NtQueryValueKey  (148,  (148, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01273   588   NtClose  (148, ... ) == 0x0
 01274   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01275   588   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0
 01276   588   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 152, ) == 0x0
 01277   588   NtQuerySystemTime  (... {-81455738, 29873102}, ) == 0x0
 01278   588   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 156, ) == 0x0
 01279   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01280   588   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01281   588   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01282   588   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01283   588   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 160, ) == 0x0
 01284   588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 164, ) == 0x0
 01285   588   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01286   588   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481416, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481416, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01287   588   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850}  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 588, 1527, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 588, 1527, 0}  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 588, 1527, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" )  ) == 0x0
 01288   588   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0
 01289   588   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 0, 0, 0, 0, 0}  (172, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 432, 588, 1528, 0} "\2P\375\177\1\00\300\0\0\0\0p\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360V\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 432, 588, 1528, 0}  (172, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 432, 588, 1528, 0} "\2P\375\177\1\00\300\0\0\0\0p\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360V\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01290   588   NtClose  (168, ... ) == 0x0
 01291   588   NtClose  (172, ... ) == 0x0
 01292   588   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01293   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01294   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01295   588   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01296   588   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01297   588   NtClose  (172, ... ) == 0x0
 01298   588   NtClose  (168, ... ) == 0x0
 01299   588   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01300   588   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481280, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481280, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01301   588   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850}  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 588, 1531, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 588, 1531, 0}  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 588, 1531, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 01302   588   NtRequestWaitReplyPort  (172, {44, 68, new_msg, 0, 432, 588, 1528, 0}  (172, {44, 68, new_msg, 0, 432, 588, 1528, 0} "\1P\0\0A\2\4\0\0\0\0\0p\6\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 432, 588, 1532, 0} "\2P\375\177\4\00\300\0\0\0\0p\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\1\0\0\240,\11\0" )  ... {40, 64, reply, 0, 432, 588, 1532, 0}  (172, {44, 68, new_msg, 0, 432, 588, 1528, 0} "\1P\0\0A\2\4\0\0\0\0\0p\6\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 432, 588, 1532, 0} "\2P\375\177\4\00\300\0\0\0\0p\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\1\0\0\240,\11\0" )  ) == 0x0
 01303   588   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 56, 0, 1, 0, 0}  (172, {64, 88, new_msg, 56, 0, 1, 0, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {64, 88, reply, 56, 432, 588, 1533, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {64, 88, reply, 56, 432, 588, 1533, 0}  (172, {64, 88, new_msg, 56, 0, 1, 0, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {64, 88, reply, 56, 432, 588, 1533, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01304   588   NtClose  (168, ... ) == 0x0
 01305   588   NtClose  (172, ... ) == 0x0
 01306   588   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01307   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01308   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01309   588   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01310   588   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01311   588   NtClose  (172, ... ) == 0x0
 01312   588   NtClose  (168, ... ) == 0x0
 01313   588   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01314   588   NtQueryValueKey  (168,  (168, "DnsNbtLookupOrder", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01315   588   NtClose  (168, ... ) == 0x0
 01316   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01317   588   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 168, {status=0x0, info=1}, ) }, 5, 96, ... 168, {status=0x0, info=1}, ) == 0x0
 01318   588   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 168, ... 172, ) == 0x0
 01319   588   NtClose  (168, ... ) == 0x0
 01320   588   NtMapViewOfSection  (172, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3e0000), 0x0, 16384, ) == 0x0
 01321   588   NtClose  (172, ... ) == 0x0
 01322   588   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01323   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 10481140, ... ) }, 10481140, ... ) == 0x0
 01324   588   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01325   588   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 168, ) == 0x0
 01326   588   NtQuerySection  (168, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01327   588   NtClose  (172, ... ) == 0x0
 01328   588   NtMapViewOfSection  (168, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fb0000), 0x0, 28672, ) == 0x0
 01329   588   NtClose  (168, ... ) == 0x0
 01330   588   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 168, ) }, ... 168, ) == 0x0
 01331   588   NtMapViewOfSection  (168, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0
 01332   588   NtClose  (168, ... ) == 0x0
 01333   588   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01334   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 172, ) }, ... 172, ) == 0x0
 01335   588   NtQueryValueKey  (172,  (172, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01336   588   NtClose  (172, ... ) == 0x0
 01337   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01338   588   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01339   588   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4063232, 65536, ) == 0x0
 01340   588   NtAllocateVirtualMemory  (-1, 4063232, 0, 4096, 4096, 4, ... 4063232, 4096, ) == 0x0
 01341   588   NtAllocateVirtualMemory  (-1, 4067328, 0, 8192, 4096, 4, ... 4067328, 8192, ) == 0x0
 01342   588   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01343   588   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481112, 112, ... 176, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481112, 112, ... 176, 0x0, 0x0, 0x0, 112, ) == 0x0
 01344   588   NtRequestWaitReplyPort  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850}  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850} "\0\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 588, 1536, 0} "\7\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 588, 1536, 0}  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850} "\0\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 588, 1536, 0} "\7\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" )  ) == 0x0
 01345   588   NtRequestWaitReplyPort  (176, {64, 88, new_msg, 0, 432, 588, 1532, 0}  (176, {64, 88, new_msg, 0, 432, 588, 1532, 0} "\1P\0\0A\2\10\0\0\0\0\0p\6\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 432, 588, 1537, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 432, 588, 1537, 0}  (176, {64, 88, new_msg, 0, 432, 588, 1532, 0} "\1P\0\0A\2\10\0\0\0\0\0p\6\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 432, 588, 1537, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01346   588   NtClose  (172, ... ) == 0x0
 01347   588   NtClose  (176, ... ) == 0x0
 01348   588   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) , 0, ... 176, 2, ) == 0x0
 01349   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01350   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01351   588   NtQueryValueKey  (176,  (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01352   588   NtQueryValueKey  (176,  (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01353   588   NtClose  (176, ... ) == 0x0
 01354   588   NtClose  (172, ... ) == 0x0
 01355   588   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01356   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 176, ) }, ... 176, ) == 0x0
 01357   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01358   588   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01359   588   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01360   588   NtClose  (172, ... ) == 0x0
 01361   588   NtClose  (176, ... ) == 0x0
 01362   588   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 01363   588   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0
 01364   588   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 176, ) == 0x0
 01365   588   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10480912, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10480912, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01366   588   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850}  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850} "\0\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 588, 1540, 0} "\7\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 588, 1540, 0}  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850} "\0\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 588, 1540, 0} "\7\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 01367   588   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 0, 432, 588, 1537, 0}  (172, {64, 88, new_msg, 0, 432, 588, 1537, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 432, 588, 1541, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 432, 588, 1541, 0}  (172, {64, 88, new_msg, 0, 432, 588, 1537, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 432, 588, 1541, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01368   588   NtClose  (176, ... ) == 0x0
 01369   588   NtClose  (172, ... ) == 0x0
 01370   588   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01371   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 176, ) }, ... 176, ) == 0x0
 01372   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01373   588   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01374   588   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01375   588   NtClose  (172, ... ) == 0x0
 01376   588   NtClose  (176, ... ) == 0x0
 01377   588   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) , 0, ... 176, 2, ) == 0x0
 01378   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01379   588   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01380   588   NtQueryValueKey  (176,  (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01381   588   NtQueryValueKey  (176,  (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01382   588   NtClose  (176, ... ) == 0x0
 01383   588   NtClose  (172, ... ) == 0x0
 01384   588   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01385   588   NtQueryValueKey  (172,  (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01386   588   NtQueryValueKey  (172,  (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01387   588   NtQueryValueKey  (172,  (172, "AutodialDLL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01388   588   NtClose  (172, ... ) == 0x0
 01389   588   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rasadhlp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01390   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01391   588   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01392   588   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == 0x0
 01393   588   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasadhlp.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01394   588   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 176, ) == 0x0
 01395   588   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01396   588   NtClose  (172, ... ) == 0x0
 01397   588   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fc0000), 0x0, 20480, ) == 0x0
 01398   588   NtClose  (176, ... ) == 0x0
 01399   588   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 176, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 176, {status=0x0, info=0}, ) == 0x0
 01400   588   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01401   588   NtDeviceIoControlFile  (176, 172, 0x0, 0x0, 0xf14014,  (176, 172, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\20\0\0\0\0\360\375\177h\2\374v\1\0\0\0\340\361\237\0D\365\237\0D\365\237\0\2$\370w\310j\367w\377\377\377\377\364j\365w$P\374w`i\365w\0\0\0\0\10\0\25\300\0\0\0\0\10\6\24\0@.$\0\254\36$\0\210/$\0\0\320\375\177\24\232\347wS\16\26\0\200\17\25\0\216\17\25\0T\16\25\0x/$\0\30\0\26\2\20\363\237\0\20\363\237\0r\0a\0s\0a\0d\0h\0l\0p\0.\0d\0l\0l\0\0\0\0\0T\16\25\0\377\377\0\0\1\0\0\0\370\24\25\0\240\31\25\0 \0\0\0\0\0\0\0\210\1\24\0\230\31\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245qH\16\25\04\16\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\260\31\1\1\0\0\24\0\340\362\237\0\300\367\237\0\334\377\237\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\260\31\25\0\210\350\24\0@\203\24\0X\203\24\0\200\17\25\0\216\17\25\0T\16\25\0\377\377\0\0\0\0\0\0T\16\25\0\7\0\0\0\200\17\25\0\20\364\237\0\177;\245q\0\0\0\0\0\0\0\0\200\17\25\0\0\0\0\0T\16\25\0\377\377\0\0\1\0\0\0\230\1\24\0\350\24\25\0\20\0\0\0\0\0\0\0\230\1\24\0\340\24\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245qH\16\25\04\16\25\0\4\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\247\1\1\0\0\24\0\250\363\237\0\210\370\237\0\334\377\237\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\247\24\0\210\350\24\0@\203\24\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) , 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01402   588   NtClose  (172, ... ) == 0x0
 01403   588   NtClose  (176, ... ) == 0x0
 01404   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12003,  (144, 140, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0,\354\300\250|\201\0\0\0\0\0\0\0\0", 26, 26, ... {status=0x0, info=176}, "\1\0\0\0\1\0\0\0\16\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0", ) , 26, 26, ... {status=0x0, info=176},  (144, 140, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0,\354\300\250|\201\0\0\0\0\0\0\0\0", 26, 26, ... {status=0x0, info=176}, "\1\0\0\0\1\0\0\0\16\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01405   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12037,  (144, 140, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , 4, 8, ... {status=0x0, info=8},  (144, 140, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01406   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12047,  (144, 140, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\353\3\0\0\11\6\2\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\0\0\0\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... {status=0x0, info=0}, 0x0, ) , 248, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01407   588   NtDeviceIoControlFile  (176, 0, 0x0, 0x0, 0x120028,  (176, 0, 0x0, 0x0, 0x120028, "\1\4\0\0\0\0\0\0\0\2\0\0\0\2\0\0\15\0\0\0\4\0\0\0\1\0\0\00}\0\0", 32, 0, ... {status=0x0, info=0}, 0x0, ) , 32, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01408   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=0}, 0x0, ) , 16, 0, ... {status=0x103, info=0}, 0x0, ) == 0x103
 01409   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01410   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=78}, 0x0, ) , 16, 0, ... {status=0x103, info=78}, 0x0, ) == 0x103
 01411   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01412   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=40}, 0x0, ) , 16, 0, ... {status=0x103, info=40}, 0x0, ) == 0x103
 01413   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01414   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=78}, 0x0, ) , 16, 0, ... {status=0x103, info=78}, 0x0, ) == 0x103
 01415   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01416   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=81}, 0x0, ) , 16, 0, ... {status=0x0, info=81}, 0x0, ) == 0x0
 01417   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01418   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01419   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01420   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=128}, 0x0, ) , 16, 0, ... {status=0x0, info=128}, 0x0, ) == 0x0
 01421   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01422   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01423   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01424   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01425   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01426   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01427   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01428   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01429   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01430   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01431   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01432   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01433   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01434   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01435   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01436   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01437   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01438   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01439   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01440   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01441   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01442   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01443   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01444   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01445   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01446   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01447   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01448   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01449   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01450   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01451   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01452   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01453   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01454   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01455   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01456   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01457   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01458   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01459   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01460   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01461   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01462   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01463   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01464   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01465   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01466   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01467   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01468   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01469   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01470   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01471   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01472   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01473   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01474   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01475   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01476   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01477   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01478   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01479   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01480   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01481   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01482   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01483   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01484   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01485   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01486   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01487   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01488   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01489   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01490   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01491   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01492   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01493   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01494   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01495   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01496   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01497   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01498   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01499   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01500   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01501   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01502   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01503   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01504   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01505   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01506   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01507   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01508   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01509   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01510   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01511   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01512   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01513   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01514   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01515   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01516   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01517   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01518   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01519   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01520   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01521   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01522   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01523   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01524   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01525   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01526   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01527   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01528   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01529   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01530   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01531   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01532   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01533   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01534   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01535   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01536   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01537   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01538   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01539   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01540   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01541   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01542   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01543   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01544   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01545   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01546   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01547   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01548   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01549   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01550   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01551   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01552   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01553   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01554   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01555   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01556   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01557   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01558   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01559   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01560   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01561   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01562   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01563   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01564   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01565   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01566   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01567   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01568   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01569   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01570   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01571   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01572   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01573   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01574   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01575   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01576   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01577   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01578   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01579   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01580   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01581   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01582   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01583   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01584   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01585   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01586   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01587   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01588   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01589   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01590   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01591   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01592   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01593   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01594   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01595   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01596   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01597   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01598   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01599   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01600   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01601   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01602   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01603   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01604   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01605   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01606   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01607   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01608   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01609   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01610   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01611   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01612   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01613   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01614   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01615   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01616   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01617   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01618   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01619   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01620   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01621   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01622   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01623   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01624   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01625   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01626   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01627   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01628   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01629   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01630   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01631   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01632   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01633   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01634   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01635   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01636   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01637   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01638   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01639   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01640   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01641   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01642   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01643   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01644   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01645   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01646   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01647   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01648   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01649   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01650   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01651   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01652   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01653   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01654   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01655   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01656   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01657   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01658   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01659   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01660   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01661   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01662   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01663   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01664   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01665   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01666   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01667   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01668   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01669   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01670   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01671   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01672   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01673   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01674   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01675   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01676   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01677   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01678   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01679   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01680   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01681   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01682   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01683   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01684   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01685   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01686   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01687   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01688   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01689   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01690   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01691   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01692   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01693   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01694   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01695   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01696   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01697   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01698   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01699   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01700   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01701   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01702   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01703   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01704   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01705   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01706   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01707   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01708   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01709   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01710   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01711   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01712   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01713   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01714   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01715   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01716   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01717   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01718   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01719   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01720   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01721   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01722   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01723   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01724   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01725   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01726   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01727   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01728   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01729   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01730   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01731   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01732   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01733   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01734   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01735   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01736   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01737   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01738   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01739   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01740   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01741   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01742   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01743   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01744   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01745   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01746   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01747   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01748   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01749   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01750   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01751   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01752   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01753   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01754   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01755   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01756   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01757   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01758   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01759   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01760   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01761   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01762   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01763   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01764   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01765   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01766   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01767   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01768   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01769   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01770   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01771   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01772   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01773   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01774   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01775   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01776   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01777   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01778   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01779   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01780   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01781   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01782   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01783   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01784   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01785   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01786   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01787   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01788   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01789   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01790   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01791   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01792   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01793   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01794   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01795   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01796   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01797   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01798   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01799   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01800   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01801   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01802   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01803   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01804   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01805   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01806   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01807   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01808   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01809   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01810   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01811   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01812   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01813   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01814   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01815   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01816   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01817   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01818   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01819   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01820   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01821   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01822   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01823   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01824   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01825   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01826   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01827   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01828   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01829   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01830   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01831   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01832   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01833   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01834   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01835   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01836   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01837   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01838   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01839   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01840   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01841   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01842   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01843   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01844   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01845   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01846   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01847   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01848   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01849   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01850   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01851   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01852   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01853   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01854   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01855   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01856   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01857   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01858   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01859   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01860   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01861   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01862   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01863   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01864   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01865   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01866   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01867   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01868   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01869   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01870   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01871   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01872   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=78}, 0x0, ) , 16, 0, ... {status=0x0, info=78}, 0x0, ) == 0x0
 01873   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=78}, 0x0, ) , 16, 0, ... {status=0x103, info=78}, 0x0, ) == 0x103
 01874   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01875   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01876   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01877   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01137   448   NtUserGetMessage  ... {0x30064, WM_TIMER, 0x65, 0x0, 0x7975, {512, 384}}, ) == 0x1
 01878   448   NtQueryValueKey  (76,  (76, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01879   448   NtQueryValueKey  (76,  (76, "SecureProtocols", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01880   448   NtQueryValueKey  (76,  (76, "CertificateRevocation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01881   448   NtQueryValueKey  (76,  (76, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01882   448   NtQueryValueKey  (76,  (76, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01883   448   NtQueryValueKey  (76,  (76, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01884   448   NtQueryValueKey  (76,  (76, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01885   448   NtQueryValueKey  (76,  (76, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01886   448   NtQueryValueKey  (76,  (76, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01887   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01888   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1239992, ... }, 1239992, ...
 01877   588   NtWaitForSingleObject  ... ) == 0x0
 01889   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 01890   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01888   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01891   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "Secur32.dll"}, 1239992, ... }, 1239992, ...
 01890   588   NtWaitForSingleObject  ... ) == 0x0
 01892   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 01893   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01891   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01894   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 1239992, ... ) }, 1239992, ... ) == 0x0
 01895   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01896   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 180, ) == 0x0
 01897   448   NtQuerySection  (180, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01898   448   NtClose  (172, ... ) == 0x0
 01899   448   NtMapViewOfSection  (180, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f90000), 0x0, 65536, ) == 0x0
 01900   448   NtClose  (180, ... ) == 0x0
 01901   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 180, ) == 0x0
 01902   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 172, ) == 0x0
 01903   448   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 184, ) }, ... 184, ) == 0x0
 01904   448   NtQueryEvent  (184, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 01905   448   NtClose  (184, ... ) == 0x0
 01906   448   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1241476, 140, ... 184, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241476, 140, ... 184, 0x0, 0x0, 256, 140, ) == 0x0
 01907   448   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 432, 448, 1612, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 432, 448, 1612, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 432, 448, 1612, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 01908   448   NtQueryValueKey  (76,  (76, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01909   448   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01910   448   NtQueryValueKey  (188,  (188, "FixupKey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01911   448   NtClose  (188, ... ) == 0x0
 01912   448   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01913   448   NtQueryValueKey  (188,  (188, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01914   448   NtClose  (188, ... ) == 0x0
 01915   448   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01916   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 192, ) }, ... 192, ) == 0x0
 01917   448   NtQueryValueKey  (192,  (192, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (192, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01918   448   NtClose  (192, ... ) == 0x0
 01919   448   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 192, ) }, ... 192, ) == 0x0
 01920   448   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 196, ) }, ... 196, ) == 0x0
 01921   448   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 200, ) }, ... 200, ) == 0x0
 01922   448   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 204, ) }, ... 204, ) == 0x0
 01923   448   NtQueryValueKey  (204,  (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01924   448   NtQueryValueKey  (204,  (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01925   448   NtClose  (204, ... ) == 0x0
 01926   448   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 204, ) }, ... 204, ) == 0x0
 01927   448   NtQueryValueKey  (204,  (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01928   448   NtQueryValueKey  (204,  (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01929   448   NtQueryValueKey  (204,  (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01930   448   NtQueryValueKey  (204,  (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01931   448   NtQueryValueKey  (204,  (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01932   448   NtQueryValueKey  (204,  (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01933   448   NtClose  (204, ... ) == 0x0
 01934   448   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Content"}, ... 204, ) }, ... 204, ) == 0x0
 01935   448   NtQueryValueKey  (204,  (204, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01936   448   NtClose  (204, ... ) == 0x0
 01937   448   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Content"}, ... 204, ) }, ... 204, ) == 0x0
 01938   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01939   448   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1374360, 0,  (0x1f0003, {24, 52, 0x80, 1374360, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 208, ) }, 0, 2147483647, ... 208, ) == STATUS_OBJECT_NAME_EXISTS
 01940   448   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 01941   448   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 01942   448   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01943   448   NtQueryValueKey  (212,  (212, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01944   448   NtClose  (212, ... ) == 0x0
 01945   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 01946   448   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01947   448   NtSetValueKey  (212,  (212, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 0, 1,  (212, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 150, ... ) == 0x0
 01948   448   NtClose  (212, ... ) == 0x0
 01949   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 01950   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 01951   448   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 01952   448   NtSetInformationFile  (212, 1239744, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01953   448   NtClose  (212, ... ) == 0x0
 01954   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\desktop.ini"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 01955   448   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01956   448   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01957   448   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) }, 16, ) == 0x0
 01958   448   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 212, ) }, ... 212, ) == 0x0
 01959   448   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "Paths"}, ... 216, ) }, ... 216, ) == 0x0
 01960   448   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path1"}, ... 220, ) }, ... 220, ) == 0x0
 01961   448   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path2"}, ... 224, ) }, ... 224, ) == 0x0
 01962   448   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path3"}, ... 228, ) }, ... 228, ) == 0x0
 01963   448   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path4"}, ... 232, ) }, ... 232, ) == 0x0
 01964   448   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "Special Paths"}, ... 236, ) }, ... 236, ) == 0x0
 01965   448   NtSetValueKey  (216,  (216, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 0, 1,  (216, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 174, ... ) == 0x0
 01966   448   NtSetValueKey  (216,  (216, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 0, 4,  (216, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 4, ... ) == 0x0
 01967   448   NtSetValueKey  (220,  (220, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 0, 1,  (220, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01968   448   NtSetValueKey  (224,  (224, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 0, 1,  (224, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01969   448   NtSetValueKey  (228,  (228, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 0, 1,  (228, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01970   448   NtSetValueKey  (232,  (232, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 0, 1,  (232, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01971   448   NtSetValueKey  (220,  (220, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (220, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01972   448   NtSetValueKey  (224,  (224, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (224, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01973   448   NtSetValueKey  (228,  (228, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (228, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01974   448   NtSetValueKey  (232,  (232, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (232, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01975   448   NtClose  (232, ... ) == 0x0
 01976   448   NtClose  (228, ... ) == 0x0
 01977   448   NtClose  (224, ... ) == 0x0
 01978   448   NtClose  (220, ... ) == 0x0
 01979   448   NtClose  (216, ... ) == 0x0
 01980   448   NtClose  (236, ... ) == 0x0
 01981   448   NtClose  (212, ... ) == 0x0
 01982   448   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Cookies"}, ... 212, ) }, ... 212, ) == 0x0
 01983   448   NtQueryValueKey  (212,  (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01984   448   NtClose  (212, ... ) == 0x0
 01985   448   NtClose  (204, ... ) == 0x0
 01986   448   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Cookies"}, ... 204, ) }, ... 204, ) == 0x0
 01987   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01988   448   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 01989   448   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 01990   448   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01991   448   NtQueryValueKey  (212,  (212, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01992   448   NtClose  (212, ... ) == 0x0
 01993   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 01994   448   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01995   448   NtSetValueKey  (212,  (212, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 0, 1,  (212, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 86, ... ) == 0x0
 01996   448   NtClose  (212, ... ) == 0x0
 01997   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 01998   448   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01999   448   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 02000   448   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02001   448   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "History"}, ... 212, ) }, ... 212, ) == 0x0
 02002   448   NtQueryValueKey  (212,  (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02003   448   NtClose  (212, ... ) == 0x0
 02004   448   NtClose  (204, ... ) == 0x0
 02005   448   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "History"}, ... 204, ) }, ... 204, ) == 0x0
 02006   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02007   448   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 02008   448   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 02009   448   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02010   448   NtQueryValueKey  (212,  (212, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 02011   448   NtClose  (212, ... ) == 0x0
 02012   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 02013   448   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02014   448   NtSetValueKey  (212,  (212, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 0, 1,  (212, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 116, ... ) == 0x0
 02015   448   NtClose  (212, ... ) == 0x0
 02016   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 02017   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 02018   448   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 02019   448   NtSetInformationFile  (212, 1239744, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02020   448   NtClose  (212, ... ) == 0x0
 02021   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\desktop.ini"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 02022   448   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 02023   448   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 02024   448   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02025   448   NtClose  (204, ... ) == 0x0
 02026   448   NtClose  (200, ... ) == 0x0
 02027   448   NtClose  (192, ... ) == 0x0
 02028   448   NtClose  (196, ... ) == 0x0
 02029   448   NtClose  (188, ... ) == 0x0
 02030   448   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "_!MSFTHISTORY!_"}, ... 188, ) }, ... 188, ) == 0x0
 02031   448   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!temporary internet files!content.ie5!"}, ... 196, ) }, ... 196, ) == 0x0
 02032   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02033   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 3, 8388641, ... 192, {status=0x0, info=1}, ) }, 3, 8388641, ... 192, {status=0x0, info=1}, ) == 0x0
 02034   448   NtQueryVolumeInformationFile  (192, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02035   448   NtClose  (192, ... ) == 0x0
 02036   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 192, {status=0x0, info=1}, ) }, 3, 8388641, ... 192, {status=0x0, info=1}, ) == 0x0
 02037   448   NtQueryVolumeInformationFile  (192, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02038   448   NtClose  (192, ... ) == 0x0
 02039   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02040   448   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 192, {status=0x0, info=1}, ) }, 7, 2113568, ... 192, {status=0x0, info=1}, ) == 0x0
 02041   448   NtSetInformationFile  (192, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02042   448   NtClose  (192, ... ) == 0x0
 02043   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) == 0x0
 02044   448   NtSetInformationFile  (192, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02045   448   NtQueryInformationFile  (192, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02046   448   NtClose  (192, ... ) == 0x0
 02047   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) == 0x0
 02048   448   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768"}, ... 200, ) }, ... 200, ) == 0x0
 02049   448   NtMapViewOfSection  (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3f0000), {0, 0}, 32768, ) == 0x0
 02050   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02051   448   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!cookies!"}, ... 204, ) }, ... 204, ) == 0x0
 02052   448   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 02053   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 3, 8388641, ... 212, {status=0x0, info=1}, ) }, 3, 8388641, ... 212, {status=0x0, info=1}, ) == 0x0
 02054   448   NtQueryVolumeInformationFile  (212, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02055   448   NtClose  (212, ... ) == 0x0
 02056   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 212, {status=0x0, info=1}, ) }, 3, 8388641, ... 212, {status=0x0, info=1}, ) == 0x0
 02057   448   NtQueryVolumeInformationFile  (212, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02058   448   NtClose  (212, ... ) == 0x0
 02059   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02060   448   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 02061   448   NtSetInformationFile  (212, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02062   448   NtClose  (212, ... ) == 0x0
 02063   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0
 02064   448   NtSetInformationFile  (212, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02065   448   NtQueryInformationFile  (212, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02066   448   NtClose  (212, ... ) == 0x0
 02067   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0
 02068   448   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Cookies_index.dat_16384"}, ... 236, ) }, ... 236, ) == 0x0
 02069   448   NtMapViewOfSection  (236, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa00000), {0, 0}, 16384, ) == 0x0
 02070   448   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 02071   448   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!history!history.ie5!"}, ... 216, ) }, ... 216, ) == 0x0
 02072   448   NtWaitForSingleObject  (216, 0, 0x0, ... ) == 0x0
 02073   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 3, 8388641, ... 220, {status=0x0, info=1}, ) }, 3, 8388641, ... 220, {status=0x0, info=1}, ) == 0x0
 02074   448   NtQueryVolumeInformationFile  (220, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02075   448   NtClose  (220, ... ) == 0x0
 02076   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 220, {status=0x0, info=1}, ) }, 3, 8388641, ... 220, {status=0x0, info=1}, ) == 0x0
 02077   448   NtQueryVolumeInformationFile  (220, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02078   448   NtClose  (220, ... ) == 0x0
 02079   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02080   448   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 220, {status=0x0, info=1}, ) }, 7, 2113568, ... 220, {status=0x0, info=1}, ) == 0x0
 02081   448   NtSetInformationFile  (220, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02082   448   NtClose  (220, ... ) == 0x0
 02083   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) == 0x0
 02084   448   NtSetInformationFile  (220, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02085   448   NtQueryInformationFile  (220, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02086   448   NtClose  (220, ... ) == 0x0
 02087   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) == 0x0
 02088   448   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_History_History.IE5_index.dat_32768"}, ... 224, ) }, ... 224, ) == 0x0
 02089   448   NtMapViewOfSection  (224, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa10000), {0, 0}, 32768, ) == 0x0
 02090   448   NtReleaseMutant  (216, ... 0x0, ) == 0x0
 02091   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02092   448   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 228, {status=0x0, info=1}, ) }, 7, 2113568, ... 228, {status=0x0, info=1}, ) == 0x0
 02093   448   NtSetInformationFile  (228, 1241672, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02094   448   NtClose  (228, ... ) == 0x0
 02095   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02096   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02097   448   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 228, {status=0x0, info=1}, ) }, 7, 2113568, ... 228, {status=0x0, info=1}, ) == 0x0
 02098   448   NtSetInformationFile  (228, 1241672, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02099   448   NtClose  (228, ... ) == 0x0
 02100   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\desktop.ini"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02101   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02102   448   NtQueryInformationFile  (192, 1240080, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02103   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02104   448   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 228, ) }, ... 228, ) == 0x0
 02105   448   NtOpenKey  (0xf, {24, 228, 0x40, 0, 0,  (0xf, {24, 228, 0x40, 0, 0, "Extensible Cache"}, ... 232, ) }, ... 232, ) == 0x0
 02106   448   NtClose  (228, ... ) == 0x0
 02107   448   NtWaitForSingleObject  (188, 0, {-600000000, -1}, ... ) == 0x0
 02108   448   NtEnumerateKey  (232, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name= (232, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name="MSHist012007051420070521"}, 64, ) }, 64, ) == 0x0
 02109   448   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007051420070521"}, ... 228, ) }, ... 228, ) == 0x0
 02110   448   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02111   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02112   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02113   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02114   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02115   448   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02116   448   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02117   448   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02118   448   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02119   448   NtClose  (228, ... ) == 0x0
 02120   448   NtEnumerateKey  (232, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name= (232, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007052120070528"}, 64, ) }, 64, ) == 0x0
 02121   448   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007052120070528"}, ... 228, ) }, ... 228, ) == 0x0
 02122   448   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02123   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02124   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02125   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02126   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02127   448   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02128   448   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02129   448   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02130   448   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02131   448   NtClose  (228, ... ) == 0x0
 02132   448   NtEnumerateKey  (232, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name= (232, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007053120070601"}, 64, ) }, 64, ) == 0x0
 02133   448   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007053120070601"}, ... 228, ) }, ... 228, ) == 0x0
 02134   448   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02135   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02136   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02137   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02138   448   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02139   448   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02140   448   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02141   448   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02142   448   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02143   448   NtClose  (228, ... ) == 0x0
 02144   448   NtEnumerateKey  (232, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02145   448   NtReleaseMutant  (188, ... 0x0, ) == 0x0
 02146   448   NtClose  (232, ... ) == 0x0
 02147   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02148   448   NtQueryInformationFile  (192, 1242008, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02149   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02150   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02151   448   NtQueryInformationFile  (192, 1242080, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02152   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02153   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02154   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02155   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02156   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02157   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02158   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 232, ) }, ... 232, ) == 0x0
 02159   448   NtQueryValueKey  (232,  (232, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02160   448   NtClose  (232, ... ) == 0x0
 02161   448   NtQueryValueKey  (76,  (76, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02162   448   NtQueryValueKey  (76,  (76, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02163   448   NtQueryValueKey  (76,  (76, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02164   448   NtQueryValueKey  (76,  (76, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02165   448   NtQueryValueKey  (76,  (76, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02166   448   NtQueryValueKey  (76,  (76, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02167   448   NtQueryValueKey  (76,  (76, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02168   448   NtQueryValueKey  (76,  (76, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02169   448   NtQueryValueKey  (76,  (76, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02170   448   NtQueryValueKey  (76,  (76, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02171   448   NtQueryValueKey  (76,  (76, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02172   448   NtQueryValueKey  (76,  (76, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02173   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 232, ) }, ... 232, ) == 0x0
 02174   448   NtQueryValueKey  (232,  (232, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02175   448   NtClose  (232, ... ) == 0x0
 02176   448   NtQueryValueKey  (76,  (76, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02177   448   NtQueryValueKey  (76,  (76, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02178   448   NtQueryValueKey  (76,  (76, "GopherDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02179   448   NtQueryValueKey  (76,  (76, "DisableCachingOfSSLPages", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02180   448   NtQueryValueKey  (76,  (76, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02181   448   NtQueryValueKey  (76,  (76, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02182   448   NtQueryValueKey  (76,  (76, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02183   448   NtQueryValueKey  (76,  (76, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02184   448   NtQueryValueKey  (76,  (76, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02185   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 232, ) }, ... 232, ) == 0x0
 02186   448   NtQueryValueKey  (232,  (232, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02187   448   NtClose  (232, ... ) == 0x0
 02188   448   NtQueryValueKey  (76,  (76, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02189   448   NtQueryValueKey  (76,  (76, "NonBlockingClient32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02190   448   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02191   448   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02192   448   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02193   448   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02194   448   NtQueryValueKey  (76,  (76, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02195   448   NtQueryValueKey  (76,  (76, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02196   448   NtQueryValueKey  (76,  (76, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02197   448   NtQueryValueKey  (76,  (76, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02198   448   NtQueryValueKey  (76,  (76, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02199   448   NtQueryValueKey  (76,  (76, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02200   448   NtQueryValueKey  (76,  (76, "WarnOnZoneCrossing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02201   448   NtQueryValueKey  (76,  (76, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02202   448   NtQueryValueKey  (76,  (76, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02203   448   NtQueryValueKey  (76,  (76, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02204   448   NtQueryValueKey  (76,  (76, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02205   448   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetStartupMutex"}, ... 232, ) }, ... 232, ) == 0x0
 02206   448   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 228, ) == 0x0
 02207   448   NtQueryValueKey  (76,  (76, "GlobalUserOffline", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02208   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02209   448   NtQueryInformationFile  (192, 1242056, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02210   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02211   448   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetConnectionMutex"}, ... 240, ) }, ... 240, ) == 0x0
 02212   448   NtCreateMutant  (0x1f0001, 0x0, 0, ... 244, ) == 0x0
 02213   448   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetProxyRegistryMutex"}, ... 248, ) }, ... 248, ) == 0x0
 02214   448   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02215   448   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02216   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 252, ) }, ... 252, ) == 0x0
 02217   448   NtQueryValueKey  (252,  (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02218   448   NtQueryValueKey  (252,  (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02219   448   NtClose  (252, ... ) == 0x0
 02220   448   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 02221   448   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 02222   448   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 02223   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RASAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02224   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\RASAPI32.DLL"}, 1240444, ... }, 1240444, ...
 01893   588   NtWaitForSingleObject  ... ) == 0x0
 02225   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02226   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02224   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02227   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "RASAPI32.DLL"}, 1240444, ... }, 1240444, ...
 02226   588   NtWaitForSingleObject  ... ) == 0x0
 02228   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02229   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02227   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02230   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.DLL"}, 1240444, ... ) }, 1240444, ... ) == 0x0
 02231   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.DLL"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02232   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02233   448   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02234   448   NtClose  (252, ... ) == 0x0
 02235   448   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76ee0000), 0x0, 225280, ) == 0x0
 02236   448   NtClose  (256, ... ) == 0x0
 02237   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rasman.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02238   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rasman.dll"}, 1239640, ... }, 1239640, ...
 02229   588   NtWaitForSingleObject  ... ) == 0x0
 02239   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02240   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02238   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02241   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rasman.dll"}, 1239640, ... }, 1239640, ...
 02240   588   NtWaitForSingleObject  ... ) == 0x0
 02242   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02243   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02241   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02244   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 1239640, ... ) }, 1239640, ... ) == 0x0
 02245   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02246   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02247   448   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02248   448   NtClose  (256, ... ) == 0x0
 02249   448   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e90000), 0x0, 69632, ) == 0x0
 02250   448   NtClose  (252, ... ) == 0x0
 02251   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02252   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\NETAPI32.dll"}, 1238836, ... }, 1238836, ...
 02243   588   NtWaitForSingleObject  ... ) == 0x0
 02253   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02254   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02252   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02255   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "NETAPI32.dll"}, 1238836, ... }, 1238836, ...
 02254   588   NtWaitForSingleObject  ... ) == 0x0
 02256   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02257   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02255   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02258   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02259   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02260   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02261   448   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02262   448   NtClose  (252, ... ) == 0x0
 02263   448   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71c20000), 0x0, 323584, ) == 0x0
 02264   448   NtClose  (256, ... ) == 0x0
 02265   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "TAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02266   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\TAPI32.dll"}, 1239640, ... }, 1239640, ...
 02257   588   NtWaitForSingleObject  ... ) == 0x0
 02267   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02268   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02266   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02269   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "TAPI32.dll"}, 1239640, ... }, 1239640, ...
 02268   588   NtWaitForSingleObject  ... ) == 0x0
 02270   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02271   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02269   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02272   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1239640, ... ) }, 1239640, ... ) == 0x0
 02273   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02274   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02275   448   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02276   448   NtClose  (256, ... ) == 0x0
 02277   448   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76eb0000), 0x0, 172032, ) == 0x0
 02278   448   NtClose  (252, ... ) == 0x0
 02279   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rtutils.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02280   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rtutils.dll"}, 1238836, ... }, 1238836, ...
 02271   588   NtWaitForSingleObject  ... ) == 0x0
 02281   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02282   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02280   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02283   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rtutils.dll"}, 1238836, ... }, 1238836, ...
 02282   588   NtWaitForSingleObject  ... ) == 0x0
 02284   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02285   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02283   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02286   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02287   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02288   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02289   448   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02290   448   NtClose  (252, ... ) == 0x0
 02291   448   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e80000), 0x0, 53248, ) == 0x0
 02292   448   NtClose  (256, ... ) == 0x0
 02293   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINMM.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02294   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINMM.dll"}, 1238836, ... }, 1238836, ...
 02285   588   NtWaitForSingleObject  ... ) == 0x0
 02295   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02296   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02294   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02297   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WINMM.dll"}, 1238836, ... }, 1238836, ...
 02296   588   NtWaitForSingleObject  ... ) == 0x0
 02298   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02299   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02297   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02300   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINMM.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02301   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINMM.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02302   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02303   448   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02304   448   NtClose  (256, ... ) == 0x0
 02305   448   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b40000), 0x0, 180224, ) == 0x0
 02306   448   NtClose  (252, ... ) == 0x0
 02307   448   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 252, ) == 0x0
 02308   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 256, ) == 0x0
 02309   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 260, ) == 0x0
 02310   448   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32"}, ... 264, ) }, ... 264, ) == 0x0
 02311   448   NtQueryValueKey  (264,  (264, "wave", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02312   448   NtQueryValueKey  (264,  (264, "wave1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02313   448   NtQueryValueKey  (264,  (264, "wave2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02314   448   NtQueryValueKey  (264,  (264, "wave3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02315   448   NtQueryValueKey  (264,  (264, "wave4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02316   448   NtQueryValueKey  (264,  (264, "wave5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02317   448   NtQueryValueKey  (264,  (264, "wave6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02318   448   NtQueryValueKey  (264,  (264, "wave7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02319   448   NtQueryValueKey  (264,  (264, "wave8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02320   448   NtQueryValueKey  (264,  (264, "wave9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02321   448   NtQueryValueKey  (264,  (264, "midi", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02322   448   NtQueryValueKey  (264,  (264, "midi1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02323   448   NtQueryValueKey  (264,  (264, "midi2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02324   448   NtQueryValueKey  (264,  (264, "midi3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02325   448   NtQueryValueKey  (264,  (264, "midi4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02326   448   NtQueryValueKey  (264,  (264, "midi5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02327   448   NtQueryValueKey  (264,  (264, "midi6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02328   448   NtQueryValueKey  (264,  (264, "midi7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02329   448   NtQueryValueKey  (264,  (264, "midi8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02330   448   NtQueryValueKey  (264,  (264, "midi9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02331   448   NtQueryTimerResolution  (... 156250, 10000, 156250, ) == 0x0
 02332   448   NtQueryValueKey  (264,  (264, "aux", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02333   448   NtQueryValueKey  (264,  (264, "aux1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02334   448   NtQueryValueKey  (264,  (264, "aux2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02335   448   NtQueryValueKey  (264,  (264, "aux3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02336   448   NtQueryValueKey  (264,  (264, "aux4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02337   448   NtQueryValueKey  (264,  (264, "aux5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02338   448   NtQueryValueKey  (264,  (264, "aux6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02339   448   NtQueryValueKey  (264,  (264, "aux7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02340   448   NtQueryValueKey  (264,  (264, "aux8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02341   448   NtQueryValueKey  (264,  (264, "aux9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02342   448   NtUserRegisterWindowMessage  ( ("MSJSTICK_VJOYD_MSGSTR", ... ) , ... ) == 0xc07c
 02343   448   NtOpenKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm"}, ... 268, ) }, ... 268, ) == 0x0
 02344   448   NtQueryValueKey  (268,  (268, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (268, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02345   448   NtClose  (268, ... ) == 0x0
 02346   448   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 0, 0,  (0x1f0003, {24, 52, 0x80, 0, 0, "DINPUTWINMM"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 02347   448   NtQueryValueKey  (264,  (264, "mixer", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02348   448   NtQueryValueKey  (264,  (264, "mixer1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02349   448   NtQueryValueKey  (264,  (264, "mixer2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02350   448   NtQueryValueKey  (264,  (264, "mixer3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02351   448   NtQueryValueKey  (264,  (264, "mixer4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02352   448   NtQueryValueKey  (264,  (264, "mixer5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02353   448   NtQueryValueKey  (264,  (264, "mixer6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02354   448   NtQueryValueKey  (264,  (264, "mixer7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02355   448   NtQueryValueKey  (264,  (264, "mixer8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02356   448   NtQueryValueKey  (264,  (264, "mixer9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02357   448   NtQueryDefaultUILanguage  (1238836, ...
 02358   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02359   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482072, ) == 0x0
 02360   448   NtQueryInformationToken  (-2147482072, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02361   448   NtClose  (-2147482072, ... ) == 0x0
 02362   448   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482072, ) }, ... -2147482072, ) == 0x0
 02363   448   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02364   448   NtOpenKey  (0x80000000, {24, -2147482072, 0x640, 0, 0,  (0x80000000, {24, -2147482072, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482076, ) }, ... -2147482076, ) == 0x0
 02365   448   NtQueryValueKey  (-2147482076,  (-2147482076, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02366   448   NtClose  (-2147482076, ... ) == 0x0
 02367   448   NtClose  (-2147482072, ... ) == 0x0
 02357   448   NtQueryDefaultUILanguage  ... ) == 0x0
 02368   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02369   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1, 96, ... 268, {status=0x0, info=1}, ) }, 1, 96, ... 268, {status=0x0, info=1}, ) == 0x0
 02370   448   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 268, ... 272, ) == 0x0
 02371   448   NtMapViewOfSection  (272, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa20000), 0x0, 163840, ) == 0x0
 02372   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02373   448   NtQueryDefaultLocale  (1, 1236872, ... ) == 0x0
 02374   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02375   448   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1613, 0} " S\26\0\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 432, 448, 1613, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1613, 0} " S\26\0\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ) == 0x0
 02376   448   NtClose  (268, ... ) == 0x0
 02377   448   NtClose  (272, ... ) == 0x0
 02378   448   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 02379   448   NtUnmapViewOfSection  (-1, 0x12e9e0, ... ) == STATUS_NOT_MAPPED_VIEW
 02380   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02381   448   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02382   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02383   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02384   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1235956, ... }, 1235956, ...
 02299   588   NtWaitForSingleObject  ... ) == 0x0
 02385   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02386   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02384   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02387   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02388   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02389   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02390   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 02391   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 272, {status=0x0, info=1}, ) }, 3, 33, ... 272, {status=0x0, info=1}, ) == 0x0
 02392   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02393   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Telephony"}, ... 268, ) }, ... 268, ) == 0x0
 02394   448   NtQueryValueKey  (268,  (268, "Tapi32MaxNumRequestRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02395   448   NtQueryValueKey  (268,  (268, "Tapi32RequestRetryTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02396   448   NtClose  (268, ... ) == 0x0
 02397   448   NtCreateMutant  (0x1f0001, 0x0, 0, ... 268, ) == 0x0
 02398   448   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 1392200, 0,  (0x1f0001, {24, 52, 0x80, 1392200, 0, "RasPbFile"}, 0, ... ) }, 0, ... ) == STATUS_ACCESS_DENIED
 02399   448   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "RasPbFile"}, ... 276, ) }, ... 276, ) == 0x0
 02400   448   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 280, ) == 0x0
 02401   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 284, ) == 0x0
 02402   448   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 288, ) == 0x0
 02403   448   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 02404   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 292, ) == 0x0
 02405   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 296, ) == 0x0
 02406   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 300, ) == 0x0
 02407   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 304, ) == 0x0
 02408   448   NtCreateKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "Software\Microsoft\Tracing"}, 0, 0x0, 0, ... 308, 2, ) }, 0, 0x0, 0, ... 308, 2, ) == 0x0
 02409   448   NtQueryValueKey  (308,  (308, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (308, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02410   448   NtClose  (308, ... ) == 0x0
 02411   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 308, ) == 0x0
 02412   448   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 312, ) == 0x0
 02413   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Tracing\RASAPI32"}, ... 316, ) }, ... 316, ) == 0x0
 02414   448   NtQueryValueKey  (316,  (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02415   448   NtQueryValueKey  (316,  (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02416   448   NtQueryValueKey  (316,  (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02417   448   NtQueryValueKey  (316,  (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02418   448   NtQueryValueKey  (316,  (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 02419   448   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02420   448   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02421   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 320, ) == 0x0
 02422   448   NtNotifyChangeKey  (316, 320, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 02423   448   NtQueryValueKey  (316,  (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02424   448   NtQueryValueKey  (316,  (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02425   448   NtQueryValueKey  (316,  (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02426   448   NtQueryValueKey  (316,  (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02427   448   NtQueryValueKey  (316,  (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 02428   448   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02429   448   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02430   448   NtNotifyChangeKey  (316, 320, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 02431   448   NtSetEvent  (304, ... 0x0, ) == 0x0
 02432   448   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 324, ) }, ... 324, ) == 0x0
 02433   448   NtWaitForSingleObject  (324, 0, {-1800000000, -1}, ... ) == 0x0
 02434   448   NtClose  (324, ... ) == 0x0
 02435   448   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 324, ) == 0x0
 02436   448   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 328, ) == 0x0
 02437   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 332, ) }, ... 332, ) == 0x0
 02438   448   NtOpenKey  (0x20019, {24, 332, 0x40, 0, 0,  (0x20019, {24, 332, 0x40, 0, 0, "ActiveComputerName"}, ... 336, ) }, ... 336, ) == 0x0
 02439   448   NtQueryValueKey  (336,  (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02440   448   NtClose  (336, ... ) == 0x0
 02441   448   NtClose  (332, ... ) == 0x0
 02442   448   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 332, ) == 0x0
 02443   448   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 336, ) == 0x0
 02444   448   NtDuplicateObject  (-1, 332, -1, 0x0, 0, 2, ... 340, ) == 0x0
 02445   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02446   448   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 02447   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 344, ) == 0x0
 02448   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02449   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02450   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240604,  (0xc0100080, {24, 0, 0x40, 0, 1240604, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 348, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 348, {status=0x0, info=1}, ) == 0x0
 02451   448   NtSetInformationFile  (348, 1240660, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02452   448   NtSetInformationFile  (348, 1240652, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02453   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02454   448   NtWriteFile  (348, 325, 0, 0,  (348, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02455   448   NtReadFile  (348, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (348, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\260%\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02456   448   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\260%\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\260%\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02457   448   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\322\317\3439\302?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\322\317\3439\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\322\317\3439\302?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\322\317\3439\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02458   448   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\323\317\3439\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\323\317\3439\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\323\317\3439\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\323\317\3439\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02459   448   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\323\317\3439\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\323\317\3439\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 02460   448   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\322\317\3439\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\322\317\3439\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 02461   448   NtClose  (344, ... ) == 0x0
 02462   448   NtClose  (348, ... ) == 0x0
 02463   448   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 02464   448   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02465   448   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02466   448   NtOpenEvent  (0x100000, {24, 0, 0x0, 0, 0,  (0x100000, {24, 0, 0x0, 0, 0, "\INSTALLATION_SECURITY_HOLD"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02467   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02468   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 348, ) == 0x0
 02469   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02470   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02471   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238108,  (0xc0100080, {24, 0, 0x40, 0, 1238108, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 344, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 344, {status=0x0, info=1}, ) == 0x0
 02472   448   NtSetInformationFile  (344, 1238164, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02473   448   NtSetInformationFile  (344, 1238156, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02474   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02475   448   NtWriteFile  (344, 325, 0, 0,  (344, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0j(\319\14\261\320\21\233\250\0\300O\331.\365\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02476   448   NtReadFile  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\354#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02477   448   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\354#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 26, 1024, ... {status=0x103, info=68},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\354#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02478   448   NtClose  (348, ... ) == 0x0
 02479   448   NtClose  (344, ... ) == 0x0
 02480   448   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 344, 2, ) }, 0, 0x0, 0, ... 344, 2, ) == 0x0
 02481   448   NtCreateKey  (0x20019, {24, 344, 0x40, 0, 0,  (0x20019, {24, 344, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 348, 2, ) }, 0, 0x0, 0, ... 348, 2, ) == 0x0
 02482   448   NtClose  (344, ... ) == 0x0
 02483   448   NtQueryValueKey  (348,  (348, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02484   448   NtClose  (348, ... ) == 0x0
 02485   448   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 348, ) }, ... 348, ) == 0x0
 02486   448   NtWaitForSingleObject  (348, 0, {-1800000000, -1}, ... ) == 0x0
 02487   448   NtClose  (348, ... ) == 0x0
 02488   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02489   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 348, ) == 0x0
 02490   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02491   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02492   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240192,  (0xc0100080, {24, 0, 0x40, 0, 1240192, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 344, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 344, {status=0x0, info=1}, ) == 0x0
 02493   448   NtSetInformationFile  (344, 1240248, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02494   448   NtSetInformationFile  (344, 1240240, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02495   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02496   448   NtWriteFile  (344, 325, 0, 0,  (344, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02497   448   NtReadFile  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\261%\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02498   448   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\261%\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\261%\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02499   448   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\2\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\0\0\0\0", 64, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 64, 1024, ... {status=0x103, info=48},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\2\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\0\0\0\0", 64, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02500   448   NtWaitForSingleObject  (325, 0, 0x0, ... ) == 0x0
 02501   448   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\3\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\02\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\2\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\2\0\0\340\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\1\0\0~\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\1\0\0B\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\1\0\0\32\1\0\0 \0\0\0\4\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\16\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0E\0R\0S\0v\0c\0\0\0DNS Client\0\0i\0e\0n\0t\0\0\0Dnscache\0\0c\0h\0e\0\0\0Logical Disk Manager\0\0k\0 \0M\0a\0n\0a\0g\0e\0r\0\0\0dmserver\0\0v\0e\0r\0\0\0DHCP Client\0l\0i\0e\0n\0t\0\0\0Dhcp\0\0p\0\0\0Cryptographic Services\0\0c\0 \0S\0e\0r\0v\0i\0c\0e\0s\0\0\0CryptSvc\0\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\3\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\02\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\2\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\2\0\0\340\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\1\0\0~\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\1\0\0B\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\1\0\0\32\1\0\0 \0\0\0\4\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\16\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0E\0R\0S\0v\0c\0\0\0DNS Client\0\0i\0e\0n\0t\0\0\0Dnscache\0\0c\0h\0e\0\0\0Logical Disk Manager\0\0k\0 \0M\0a\0n\0a\0g\0e\0r\0\0\0dmserver\0\0v\0e\0r\0\0\0DHCP Client\0l\0i\0e\0n\0t\0\0\0Dhcp\0\0p\0\0\0Cryptographic Services\0\0c\0 \0S\0e\0r\0v\0i\0c\0e\0s\0\0\0CryptSvc\0\0", ) , ) == 0x103
 02502   448   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\4\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0>\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\3\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\4\2\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\362\1\0\0\336\1\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\306\1\0\0\242\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\1\0\0 \1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\1\0\0\356\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Help and Support\0\0S\0u\0p\0p\0o\0r\0t\0\0\0helpsvc\0s\0v\0c\0\0\0Fast User Switching Compatibility\0n\0g\0 \0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0FastUserSwitchingCompatibility\0\0g\0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0COM+ Event System\0t\0 \0S\0y\0s\0t\0e\0m\0\0\0EventSystem\0y\0s\0t\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\4\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0>\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\3\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\4\2\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\362\1\0\0\336\1\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\306\1\0\0\242\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\1\0\0 \1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\1\0\0\356\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Help and Support\0\0S\0u\0p\0p\0o\0r\0t\0\0\0helpsvc\0s\0v\0c\0\0\0Fast User Switching Compatibility\0n\0g\0 \0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0FastUserSwitchingCompatibility\0\0g\0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0COM+ Event System\0t\0 \0S\0y\0s\0t\0e\0m\0\0\0EventSystem\0y\0s\0t\0", ) , ) == 0x103
 02503   448   NtWaitForSingleObject  (325, 0, 0x0, ... ) == 0x0
 02504   448   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\5\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0p\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\4\0\0\0X\2\0\0\0\0\0\0@\2\0\0&\2\0\0\30\2\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\1\0\0x\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\1\0\0B\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\1\0\0\370\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Network Location Awareness (NLA)\0\0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0\0\0Nla\0a\0\0\0Network Connections\0n\0n\0e\0c\0t\0i\0o\0n\0s\0\0\0Netman\0\0a\0n\0\0\0Messenger\0n\0g\0e\0r\0\0\0Messenger\0n\0g\0e\0r\0\0\0TCP/IP NetBIOS Helper\0I\0O\0S\0 \0H\0e\0l\0p\0e\0r\0\0\0LmHosts\0s\0t\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\5\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0p\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\4\0\0\0X\2\0\0\0\0\0\0@\2\0\0&\2\0\0\30\2\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\1\0\0x\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\1\0\0B\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\1\0\0\370\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Network Location Awareness (NLA)\0\0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0\0\0Nla\0a\0\0\0Network Connections\0n\0n\0e\0c\0t\0i\0o\0n\0s\0\0\0Netman\0\0a\0n\0\0\0Messenger\0n\0g\0e\0r\0\0\0Messenger\0n\0g\0e\0r\0\0\0TCP/IP NetBIOS Helper\0I\0O\0S\0 \0H\0e\0l\0p\0e\0r\0\0\0LmHosts\0s\0t\0", ) , ) == 0x103
 02505   448   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\6\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\242\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\5\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\372\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\272\1\0\0\226\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0X\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\1\0\0\24\1\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0a\0m\0S\0s\0\0\0Remote Procedure Call (RPC)\0r\0e\0 \0C\0a\0l\0l\0 \0(\0R\0P\0C\0)\0\0\0RpcSs\0S\0s\0\0\0Remote Registry\0e\0g\0i\0s\0t\0r\0y\0\0\0RemoteRegistry\0\0g\0i\0s\0t\0r\0y\0\0\0Protected Storage\0 \0S\0t\0o\0r\0a\0g\0e\0\0\0ProtectedStorage\0\0S\0t\0o\0r\0a\0g\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\6\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\242\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\5\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\372\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\272\1\0\0\226\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0X\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\1\0\0\24\1\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0a\0m\0S\0s\0\0\0Remote Procedure Call (RPC)\0r\0e\0 \0C\0a\0l\0l\0 \0(\0R\0P\0C\0)\0\0\0RpcSs\0S\0s\0\0\0Remote Registry\0e\0g\0i\0s\0t\0r\0y\0\0\0RemoteRegistry\0\0g\0i\0s\0t\0r\0y\0\0\0Protected Storage\0 \0S\0t\0o\0r\0a\0g\0e\0\0\0ProtectedStorage\0\0S\0t\0o\0r\0a\0g\0", ) , ) == 0x103
 02506   448   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\7\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\6\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\0\2\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\356\1\0\0\320\1\0\0 \1\0\0\4\0\0\0G\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\276\1\0\0\236\1\0\0 \1\0\0\4\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\1\0\0`\1\0\0 \0\0\0\4\0\0\0A\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\1\0\0\14\1\0\0 \0\0\0\4\0\0\0\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\0\0\0\340\0\0\0\20\1\0\0\4\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Print Spooler\0p\0o\0o\0l\0e\0r\0\0\0Spooler\0l\0e\0r\0\0\0Shell Hardware Detection\0\0e\0 \0D\0e\0t\0e\0c\0t\0i\0o\0n\0\0\0ShellHWDetection\0\0t\0e\0c\0t\0i\0o\0n\0\0\0System Event Notification\0N\0o\0t\0i\0f\0i\0c\0a\0t\0i\0o\0n\0\0\0SENS\0\0S\0\0\0Secondary Logon\0y\0 \0L\0o\0g\0o\0n\0\0\0seclogon\0\0g\0o\0n\0\0\0Task Sch", ) , 44, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\7\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\324\317\3439\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\6\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\0\2\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\356\1\0\0\320\1\0\0 \1\0\0\4\0\0\0G\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\276\1\0\0\236\1\0\0 \1\0\0\4\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\1\0\0`\1\0\0 \0\0\0\4\0\0\0A\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\1\0\0\14\1\0\0 \0\0\0\4\0\0\0\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\0\0\0\340\0\0\0\20\1\0\0\4\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Print Spooler\0p\0o\0o\0l\0e\0r\0\0\0Spooler\0l\0e\0r\0\0\0Shell Hardware Detection\0\0e\0 \0D\0e\0t\0e\0c\0t\0i\0o\0n\0\0\0ShellHWDetection\0\0t\0e\0c\0t\0i\0o\0n\0\0\0System Event Notification\0N\0o\0t\0i\0f\0i\0c\0a\0t\0i\0o\0n\0\0\0SENS\0\0S\0\0\0Secondary Logon\0y\0 \0L\0o\0g\0o\0n\0\0\0seclogon\0\0g\0o\0n\0\0\0Task Sch", ) , ) == 0x103
 02507   448   NtClose  (348, ... ) == 0x0
 02508   448   NtClose  (344, ... ) == 0x0
 02509   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "sensapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02510   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\sensapi.dll"}, 1240452, ... }, 1240452, ...
 02386   588   NtWaitForSingleObject  ... ) == 0x0
 02511   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02512   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02510   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02513   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "sensapi.dll"}, 1240452, ... }, 1240452, ...
 02512   588   NtWaitForSingleObject  ... ) == 0x0
 02514   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02515   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02513   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02516   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\sensapi.dll"}, 1240452, ... ) }, 1240452, ... ) == 0x0
 02517   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\sensapi.dll"}, 5, 96, ... 344, {status=0x0, info=1}, ) }, 5, 96, ... 344, {status=0x0, info=1}, ) == 0x0
 02518   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 344, ... 348, ) == 0x0
 02519   448   NtQuerySection  (348, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02520   448   NtClose  (344, ... ) == 0x0
 02521   448   NtMapViewOfSection  (348, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x722b0000), 0x0, 20480, ) == 0x0
 02522   448   NtClose  (348, ... ) == 0x0
 02523   448   NtOpenSection  (0x4, {24, 52, 0x0, 0, 0,  (0x4, {24, 52, 0x0, 0, 0, "SENS Information Cache"}, ... 348, ) }, ... 348, ) == 0x0
 02524   448   NtMapViewOfSection  (348, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa20000), {0, 0}, 4096, ) == 0x0
 02525   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 344, ) == 0x0
 02526   448   NtConnectPort  ( ("\RPC Control\senssvc", {12, 2, 1, 1}, 0x0, 0x0, 1240916, 112, ... 352, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1240916, 112, ... 352, 0x0, 0x0, 0x0, 112, ) == 0x0
 02527   448   NtRequestWaitReplyPort  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680}  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680} "\0$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0 H\25\0\4\0\0\0 H\25\0\20\344\314w H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1615, 0} "\7$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0 H\25\0\377\377\377\377 H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1615, 0}  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680} "\0$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0 H\25\0\4\0\0\0 H\25\0\20\344\314w H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1615, 0} "\7$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0 H\25\0\377\377\377\377 H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" )  ) == 0x0
 02528   448   NtRequestWaitReplyPort  (352, {32, 56, new_msg, 0, 44, 7, 20, 0}  (352, {32, 56, new_msg, 0, 44, 7, 20, 0} "\1\0\0\0A\2\0\0\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\377\377\377\377@\2\0\0" ... {124, 148, reply, 0, 432, 448, 1616, 0} "\2\360\371\177\1\00\300\0\0\0\0\241\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\304\233\0\370X\5O\200\0\360\371\177\0\0\0\0\0\0\0\0h.\22\201\20G'\201\1G'\201\0\0\0\0|\376\37\300\20G'\201\0\0\0\0\0\0\340\0\377\377\337\0\0\0\0\0\0\0\340\0\0\0\0\0\20G'\201<\233\0\370" )  ... {124, 148, reply, 0, 432, 448, 1616, 0}  (352, {32, 56, new_msg, 0, 44, 7, 20, 0} "\1\0\0\0A\2\0\0\302?\334\21\261\310\0\14)\371\246\3050\0\0\0\377\377\377\377@\2\0\0" ... {124, 148, reply, 0, 432, 448, 1616, 0} "\2\360\371\177\1\00\300\0\0\0\0\241\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\304\233\0\370X\5O\200\0\360\371\177\0\0\0\0\0\0\0\0h.\22\201\20G'\201\1G'\201\0\0\0\0|\376\37\300\20G'\201\0\0\0\0\0\0\340\0\377\377\337\0\0\0\0\0\0\0\340\0\0\0\0\0\20G'\201<\233\0\370" )  ) == 0x0
 02529   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02530   448   NtQueryInformationFile  (192, 1242024, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02531   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02532   448   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\0\20Z\25\0" ... {176, 200, reply, 0, 432, 448, 1617, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\0\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 432, 448, 1617, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\0\20Z\25\0" ... {176, 200, reply, 0, 432, 448, 1617, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\0\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 02533   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02534   448   NtOpenThreadToken  (-2, 0x20008, 1, ... ) == STATUS_NO_TOKEN
 02535   448   NtOpenProcessToken  (-1, 0x20008, ... 356, ) == 0x0
 02536   448   NtQueryInformationToken  (356, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02537   448   NtClose  (356, ... ) == 0x0
 02538   448   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER"}, ... 356, ) }, ... 356, ) == 0x0
 02539   448   NtSetInformationObject  (356, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 02540   448   NtOpenKey  (0x3, {24, 356, 0x40, 0, 0,  (0x3, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 360, ) }, ... 360, ) == 0x0
 02541   448   NtOpenKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, ... 364, ) }, ... 364, ) == 0x0
 02542   448   NtQueryValueKey  (364,  (364, "MigrateProxy", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "MigrateProxy", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02543   448   NtClose  (364, ... ) == 0x0
 02544   448   NtAllocateVirtualMemory  (-1, 1400832, 0, 20480, 4096, 4, ... 1400832, 20480, ) == 0x0
 02545   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02546   448   NtOpenProcessToken  (-1, 0xc, ... 364, ) == 0x0
 02547   448   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 02548   448   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 02549   448   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 02550   448   NtQueryValueKey  (368,  (368, "Common AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 82, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "Common AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 82, ) }, 82, ) == 0x0
 02551   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 372, ) }, ... 372, ) == 0x0
 02552   448   NtMapViewOfSection  (372, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 02553   448   NtClose  (372, ... ) == 0x0
 02554   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 372, ) }, ... 372, ) == 0x0
 02555   448   NtQueryValueKey  (372,  (372, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02556   448   NtClose  (372, ... ) == 0x0
 02557   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 372, ) }, ... 372, ) == 0x0
 02558   448   NtQueryValueKey  (372,  (372, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02559   448   NtClose  (372, ... ) == 0x0
 02560   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 372, ) }, ... 372, ) == 0x0
 02561   448   NtQueryValueKey  (372,  (372, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (372, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 02562   448   NtClose  (372, ... ) == 0x0
 02563   448   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1237236, 0,  (0x1f0003, {24, 52, 0x80, 1237236, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 372, ) }, 0, 1, ... 372, ) == STATUS_OBJECT_NAME_EXISTS
 02564   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02565   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02566   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02567   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02568   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02569   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02570   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02571   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02572   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02573   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02574   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02575   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02576   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02577   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02578   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02579   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02580   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02581   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02582   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02583   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02584   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02585   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02586   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02587   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02588   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02589   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02590   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02591   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 376, ) == 0x0
 02592   448   NtQueryInformationToken  (376, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02593   448   NtClose  (376, ... ) == 0x0
 02594   448   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 02595   448   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 380, ) }, ... 380, ) == 0x0
 02596   448   NtQueryValueKey  (380,  (380, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (380, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 02597   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02598   448   NtQueryValueKey  (380,  (380, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (380, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 02599   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02600   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02601   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02602   448   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02603   448   NtClose  (380, ... ) == 0x0
 02604   448   NtClose  (376, ... ) == 0x0
 02605   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02606   448   NtQueryValueKey  (376,  (376, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02607   448   NtClose  (376, ... ) == 0x0
 02608   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02609   448   NtQueryValueKey  (376,  (376, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02610   448   NtQueryValueKey  (376,  (376, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02611   448   NtClose  (376, ... ) == 0x0
 02612   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02613   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02614   448   NtQueryValueKey  (376,  (376, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02615   448   NtClose  (376, ... ) == 0x0
 02616   448   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02617   448   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10682368, 4096, ) == 0x0
 02618   448   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ... 1421312, 4096, ) == 0x0
 02619   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02620   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02621   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02622   448   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02623   448   NtClose  (376, ... ) == 0x0
 02624   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02625   448   NtQueryValueKey  (376,  (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02626   448   NtClose  (376, ... ) == 0x0
 02627   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02628   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 376, ) }, ... 376, ) == 0x0
 02629   448   NtQueryKey  (376, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02630   448   NtQuerySecurityObject  (376, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02631   448   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02632   448   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02633   448   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02634   448   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02635   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02636   448   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02637   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02638   448   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02639   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02640   448   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02641   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02642   448   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02643   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02644   448   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02645   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02646   448   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02647   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02648   448   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02649   448   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02650   448   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02651   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02652   448   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02653   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02654   448   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02655   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02656   448   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02657   448   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02658   448   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02659   448   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02660   448   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02661   448   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02662   448   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02663   448   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02664   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02665   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02666   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02667   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02668   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02669   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02670   448   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02671   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02672   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02673   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02674   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02675   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02676   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02677   448   NtClose  (376, ... ) == 0x0
 02678   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 376, ) }, ... 376, ) == 0x0
 02679   448   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "ActiveComputerName"}, ... 380, ) }, ... 380, ) == 0x0
 02680   448   NtQueryValueKey  (380,  (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02681   448   NtClose  (380, ... ) == 0x0
 02682   448   NtClose  (376, ... ) == 0x0
 02683   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02684   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02685   448   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02686   448   NtClose  (376, ... ) == 0x0
 02687   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02688   448   NtQueryValueKey  (376,  (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 02689   448   NtClose  (376, ... ) == 0x0
 02690   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02691   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 376, ) }, ... 376, ) == 0x0
 02692   448   NtQueryValueKey  (376,  (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 02693   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02694   448   NtQueryValueKey  (376,  (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 02695   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02696   448   NtClose  (376, ... ) == 0x0
 02697   448   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02698   448   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 02699   448   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02700   448   NtQueryInformationToken  (364, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 02701   448   NtDuplicateToken  (364, 0xc, {24, 0, 0x0, 0, 1239544, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 02702   448   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02703   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02704   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02705   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02706   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02707   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237748,  (0xc0100080, {24, 0, 0x40, 0, 1237748, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02708   448   NtSetInformationFile  (384, 1237804, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02709   448   NtSetInformationFile  (384, 1237796, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02710   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02711   448   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02712   448   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\355#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02713   448   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\355#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\355#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02714   448   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\24\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\24\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\24\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\24\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02715   448   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\24\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\24\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02716   448   NtClose  (380, ... ) == 0x0
 02717   448   NtClose  (384, ... ) == 0x0
 02718   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02719   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 384, ) == 0x0
 02720   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02721   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02722   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237744,  (0xc0100080, {24, 0, 0x40, 0, 1237744, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) == 0x0
 02723   448   NtSetInformationFile  (380, 1237800, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02724   448   NtSetInformationFile  (380, 1237792, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02725   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02726   448   NtWriteFile  (380, 325, 0, 0,  (380, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02727   448   NtReadFile  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\356#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02728   448   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\356#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\356#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02729   448   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\25\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\25\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\25\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\25\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02730   448   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\25\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\25\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02731   448   NtClose  (384, ... ) == 0x0
 02732   448   NtClose  (380, ... ) == 0x0
 02733   448   NtOpenEvent  (0x100000, {24, 0, 0x0, 0, 0,  (0x100000, {24, 0, 0x0, 0, 0, "\INSTALLATION_SECURITY_HOLD"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02734   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02735   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02736   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02737   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02738   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237376,  (0xc0100080, {24, 0, 0x40, 0, 1237376, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02739   448   NtSetInformationFile  (384, 1237432, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02740   448   NtSetInformationFile  (384, 1237424, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02741   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02742   448   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0j(\319\14\261\320\21\233\250\0\300O\331.\365\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02743   448   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\357#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02744   448   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\357#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 26, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\357#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02745   448   NtClose  (380, ... ) == 0x0
 02746   448   NtClose  (384, ... ) == 0x0
 02747   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02748   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02749   448   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02750   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 02751   448   NtQueryValueKey  (384,  (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 02752   448   NtClose  (384, ... ) == 0x0
 02753   448   NtCreateKey  (0x2001f, {24, 376, 0x40, 0, 0,  (0x2001f, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 02754   448   NtQueryValueKey  (384,  (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02755   448   NtClose  (384, ... ) == 0x0
 02756   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02757   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02758   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1239448, ... ) }, 1239448, ... ) == 0x0
 02759   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239456,  (0x80100080, {24, 0, 0x40, 0, 1239456, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02760   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02761   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02762   448   NtQueryInformationFile  (384, 1239472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02763   448   NtReadFile  (384, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 02764   448   NtClose  (384, ... ) == 0x0
 02765   448   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02766   448   NtAllocateVirtualMemory  (-1, 1425408, 0, 12288, 4096, 4, ... 1425408, 12288, ) == 0x0
 02767   448   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02768   448   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02769   448   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02770   448   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02771   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02772   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02773   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02774   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02775   448   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02776   448   NtClose  (380, ... ) == 0x0
 02777   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02778   448   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02779   448   NtClose  (380, ... ) == 0x0
 02780   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02781   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02782   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02783   448   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02784   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02785   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02786   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02787   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02788   448   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02789   448   NtClose  (380, ... ) == 0x0
 02790   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02791   448   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02792   448   NtClose  (380, ... ) == 0x0
 02793   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02794   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02795   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02796   448   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02797   448   NtClose  (384, ... ) == 0x0
 02798   448   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Volatile Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02799   448   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02800   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02801   448   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02802   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02803   448   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02804   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02805   448   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02806   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02807   448   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02808   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02809   448   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02810   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02811   448   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02812   448   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02813   448   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02814   448   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02815   448   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02816   448   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02817   448   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02818   448   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02819   448   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02820   448   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02821   448   NtClose  (384, ... ) == 0x0
 02822   448   NtClose  (376, ... ) == 0x0
 02823   448   NtFreeVirtualMemory  (-1, (0xa30000), 0, 32768, ... (0xa30000), 4096, ) == 0x0
 02824   448   NtClose  (368, ... ) == 0x0
 02825   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data"}, 1240112, ... ) }, 1240112, ... ) == 0x0
 02826   448   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 02827   448   NtSetValueKey  (368,  (368, "Common AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 106, ... ) , 0, 1,  (368, "Common AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 106, ... ) , 106, ... ) == 0x0
 02828   448   NtClose  (368, ... ) == 0x0
 02829   448   NtClose  (364, ... ) == 0x0
 02830   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02831   448   NtQueryDirectoryFile  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1,  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02832   448   NtClose  (364, ... ) == 0x0
 02833   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02834   448   NtQueryDirectoryFile  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1,  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02835   448   NtClose  (364, ... ) == 0x0
 02836   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02837   448   NtOpenProcessToken  (-1, 0xc, ... 364, ) == 0x0
 02838   448   NtQueryInformationToken  (364, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 02839   448   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 368, ) }, ... 368, ) == 0x0
 02840   448   NtCreateKey  (0x2000000, {24, 368, 0x40, 0, 0,  (0x2000000, {24, 368, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 02841   448   NtClose  (368, ... ) == 0x0
 02842   448   NtQueryValueKey  (376,  (376, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 02843   448   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10682368, 4096, ) == 0x0
 02844   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02845   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02846   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02847   448   NtQueryValueKey  (368,  (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02848   448   NtClose  (368, ... ) == 0x0
 02849   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02850   448   NtQueryValueKey  (368,  (368, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02851   448   NtClose  (368, ... ) == 0x0
 02852   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02853   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 368, ) }, ... 368, ) == 0x0
 02854   448   NtQueryKey  (368, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02855   448   NtQuerySecurityObject  (368, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02856   448   NtEnumerateValueKey  (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02857   448   NtEnumerateValueKey  (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02858   448   NtEnumerateValueKey  (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02859   448   NtEnumerateValueKey  (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02860   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02861   448   NtEnumerateValueKey  (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02862   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02863   448   NtEnumerateValueKey  (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02864   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02865   448   NtEnumerateValueKey  (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02866   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02867   448   NtEnumerateValueKey  (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02868   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02869   448   NtEnumerateValueKey  (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02870   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02871   448   NtEnumerateValueKey  (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02872   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02873   448   NtEnumerateValueKey  (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02874   448   NtEnumerateValueKey  (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02875   448   NtEnumerateValueKey  (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02876   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02877   448   NtEnumerateValueKey  (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02878   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02879   448   NtEnumerateValueKey  (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02880   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02881   448   NtEnumerateValueKey  (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02882   448   NtEnumerateValueKey  (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02883   448   NtEnumerateValueKey  (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02884   448   NtEnumerateValueKey  (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02885   448   NtEnumerateValueKey  (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02886   448   NtEnumerateValueKey  (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02887   448   NtEnumerateValueKey  (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02888   448   NtEnumerateValueKey  (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02889   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02890   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02891   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02892   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02893   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02894   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02895   448   NtEnumerateValueKey  (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02896   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02897   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02898   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02899   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02900   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02901   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02902   448   NtClose  (368, ... ) == 0x0
 02903   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 368, ) }, ... 368, ) == 0x0
 02904   448   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "ActiveComputerName"}, ... 384, ) }, ... 384, ) == 0x0
 02905   448   NtQueryValueKey  (384,  (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02906   448   NtClose  (384, ... ) == 0x0
 02907   448   NtClose  (368, ... ) == 0x0
 02908   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02909   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02910   448   NtQueryValueKey  (368,  (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02911   448   NtClose  (368, ... ) == 0x0
 02912   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02913   448   NtQueryValueKey  (368,  (368, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 02914   448   NtClose  (368, ... ) == 0x0
 02915   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02916   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 368, ) }, ... 368, ) == 0x0
 02917   448   NtQueryValueKey  (368,  (368, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 02918   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02919   448   NtQueryValueKey  (368,  (368, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 02920   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02921   448   NtClose  (368, ... ) == 0x0
 02922   448   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02923   448   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 368, ) }, ... 368, ) == 0x0
 02924   448   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02925   448   NtQueryInformationToken  (364, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 02926   448   NtDuplicateToken  (364, 0xc, {24, 0, 0x0, 0, 1239544, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 02927   448   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02928   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02929   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 384, ) == 0x0
 02930   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02931   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02932   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237748,  (0xc0100080, {24, 0, 0x40, 0, 1237748, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) == 0x0
 02933   448   NtSetInformationFile  (380, 1237804, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02934   448   NtSetInformationFile  (380, 1237796, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02935   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02936   448   NtWriteFile  (380, 325, 0, 0,  (380, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02937   448   NtReadFile  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\360#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02938   448   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\360#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\360#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02939   448   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\26\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\26\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\26\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\26\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02940   448   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\26\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\26\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02941   448   NtClose  (384, ... ) == 0x0
 02942   448   NtClose  (380, ... ) == 0x0
 02943   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02944   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02945   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02946   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02947   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237744,  (0xc0100080, {24, 0, 0x40, 0, 1237744, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02948   448   NtSetInformationFile  (384, 1237800, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02949   448   NtSetInformationFile  (384, 1237792, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02950   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02951   448   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02952   448   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\361#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02953   448   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\361#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\361#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02954   448   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\27\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\27\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\27\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\27\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02955   448   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\27\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\27\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02956   448   NtClose  (380, ... ) == 0x0
 02957   448   NtClose  (384, ... ) == 0x0
 02958   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02959   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02960   448   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02961   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 02962   448   NtQueryValueKey  (384,  (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 02963   448   NtClose  (384, ... ) == 0x0
 02964   448   NtCreateKey  (0x2001f, {24, 368, 0x40, 0, 0,  (0x2001f, {24, 368, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 02965   448   NtQueryValueKey  (384,  (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02966   448   NtClose  (384, ... ) == 0x0
 02967   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02968   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02969   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1239448, ... ) }, 1239448, ... ) == 0x0
 02970   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239456,  (0x80100080, {24, 0, 0x40, 0, 1239456, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02971   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02972   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02973   448   NtQueryInformationFile  (384, 1239472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02974   448   NtReadFile  (384, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 02975   448   NtClose  (384, ... ) == 0x0
 02976   448   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02977   448   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02978   448   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02979   448   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02980   448   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02981   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02982   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02983   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02984   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02985   448   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02986   448   NtClose  (380, ... ) == 0x0
 02987   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02988   448   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02989   448   NtClose  (380, ... ) == 0x0
 02990   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02991   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02992   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02993   448   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02994   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02995   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02996   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02997   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02998   448   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02999   448   NtClose  (380, ... ) == 0x0
 03000   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 03001   448   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03002   448   NtClose  (380, ... ) == 0x0
 03003   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03004   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03005   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03006   448   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03007   448   NtClose  (384, ... ) == 0x0
 03008   448   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "Volatile Environment"}, ... 384, ) }, ... 384, ) == 0x0
 03009   448   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03010   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03011   448   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03012   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03013   448   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03014   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03015   448   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03016   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03017   448   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03018   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03019   448   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03020   448   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03021   448   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03022   448   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03023   448   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03024   448   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03025   448   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03026   448   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03027   448   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03028   448   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03029   448   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03030   448   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03031   448   NtClose  (384, ... ) == 0x0
 03032   448   NtClose  (368, ... ) == 0x0
 03033   448   NtFreeVirtualMemory  (-1, (0xa30000), 0, 32768, ... (0xa30000), 4096, ) == 0x0
 03034   448   NtClose  (376, ... ) == 0x0
 03035   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1240112, ... ) }, 1240112, ... ) == 0x0
 03036   448   NtQueryInformationToken  (364, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03037   448   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 03038   448   NtCreateKey  (0x2000000, {24, 376, 0x40, 0, 0,  (0x2000000, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 03039   448   NtClose  (376, ... ) == 0x0
 03040   448   NtSetValueKey  (368,  (368, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (368, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03041   448   NtClose  (368, ... ) == 0x0
 03042   448   NtClose  (364, ... ) == 0x0
 03043   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03044   448   NtCreateKey  (0x2, {24, 360, 0x40, 0, 0,  (0x2, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03045   448   NtSetValueKey  (364,  (364, "MigrateProxy", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (364, "MigrateProxy", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03046   448   NtClose  (364, ... ) == 0x0
 03047   448   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, ... 364, ) }, ... 364, ) == 0x0
 03048   448   NtQueryValueKey  (364,  (364, "ProxyEnable", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "ProxyEnable", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03049   448   NtQueryValueKey  (364,  (364, "ProxyServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03050   448   NtQueryValueKey  (364,  (364, "ProxyOverride", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03051   448   NtQueryValueKey  (364,  (364, "AutoConfigURL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03052   448   NtClose  (364, ... ) == 0x0
 03053   448   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03054   448   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03055   448   NtQueryValueKey  (364,  (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03056   448   NtQueryValueKey  (364,  (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03057   448   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03058   448   NtClose  (364, ... ) == 0x0
 03059   448   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03060   448   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03061   448   NtQueryValueKey  (364,  (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03062   448   NtQueryValueKey  (364,  (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03063   448   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03064   448   NtClose  (364, ... ) == 0x0
 03065   448   NtWaitForSingleObject  (228, 0, 0x0, ... ) == 0x0
 03066   448   NtClearEvent  (228, ... ) == 0x0
 03067   448   NtSetEvent  (228, ... 0x0, ) == 0x0
 03068   448   NtCreateKey  (0x20006, {24, 360, 0x40, 0, 0,  (0x20006, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03069   448   NtSetValueKey  (364,  (364, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 0, 4,  (364, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03070   448   NtDeleteValueKey  (364,  (364, "ProxyServer", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03071   448   NtDeleteValueKey  (364,  (364, "ProxyOverride", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03072   448   NtDeleteValueKey  (364,  (364, "AutoConfigURL", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03073   448   NtClose  (364, ... ) == 0x0
 03074   448   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT"}, ... 364, ) }, ... 364, ) == 0x0
 03075   448   NtCreateKey  (0x2, {24, 364, 0x40, 0, 0,  (0x2, {24, 364, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 368, 2, ) }, 0, "", 0, ... 368, 2, ) == 0x0
 03076   448   NtSetValueKey  (368,  (368, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 0, 4,  (368, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03077   448   NtClose  (368, ... ) == 0x0
 03078   448   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03079   448   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 368, 2, ) }, 0, "", 0, ... 368, 2, ) == 0x0
 03080   448   NtQueryValueKey  (368,  (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03081   448   NtQueryValueKey  (368,  (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03082   448   NtCreateKey  (0x2, {24, 360, 0x40, 0, 0,  (0x2, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 376, 2, ) }, 0, "", 0, ... 376, 2, ) == 0x0
 03083   448   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03084   448   NtClose  (368, ... ) == 0x0
 03085   448   NtSetValueKey  (376,  (376, "SavedLegacySettings", 0, 3, "<\0\0\0\27\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0", 56, ... , 0, 3,  (376, "SavedLegacySettings", 0, 3, "<\0\0\0\27\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0", 56, ... , 56, ...
 03086   448   NtSetInformationFile  (-2147482740, -136509644, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 03087   448   NtSetInformationFile  (-2147482740, -136509744, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 03085   448   NtSetValueKey  ... ) == 0x0
 03088   448   NtClose  (376, ... ) == 0x0
 03089   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03090   448   NtQueryInformationFile  (192, 1242180, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03091   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03092   448   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03093   448   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03094   448   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03095   448   NtClearEvent  (376, ... ) == 0x0
 03096   448   NtSetEvent  (376, ... 0x0, ) == 0x0
 03097   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03098   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1239760, ... }, 1239760, ...
 02515   588   NtWaitForSingleObject  ... ) == 0x0
 03099   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03100   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03098   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03101   448   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "wsock32.dll"}, 1239760, ... }, 1239760, ...
 03100   588   NtWaitForSingleObject  ... ) == 0x0
 03102   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03103   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03101   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03104   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 1239760, ... ) }, 1239760, ... ) == 0x0
 03105   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 5, 96, ... 368, {status=0x0, info=1}, ) }, 5, 96, ... 368, {status=0x0, info=1}, ) == 0x0
 03106   448   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 368, ... 384, ) == 0x0
 03107   448   NtQuerySection  (384, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03108   448   NtClose  (368, ... ) == 0x0
 03109   448   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0
 03110   448   NtClose  (384, ... ) == 0x0
 03111   448   NtClearEvent  (228, ... ) == 0x0
 03112   448   NtSetEvent  (228, ... 0x0, ) == 0x0
 03113   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03114   448   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03115   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03116   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03117   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03118   448   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03119   448   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03120   448   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03121   448   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03122   448   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03123   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03124   448   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03125   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03126   448   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03127   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "urlmon.dll"}, ... 384, ) }, ... 384, ) == 0x0
 03128   448   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x760f0000), 0x0, 491520, ) == 0x0
 03129   448   NtClose  (384, ... ) == 0x0
 03130   448   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "VERSION.dll"}, ... 384, ) }, ... 384, ) == 0x0
 03131   448   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 28672, ) == 0x0
 03132   448   NtClose  (384, ... ) == 0x0
 03133   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 03134   448   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 10682368, 65536, ) == 0x0
 03135   448   NtAllocateVirtualMemory  (-1, 10682368, 0, 4096, 4096, 4, ... 10682368, 4096, ) == 0x0
 03136   448   NtAllocateVirtualMemory  (-1, 10686464, 0, 8192, 4096, 4, ... 10686464, 8192, ) == 0x0
 03137   448   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCounterMutex"}, 0, ... 384, ) }, 0, ... 384, ) == 0x0
 03138   448   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCacheCounterMutex"}, 0, ... 368, ) }, 0, ... 368, ) == 0x0
 03139   448   NtQueryDefaultUILanguage  (1237672, ...
 03140   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03141   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482072, ) == 0x0
 03142   448   NtQueryInformationToken  (-2147482072, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03143   448   NtClose  (-2147482072, ... ) == 0x0
 03144   448   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482072, ) }, ... -2147482072, ) == 0x0
 03145   448   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03146   448   NtOpenKey  (0x80000000, {24, -2147482072, 0x640, 0, 0,  (0x80000000, {24, -2147482072, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482076, ) }, ... -2147482076, ) == 0x0
 03147   448   NtQueryValueKey  (-2147482076,  (-2147482076, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03148   448   NtClose  (-2147482076, ... ) == 0x0
 03149   448   NtClose  (-2147482072, ... ) == 0x0
 03139   448   NtQueryDefaultUILanguage  ... ) == 0x0
 03150   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03151   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 1, 96, ... 380, {status=0x0, info=1}, ) }, 1, 96, ... 380, {status=0x0, info=1}, ) == 0x0
 03152   448   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 380, ... 388, ) == 0x0
 03153   448   NtMapViewOfSection  (388, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa60000), 0x0, 454656, ) == 0x0
 03154   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03155   448   NtQueryDefaultLocale  (1, 1235708, ... ) == 0x0
 03156   448   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03157   448   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1618, 0} " S\26\0\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 432, 448, 1618, 0}  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" ... {128, 156, reply, 0, 432, 448, 1618, 0} " S\26\0\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" )  ) == 0x0
 03158   448   NtClose  (380, ... ) == 0x0
 03159   448   NtClose  (388, ... ) == 0x0
 03160   448   NtUnmapViewOfSection  (-1, 0xa60000, ... ) == 0x0
 03161   448   NtUnmapViewOfSection  (-1, 0x12e554, ... ) == STATUS_NOT_MAPPED_VIEW
 03162   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03163   448   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03164   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03165   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03166   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1234248, ... }, 1234248, ...
 03103   588   NtWaitForSingleObject  ... ) == 0x0
 03167   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03168   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03166   448   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03169   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03170   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03171   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03172   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1234840, ... ) }, 1234840, ... ) == 0x0
 03173   448   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 388, {status=0x0, info=1}, ) }, 3, 33, ... 388, {status=0x0, info=1}, ) == 0x0
 03174   448   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03175   448   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 03176   448   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 03177   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03178   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03179   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 03180   448   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03181   448   NtClose  (380, ... ) == 0x0
 03182   448   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes"}, ... 380, ) }, ... 380, ) == 0x0
 03183   448   NtSetInformationObject  (382, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 03184   448   NtQueryKey  (382, Name, 384, ... {Name= (382, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 03185   448   NtOpenKey  (0x2000000, {24, 382, 0x40, 0, 0,  (0x2000000, {24, 382, 0x40, 0, 0, "PROTOCOLS\Name-Space Handler\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03186   448   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\PROTOCOLS\Name-Space Handler"}, ... 392, ) }, ... 392, ) == 0x0
 03187   448   NtQueryKey  (394, Name, 392, ... {Name= (394, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space HandlerS"}, 130, ) }, 130, ) == 0x0
 03188   448   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03189   448   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03190   448   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03191   448   NtClose  (396, ... ) == 0x0
 03192   448   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\PROTOCOLS\Name-Space Handler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03193   448   NtEnumerateKey  (394, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name= (394, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name="mk", Class=""}, 28, ) , Class=""}, 28, ) == 0x0
 03194   448   NtEnumerateKey  (394, 1, Node, 288, ... ) == STATUS_NO_MORE_ENTRIES
 03195   448   NtClose  (394, ... ) == 0x0
 03196   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03197   448   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03198   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 392, ) }, ... 392, ) == 0x0
 03199   448   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Ranges\"}, ... 396, ) }, ... 396, ) == 0x0
 03200   448   NtQueryKey  (396, 4, 176, ... {key info, class 4, size 40}, 40, ) == 0x0
 03201   448   NtClose  (396, ... ) == 0x0
 03202   448   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 432, 448, 1619, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 432, 448, 1619, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 432, 448, 1619, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 03203   448   NtCreateSection  (0xf0007, {24, 52, 0x80, 0, 0,  (0xf0007, {24, 52, 0x80, 0, 0, "UrlZonesSM_SRI-user"}, {8, 0}, 4, 134217728, 0, ... 396, ) }, {8, 0}, 4, 134217728, 0, ... 396, ) == 0x0
 03204   448   NtMapViewOfSection  (396, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa60000), {0, 0}, 4096, ) == 0x0
 03205   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 400, ) }, ... 400, ) == 0x0
 03206   448   NtQueryValueKey  (400,  (400, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03207   448   NtClose  (400, ... ) == 0x0
 03208   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 400, ) }, ... 400, ) == 0x0
 03209   448   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "0"}, ... 404, ) }, ... 404, ) == 0x0
 03210   448   NtClose  (404, ... ) == 0x0
 03211   448   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "1"}, ... 404, ) }, ... 404, ) == 0x0
 03212   448   NtClose  (404, ... ) == 0x0
 03213   448   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "2"}, ... 404, ) }, ... 404, ) == 0x0
 03214   448   NtClose  (404, ... ) == 0x0
 03215   448   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "3"}, ... 404, ) }, ... 404, ) == 0x0
 03216   448   NtClose  (404, ... ) == 0x0
 03217   448   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "4"}, ... 404, ) }, ... 404, ) == 0x0
 03218   448   NtClose  (404, ... ) == 0x0
 03219   448   NtClose  (400, ... ) == 0x0
 03220   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 400, ) }, ... 400, ) == 0x0
 03221   448   NtEnumerateKey  (400, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name= (400, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name="0"}, 18, ) }, 18, ) == 0x0
 03222   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"}, ... 404, ) }, ... 404, ) == 0x0
 03223   448   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) }, 16, ) == 0x0
 03224   448   NtClose  (404, ... ) == 0x0
 03225   448   NtEnumerateKey  (400, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="1"}, 18, ) }, 18, ) == 0x0
 03226   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1"}, ... 404, ) }, ... 404, ) == 0x0
 03227   448   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) }, 16, ) == 0x0
 03228   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03229   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03230   448   NtOpenKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 408, ) }, ... 408, ) == 0x0
 03231   448   NtSetValueKey  (408,  (408, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03232   448   NtSetValueKey  (408,  (408, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03233   448   NtSetValueKey  (408,  (408, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03234   448   NtClose  (408, ... ) == 0x0
 03235   448   NtClose  (404, ... ) == 0x0
 03236   448   NtEnumerateKey  (400, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="2I"}, 18, ) }, 18, ) == 0x0
 03237   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2"}, ... 404, ) }, ... 404, ) == 0x0
 03238   448   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) }, 16, ) == 0x0
 03239   448   NtClose  (404, ... ) == 0x0
 03240   448   NtEnumerateKey  (400, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="3"}, 18, ) }, 18, ) == 0x0
 03241   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 404, ) }, ... 404, ) == 0x0
 03242   448   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03243   448   NtClose  (404, ... ) == 0x0
 03244   448   NtEnumerateKey  (400, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="4"}, 18, ) }, 18, ) == 0x0
 03245   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"}, ... 404, ) }, ... 404, ) == 0x0
 03246   448   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03247   448   NtClose  (404, ... ) == 0x0
 03248   448   NtEnumerateKey  (400, 5, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 03249   448   NtClose  (400, ... ) == 0x0
 03250   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03251   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03252   448   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03253   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03254   448   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03255   448   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03256   448   NtClearEvent  (228, ... ) == 0x0
 03257   448   NtSetEvent  (228, ... 0x0, ) == 0x0
 03258   448   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 400, ) }, ... 400, ) == 0x0
 03259   448   NtQueryValueKey  (400,  (400, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03260   448   NtClose  (400, ... ) == 0x0
 03261   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03262   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03263   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03264   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03265   448   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03266   448   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03267   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 400, ) }, ... 400, ) == 0x0
 03268   448   NtQueryValueKey  (400,  (400, "1A10", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "1A10", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03269   448   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03270   448   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03271   448   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03272   448   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03273   448   NtClose  (400, ... ) == 0x0
 03274   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03275   448   NtQueryInformationFile  (192, 1241900, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03276   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03277   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03278   448   NtQueryInformationFile  (192, 1239516, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03279   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03280   448   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03281   448   NtQueryInformationFile  (212, 1241480, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03282   448   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03283   448   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03284   448   NtQueryInformationFile  (212, 1241440, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03285   448   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03286   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03287   448   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 400, ) == 0x0
 03288   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03289   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03290   448   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {128, 152, reply, 0, 432, 448, 1621, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1621, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {128, 152, reply, 0, 432, 448, 1621, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03291   448   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 44, 3, 20, 0}  (408, {64, 88, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\10\0\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 432, 448, 1622, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 432, 448, 1622, 0}  (408, {64, 88, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\10\0\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 432, 448, 1622, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03292   448   NtClose  (404, ... ) == 0x0
 03293   448   NtClose  (408, ... ) == 0x0
 03294   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03295   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03296   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03297   448   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03298   448   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03299   448   NtClose  (408, ... ) == 0x0
 03300   448   NtClose  (404, ... ) == 0x0
 03301   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03302   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03303   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03304   448   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03305   448   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03306   448   NtClose  (404, ... ) == 0x0
 03307   448   NtClose  (408, ... ) == 0x0
 03308   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03309   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03310   448   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03311   448   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03312   448   NtClose  (408, ... ) == 0x0
 03313   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03314   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03315   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03316   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03317   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03318   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03319   448   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1625, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1625, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1625, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" )  ) == 0x0
 03320   448   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 432, 448, 1622, 0}  (404, {112, 136, new_msg, 0, 432, 448, 1622, 0} "\1H\0\0A\2\11\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03168   588   NtWaitForSingleObject  ... ) == 0x0
 03321   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03322   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03320   448   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 432, 448, 1626, 0}  ... {44, 68, reply, 0, 432, 448, 1626, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03323   448   NtClose  (408, ... ) == 0x0
 03324   448   NtClose  (404, ... ) == 0x0
 03325   448   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03326   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03327   448   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03328   448   NtClose  (408, ... ) == 0x0
 03329   448   NtClose  (404, ... ) == 0x0
 03330   448   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03331   448   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03332   448   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03333   448   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03334   448   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03335   448   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03336   448   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 03337   448   NtClose  (404, ... ) == 0x0
 03338   448   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03339   448   NtClose  (408, ... ) == 0x0
 03340   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03341   448   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03342   448   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 03343   448   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 03344   448   NtClose  (408, ... ) == 0x0
 03345   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03346   448   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03347   448   NtClose  (408, ... ) == 0x0
 03348   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03349   448   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03350   448   NtClose  (408, ... ) == 0x0
 03351   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03352   448   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03353   448   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03354   448   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03355   448   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 03356   448   NtClose  (404, ... ) == 0x0
 03357   448   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 03358   448   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 03359   448   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ... 1437696, 4096, ) == 0x0
 03360   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03361   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03362   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03363   448   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03364   448   NtClose  (404, ... ) == 0x0
 03365   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03366   448   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 03367   448   NtClose  (404, ... ) == 0x0
 03368   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03369   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 03370   448   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 03371   448   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 03372   448   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03373   448   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03374   448   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03375   448   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03376   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03377   448   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03378   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03379   448   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03380   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03381   448   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03382   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03383   448   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03384   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03385   448   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03386   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03387   448   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03388   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03389   448   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03390   448   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03391   448   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03392   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03393   448   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03394   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03395   448   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03396   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03397   448   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03398   448   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03399   448   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03400   448   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03401   448   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03402   448   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03403   448   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03404   448   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03405   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03406   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03407   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03408   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03409   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03410   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03411   448   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03412   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03413   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03414   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03415   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03416   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03417   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03418   448   NtClose  (404, ... ) == 0x0
 03419   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 03420   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 03421   448   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03422   448   NtClose  (416, ... ) == 0x0
 03423   448   NtClose  (404, ... ) == 0x0
 03424   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03425   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03426   448   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03427   448   NtClose  (404, ... ) == 0x0
 03428   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03429   448   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03430   448   NtClose  (404, ... ) == 0x0
 03431   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03432   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 03433   448   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03434   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03435   448   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03436   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03437   448   NtClose  (404, ... ) == 0x0
 03438   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03439   448   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03440   448   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03441   448   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03442   448   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03443   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03444   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03445   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 03446   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03447   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03448   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 03449   448   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03450   448   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03451   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03452   448   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03453   448   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\362#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03454   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\362#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\362#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03455   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\30\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\30\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\30\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\30\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03456   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\30\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\30\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03457   448   NtClose  (416, ... ) == 0x0
 03458   448   NtClose  (420, ... ) == 0x0
 03459   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03460   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 03461   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03462   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03463   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03464   448   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03465   448   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03466   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03467   448   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03468   448   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\363#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03469   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\363#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\363#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03470   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\31\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\31\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\31\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\31\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03471   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\31\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\31\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03472   448   NtClose  (420, ... ) == 0x0
 03473   448   NtClose  (416, ... ) == 0x0
 03474   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03475   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03476   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03477   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 03478   448   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03479   448   NtClose  (416, ... ) == 0x0
 03480   448   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 03481   448   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03482   448   NtClose  (416, ... ) == 0x0
 03483   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03484   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03485   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 03486   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03487   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03488   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03489   448   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03490   448   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03491   448   NtClose  (416, ... ) == 0x0
 03492   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03493   448   NtAllocateVirtualMemory  (-1, 1441792, 0, 12288, 4096, 4, ... 1441792, 12288, ) == 0x0
 03494   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03495   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03496   448   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03497   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03498   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03499   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03500   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03501   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03502   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03503   448   NtClose  (420, ... ) == 0x0
 03504   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03505   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03506   448   NtClose  (420, ... ) == 0x0
 03507   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03508   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03509   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03510   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03511   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03512   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03513   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03514   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03515   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03516   448   NtClose  (420, ... ) == 0x0
 03517   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03518   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03519   448   NtClose  (420, ... ) == 0x0
 03520   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03521   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03522   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03523   448   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03524   448   NtClose  (416, ... ) == 0x0
 03525   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03526   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03527   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03528   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03529   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03530   448   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03531   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03532   448   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03533   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03534   448   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03535   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03536   448   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03537   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03538   448   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03539   448   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03540   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03541   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03542   448   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03543   448   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03544   448   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03545   448   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03546   448   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03547   448   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03548   448   NtClose  (416, ... ) == 0x0
 03549   448   NtClose  (404, ... ) == 0x0
 03550   448   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 03551   448   NtClose  (412, ... ) == 0x0
 03552   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 03553   448   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03554   448   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 03555   448   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03556   448   NtClose  (412, ... ) == 0x0
 03557   448   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03558   448   NtClose  (404, ... ) == 0x0
 03559   448   NtClose  (408, ... ) == 0x0
 03560   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03561   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03562   448   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03563   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03564   448   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03565   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03566   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03567   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03568   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03569   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03570   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03571   448   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1629, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1629, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1629, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03572   448   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03322   588   NtWaitForSingleObject  ... ) == 0x0
 03573   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03574   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03572   448   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 432, 448, 1630, 0}  ... {44, 68, reply, 0, 432, 448, 1630, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03575   448   NtClose  (408, ... ) == 0x0
 03576   448   NtClose  (404, ... ) == 0x0
 03577   448   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03578   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03579   448   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03580   448   NtClose  (408, ... ) == 0x0
 03581   448   NtClose  (404, ... ) == 0x0
 03582   448   NtClearEvent  (376, ... ) == 0x0
 03583   448   NtSetEvent  (376, ... 0x0, ) == 0x0
 03584   448   NtClose  (376, ... ) == 0x0
 03585   448   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03586   448   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03587   448   NtClearEvent  (376, ... ) == 0x0
 03588   448   NtSetEvent  (376, ... 0x0, ) == 0x0
 03589   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03590   448   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03591   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03592   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03593   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03594   448   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03595   448   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03596   448   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03597   448   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03598   448   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03599   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03600   448   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03601   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03602   448   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03603   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03604   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03605   448   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03606   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03607   448   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03608   448   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03609   448   NtClearEvent  (228, ... ) == 0x0
 03610   448   NtSetEvent  (228, ... 0x0, ) == 0x0
 03611   448   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 404, ) }, ... 404, ) == 0x0
 03612   448   NtQueryValueKey  (404,  (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03613   448   NtClose  (404, ... ) == 0x0
 03614   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03615   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03616   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03617   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03618   448   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03619   448   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03620   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03621   448   NtQueryInformationFile  (192, 1241896, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03622   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03623   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03624   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03625   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03626   448   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1633, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1633, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1633, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 03627   448   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 432, 448, 1630, 0}  (408, {64, 88, new_msg, 0, 432, 448, 1630, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 432, 448, 1634, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 432, 448, 1634, 0}  (408, {64, 88, new_msg, 0, 432, 448, 1630, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 432, 448, 1634, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03628   448   NtClose  (404, ... ) == 0x0
 03629   448   NtClose  (408, ... ) == 0x0
 03630   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03631   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03632   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03633   448   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03634   448   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03635   448   NtClose  (408, ... ) == 0x0
 03636   448   NtClose  (404, ... ) == 0x0
 03637   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03638   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03639   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03640   448   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03641   448   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03642   448   NtClose  (404, ... ) == 0x0
 03643   448   NtClose  (408, ... ) == 0x0
 03644   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03645   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03646   448   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03647   448   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03648   448   NtClose  (408, ... ) == 0x0
 03649   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03650   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03651   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03652   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03653   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03654   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03655   448   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1637, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1637, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1637, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 03656   448   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 432, 448, 1634, 0}  (404, {112, 136, new_msg, 0, 432, 448, 1634, 0} "\1H\0\0A\2\11\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03574   588   NtWaitForSingleObject  ... ) == 0x0
 03657   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03658   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03656   448   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 432, 448, 1638, 0}  ... {44, 68, reply, 0, 432, 448, 1638, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03659   448   NtClose  (408, ... ) == 0x0
 03660   448   NtClose  (404, ... ) == 0x0
 03661   448   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03662   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03663   448   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv02.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03664   448   NtClose  (408, ... ) == 0x0
 03665   448   NtClose  (404, ... ) == 0x0
 03666   448   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03667   448   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03668   448   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03669   448   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03670   448   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03671   448   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03672   448   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 03673   448   NtClose  (404, ... ) == 0x0
 03674   448   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03675   448   NtClose  (408, ... ) == 0x0
 03676   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03677   448   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03678   448   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 03679   448   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 03680   448   NtClose  (408, ... ) == 0x0
 03681   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03682   448   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03683   448   NtClose  (408, ... ) == 0x0
 03684   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03685   448   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03686   448   NtClose  (408, ... ) == 0x0
 03687   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03688   448   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03689   448   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03690   448   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03691   448   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 03692   448   NtClose  (404, ... ) == 0x0
 03693   448   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 03694   448   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 03695   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03696   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03697   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03698   448   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03699   448   NtClose  (404, ... ) == 0x0
 03700   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03701   448   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 03702   448   NtClose  (404, ... ) == 0x0
 03703   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03704   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 03705   448   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 03706   448   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 03707   448   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03708   448   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03709   448   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03710   448   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03711   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03712   448   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03713   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03714   448   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03715   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03716   448   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03717   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03718   448   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03719   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03720   448   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03721   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03722   448   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03723   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03724   448   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03725   448   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03726   448   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03727   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03728   448   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03729   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03730   448   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03731   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03732   448   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03733   448   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03734   448   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03735   448   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03736   448   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03737   448   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03738   448   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03739   448   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03740   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03741   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03742   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03743   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03744   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03745   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03746   448   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03747   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03748   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03749   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03750   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03751   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03752   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03753   448   NtClose  (404, ... ) == 0x0
 03754   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 03755   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 03756   448   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03757   448   NtClose  (416, ... ) == 0x0
 03758   448   NtClose  (404, ... ) == 0x0
 03759   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03760   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03761   448   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03762   448   NtClose  (404, ... ) == 0x0
 03763   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03764   448   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03765   448   NtClose  (404, ... ) == 0x0
 03766   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03767   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 03768   448   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03769   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03770   448   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03771   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03772   448   NtClose  (404, ... ) == 0x0
 03773   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03774   448   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03775   448   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03776   448   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03777   448   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03778   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03779   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03780   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 03781   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03782   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03783   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 03784   448   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03785   448   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03786   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03787   448   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03788   448   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\364#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03789   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\364#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\364#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03790   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\32\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\32\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\32\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\32\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03791   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\32\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\32\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03792   448   NtClose  (416, ... ) == 0x0
 03793   448   NtClose  (420, ... ) == 0x0
 03794   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03795   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 03796   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03797   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03798   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03799   448   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03800   448   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03801   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03802   448   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03803   448   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\365#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03804   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\365#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\365#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03805   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\33\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\33\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\33\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\33\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03806   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\33\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\33\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03807   448   NtClose  (420, ... ) == 0x0
 03808   448   NtClose  (416, ... ) == 0x0
 03809   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03810   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03811   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03812   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 03813   448   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03814   448   NtClose  (416, ... ) == 0x0
 03815   448   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 03816   448   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03817   448   NtClose  (416, ... ) == 0x0
 03818   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03819   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03820   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 03821   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03822   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03823   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03824   448   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03825   448   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03826   448   NtClose  (416, ... ) == 0x0
 03827   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03828   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03829   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03830   448   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03831   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03832   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03833   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03834   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03835   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03836   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03837   448   NtClose  (420, ... ) == 0x0
 03838   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03839   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03840   448   NtClose  (420, ... ) == 0x0
 03841   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03842   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03843   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03844   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03845   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03846   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03847   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03848   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03849   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03850   448   NtClose  (420, ... ) == 0x0
 03851   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03852   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03853   448   NtClose  (420, ... ) == 0x0
 03854   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03855   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03856   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03857   448   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03858   448   NtClose  (416, ... ) == 0x0
 03859   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03860   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03861   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03862   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03863   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03864   448   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03865   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03866   448   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03867   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03868   448   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03869   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03870   448   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03871   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03872   448   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03873   448   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03874   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03875   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03876   448   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03877   448   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03878   448   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03879   448   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03880   448   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03881   448   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03882   448   NtClose  (416, ... ) == 0x0
 03883   448   NtClose  (404, ... ) == 0x0
 03884   448   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 03885   448   NtClose  (412, ... ) == 0x0
 03886   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 03887   448   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03888   448   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 03889   448   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03890   448   NtClose  (412, ... ) == 0x0
 03891   448   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03892   448   NtClose  (404, ... ) == 0x0
 03893   448   NtClose  (408, ... ) == 0x0
 03894   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03895   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03896   448   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03897   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03898   448   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03899   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03900   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03901   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03902   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03903   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03904   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03905   448   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1641, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1641, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1641, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03906   448   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03658   588   NtWaitForSingleObject  ... ) == 0x0
 03907   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03908   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03906   448   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 432, 448, 1642, 0}  ... {44, 68, reply, 0, 432, 448, 1642, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03909   448   NtClose  (408, ... ) == 0x0
 03910   448   NtClose  (404, ... ) == 0x0
 03911   448   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03912   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03913   448   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv02.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03914   448   NtClose  (408, ... ) == 0x0
 03915   448   NtClose  (404, ... ) == 0x0
 03916   448   NtClearEvent  (376, ... ) == 0x0
 03917   448   NtSetEvent  (376, ... 0x0, ) == 0x0
 03918   448   NtClose  (376, ... ) == 0x0
 03919   448   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03920   448   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03921   448   NtClearEvent  (376, ... ) == 0x0
 03922   448   NtSetEvent  (376, ... 0x0, ) == 0x0
 03923   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03924   448   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03925   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03926   448   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03927   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03928   448   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03929   448   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03930   448   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03931   448   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03932   448   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03933   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03934   448   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03935   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03936   448   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03937   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03938   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03939   448   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\debelizombi.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03940   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\debelizombi.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03941   448   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03942   448   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03943   448   NtClearEvent  (228, ... ) == 0x0
 03944   448   NtSetEvent  (228, ... 0x0, ) == 0x0
 03945   448   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 404, ) }, ... 404, ) == 0x0
 03946   448   NtQueryValueKey  (404,  (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03947   448   NtClose  (404, ... ) == 0x0
 03948   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03949   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03950   448   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03951   448   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03952   448   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03953   448   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03954   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03955   448   NtQueryInformationFile  (192, 1241896, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03956   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03957   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03958   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03959   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03960   448   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1645, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1645, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1645, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 03961   448   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 432, 448, 1642, 0}  (408, {64, 88, new_msg, 0, 432, 448, 1642, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 432, 448, 1646, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 432, 448, 1646, 0}  (408, {64, 88, new_msg, 0, 432, 448, 1642, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 432, 448, 1646, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03962   448   NtClose  (404, ... ) == 0x0
 03963   448   NtClose  (408, ... ) == 0x0
 03964   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03965   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03966   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03967   448   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03968   448   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03969   448   NtClose  (408, ... ) == 0x0
 03970   448   NtClose  (404, ... ) == 0x0
 03971   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03972   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03973   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03974   448   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03975   448   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03976   448   NtClose  (404, ... ) == 0x0
 03977   448   NtClose  (408, ... ) == 0x0
 03978   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03979   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03980   448   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03981   448   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03982   448   NtClose  (408, ... ) == 0x0
 03983   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03984   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03985   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03986   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03987   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03988   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03989   448   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1649, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1649, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1649, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 03990   448   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 432, 448, 1646, 0}  (404, {112, 136, new_msg, 0, 432, 448, 1646, 0} "\1H\0\0A\2\11\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03908   588   NtWaitForSingleObject  ... ) == 0x0
 03991   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=95}, 0x0, ) , 16, 0, ... {status=0x103, info=95}, 0x0, ) == 0x103
 03992   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03990   448   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 432, 448, 1650, 0}  ... {44, 68, reply, 0, 432, 448, 1650, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03993   448   NtClose  (408, ... ) == 0x0
 03994   448   NtClose  (404, ... ) == 0x0
 03995   448   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03996   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03997   448   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.debelizombi.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03998   448   NtClose  (408, ... ) == 0x0
 03999   448   NtClose  (404, ... ) == 0x0
 04000   448   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 04001   448   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 04002   448   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 04003   448   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04004   448   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04005   448   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 04006   448   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 04007   448   NtClose  (404, ... ) == 0x0
 04008   448   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04009   448   NtClose  (408, ... ) == 0x0
 04010   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04011   448   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 04012   448   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 04013   448   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 04014   448   NtClose  (408, ... ) == 0x0
 04015   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 04016   448   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 04017   448   NtClose  (408, ... ) == 0x0
 04018   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 04019   448   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 04020   448   NtClose  (408, ... ) == 0x0
 04021   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04022   448   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 04023   448   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 04024   448   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 04025   448   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 04026   448   NtClose  (404, ... ) == 0x0
 04027   448   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 04028   448   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 04029   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04030   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04031   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04032   448   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 04033   448   NtClose  (404, ... ) == 0x0
 04034   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04035   448   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 04036   448   NtClose  (404, ... ) == 0x0
 04037   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04038   448   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 04039   448   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 04040   448   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 04041   448   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 04042   448   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 04043   448   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 04044   448   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 04045   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04046   448   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 04047   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04048   448   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 04049   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04050   448   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 04051   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04052   448   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 04053   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04054   448   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 04055   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04056   448   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 04057   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04058   448   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04059   448   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04060   448   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 04061   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04062   448   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 04063   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04064   448   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 04065   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04066   448   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 04067   448   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 04068   448   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 04069   448   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 04070   448   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 04071   448   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 04072   448   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 04073   448   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04074   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04075   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04076   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 04077   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04078   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04079   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04080   448   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04081   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04082   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04083   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 04084   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04085   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04086   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04087   448   NtClose  (404, ... ) == 0x0
 04088   448   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 04089   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 04090   448   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 04091   448   NtClose  (416, ... ) == 0x0
 04092   448   NtClose  (404, ... ) == 0x0
 04093   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04094   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04095   448   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 04096   448   NtClose  (404, ... ) == 0x0
 04097   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04098   448   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 04099   448   NtClose  (404, ... ) == 0x0
 04100   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04101   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 04102   448   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 04103   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04104   448   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 04105   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04106   448   NtClose  (404, ... ) == 0x0
 04107   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04108   448   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 04109   448   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 04110   448   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 04111   448   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 04112   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04113   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04114   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 04115   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04116   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04117   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 04118   448   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04119   448   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04120   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04121   448   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04122   448   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\366#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04123   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\366#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\366#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04124   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\34\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\34\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\34\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\34\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04125   448   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\34\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\34\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 04126   448   NtClose  (416, ... ) == 0x0
 04127   448   NtClose  (420, ... ) == 0x0
 04128   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04129   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 04130   448   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04131   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04132   448   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 04133   448   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04134   448   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04135   448   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04136   448   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04137   448   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\367#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04138   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\367#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\367#\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04139   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\35\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\35\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\35\223\7:\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\35\223\7:\302?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04140   448   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\35\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\35\223\7:\302?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 04141   448   NtClose  (420, ... ) == 0x0
 04142   448   NtClose  (416, ... ) == 0x0
 04143   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04144   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04145   448   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04146   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 04147   448   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 04148   448   NtClose  (416, ... ) == 0x0
 04149   448   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 04150   448   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04151   448   NtClose  (416, ... ) == 0x0
 04152   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04153   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04154   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 04155   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 04156   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04157   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04158   448   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04159   448   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 04160   448   NtClose  (416, ... ) == 0x0
 04161   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 04162   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04163   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04164   448   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04165   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04166   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04167   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04168   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 04169   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04170   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 04171   448   NtClose  (420, ... ) == 0x0
 04172   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04173   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 04174   448   NtClose  (420, ... ) == 0x0
 04175   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04176   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04177   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04178   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04179   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04180   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04181   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 04182   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04183   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 04184   448   NtClose  (420, ... ) == 0x0
 04185   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04186   448   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 04187   448   NtClose  (420, ... ) == 0x0
 04188   448   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04189   448   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04190   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04191   448   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04192   448   NtClose  (416, ... ) == 0x0
 04193   448   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 04194   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 04195   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04196   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 04197   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04198   448   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 04199   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04200   448   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 04201   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04202   448   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 04203   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04204   448   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 04205   448   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04206   448   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 04207   448   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04208   448   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 04209   448   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 04210   448   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 04211   448   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 04212   448   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 04213   448   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 04214   448   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 04215   448   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04216   448   NtClose  (416, ... ) == 0x0
 04217   448   NtClose  (404, ... ) == 0x0
 04218   448   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 04219   448   NtClose  (412, ... ) == 0x0
 04220   448   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 04221   448   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 04222   448   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 04223   448   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 04224   448   NtClose  (412, ... ) == 0x0
 04225   448   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 04226   448   NtClose  (404, ... ) == 0x0
 04227   448   NtClose  (408, ... ) == 0x0
 04228   448   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 04229   448   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 04230   448   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04231   448   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 04232   448   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 04233   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04234   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04235   448   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04236   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04237   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 04238   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 04239   448   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1653, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1653, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1653, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 04240   448   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\302?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03992   588   NtWaitForSingleObject  ... ) == 0x0
 04241   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=95}, 0x0, ) , 16, 0, ... {status=0x103, info=95}, 0x0, ) == 0x103
 04242   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 04240   448   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 432, 448, 1654, 0}  ... {44, 68, reply, 0, 432, 448, 1654, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 04243   448   NtClose  (408, ... ) == 0x0
 04244   448   NtClose  (404, ... ) == 0x0
 04245   448   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 04246   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 04247   448   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.debelizombi.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 04248   448   NtClose  (408, ... ) == 0x0
 04249   448   NtClose  (404, ... ) == 0x0
 04250   448   NtClearEvent  (376, ... ) == 0x0
 04251   448   NtSetEvent  (376, ... 0x0, ) == 0x0
 04252   448   NtClose  (376, ... ) == 0x0
 04253   448   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1242800,  (0x80100080, {24, 0, 0x40, 0, 1242800, "\??\C:\WINDOWS\imon.cfg"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04254   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04255   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04256   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1239612, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1239612, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 04257   448   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376}  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376} "\0$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1657, 0} "\7$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1657, 0}  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376} "\0$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1657, 0} "\7$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 04258   448   NtRequestWaitReplyPort  (404, {64, 88, new_msg, 0, 432, 448, 1654, 0}  (404, {64, 88, new_msg, 0, 432, 448, 1654, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 432, 448, 1658, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 432, 448, 1658, 0}  (404, {64, 88, new_msg, 0, 432, 448, 1654, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 432, 448, 1658, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 04259   448   NtClose  (376, ... ) == 0x0
 04260   448   NtClose  (404, ... ) == 0x0
 04261   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 04262   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 04263   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04264   448   NtQueryValueKey  (404,  (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04265   448   NtQueryValueKey  (404,  (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04266   448   NtClose  (404, ... ) == 0x0
 04267   448   NtClose  (376, ... ) == 0x0
 04268   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 04269   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 04270   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04271   448   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04272   448   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04273   448   NtClose  (376, ... ) == 0x0
 04274   448   NtClose  (404, ... ) == 0x0
 04275   448   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04276   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 04277   448   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1239412, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1239412, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 04278   448   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176}  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176} "\0$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1661, 0} "\7$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" )  ... {128, 152, reply, 0, 432, 448, 1661, 0}  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176} "\0$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" ... {128, 152, reply, 0, 432, 448, 1661, 0} "\7$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" )  ) == 0x0
 04279   448   NtRequestWaitReplyPort  (376, {64, 88, new_msg, 0, 432, 448, 1658, 0}  (376, {64, 88, new_msg, 0, 432, 448, 1658, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 432, 448, 1662, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 432, 448, 1662, 0}  (376, {64, 88, new_msg, 0, 432, 448, 1658, 0} "\1H\0\0A\2\10\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 432, 448, 1662, 0} "\2H,\341\1\0\0\0\210K,\370\360\15W\200\255\0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 04280   448   NtClose  (404, ... ) == 0x0
 04281   448   NtClose  (376, ... ) == 0x0
 04282   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 04283   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 04284   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04285   448   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04286   448   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04287   448   NtClose  (376, ... ) == 0x0
 04288   448   NtClose  (404, ... ) == 0x0
 04289   448   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 04290   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 04291   448   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04292   448   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04293   448   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04294   448   NtClose  (404, ... ) == 0x0
 04295   448   NtClose  (376, ... ) == 0x0
 04296   448   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 04297   448   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 04298   448   NtDeviceIoControlFile  (376, 404, 0x0, 0x0, 0xf14014,  (376, 404, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\231%\362v\2\0\0\200\330\304\362v\0\0\0\0\360\356\22\0O\345\367w{\30\335w\0\0\0\0\300.\24\0\0\0\24\0\200\23\25\0\0\0\0\0\0\360\22\0\277\37\365w\0\0\24\0\203 \365w\10\6\24\0\215\26\365w\0\0\0\0\260\27\25\0\260\31\25\0\24\232\347w\23\30\26\0\250\336\25\0\266\336\25\0\24\30\25\0\377\377\0\0\0\0\0\0\24\30\25\0\7\0\0\0\250\336\25\0\254\357\22\0\177;\245q\0\0\0\0\0\0\0\0\250\336\25\0\0\0\0\0\24\30\25\0\377\377\0\0\1\0\0\0\210\1\24\0\210\23\25\0\4\0\0\0\0\0\0\0\210\1\24\0\200\23\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q\10\30\25\0\364\27\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\260\31\1\1\0\0\24\0D\357\22\0$\364\22\0\274\373\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\260\31\25\0\240\305\25\0\310\266\25\0\340\266\25\0\250\336\25\0\266\336\25\0\24\30\25\0\377\377\0\0\0\0\0\0\24\30\25\0\7\0\0\0\250\336\25\0t\360\22\0\177;\245q\0\0\0\0\0\0\0\0\250\336\25\0\0\0\0\0\24\30\25\0\377\377\0\0\1\0\0\0\210\1\24\0x\23\25\0\4\0\0\0\0\0\0\0\210\1\24\0p\23\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q\10\30\25\0\364\27\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\30*\1\1\0\0\24\0\14\360\22\0\354\364\22\0\274\373\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\30*\25\0\340\260\25\0\310\266\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) , 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 04299   448   NtClose  (404, ... ) == 0x0
 04300   448   NtClose  (376, ... ) == 0x0
 04301   448   NtUserGetMessage  (0, 0, 0, ...
 04242   588   NtWaitForSingleObject  ... ) == 0x0
 04302   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=78}, 0x0, ) , 16, 0, ... {status=0x103, info=78}, 0x0, ) == 0x103
 04303   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x102
 04304   588   NtQuerySystemTime  (... {-54111988, 29873102}, ) == 0x0
 04305   588   NtWaitForSingleObject  (140, 1, {-1, 2147483647}, ... ) == 0x0
 04306   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04307   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04308   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04309   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04310   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04311   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04312   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04313   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04314   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04315   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04316   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04317   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04318   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04319   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04320   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04321   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04322   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04323   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04324   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04325   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04326   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04327   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04328   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04329   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04330   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04331   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04332   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04333   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04334   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04335   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04336   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04337   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04338   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04339   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04340   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04341   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04342   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04343   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04344   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04345   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04346   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04347   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04348   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04349   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04350   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04351   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04352   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04353   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04354   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04355   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04356   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04357   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04358   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04359   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04360   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04361   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04362   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04363   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04364   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04365   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04366   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04367   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04368   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04369   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04370   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04371   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04372   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04373   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04374   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04375   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04376   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04377   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04378   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04379   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04380   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04381   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04382   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04383   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04384   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04385   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04386   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04387   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04388   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04389   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04390   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04391   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04392   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04393   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04394   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04395   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04396   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04397   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04398   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04399   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04400   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04401   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04402   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04403   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04404   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=161}, 0x0, ) , 16, 0, ... {status=0x0, info=161}, 0x0, ) == 0x0
 04405   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=161}, 0x0, ) , 16, 0, ... {status=0x103, info=161}, 0x0, ) == 0x103
 04406   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04407   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04408   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04409   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04410   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04411   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04412   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04413   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04414   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04415   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04416   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04417   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04418   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04419   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04420   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04421   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04422   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04423   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04424   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04425   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04426   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04427   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04428   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04429   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04430   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04431   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04432   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04433   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04434   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04435   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04436   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04437   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04438   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04439   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04440   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04441   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04442   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04443   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04444   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04445   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04446   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04447   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04448   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04449   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04450   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04451   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04452   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04453   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04454   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04455   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04456   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04457   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04458   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04459   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04460   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04461   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04462   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04463   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04464   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04465   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04466   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04467   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04468   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04469   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04470   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04471   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04472   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04473   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04474   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04475   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04476   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04477   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04478   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04479   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04480   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04481   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04482   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04483   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04484   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04485   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04486   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04487   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04488   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04489   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04490   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04491   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04492   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04493   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04494   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04495   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04496   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04497   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04498   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04499   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04500   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04501   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04502   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04503   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04504   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04505   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04506   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04507   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04508   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04509   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04510   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04511   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04512   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04513   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04514   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04515   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04516   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04517   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04518   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04519   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04520   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04521   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04522   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04523   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04524   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04525   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04526   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04527   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04528   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04529   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04530   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04531   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04532   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04533   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04534   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04535   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04536   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04537   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04538   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04539   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04540   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04541   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04542   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04543   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04544   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04545   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04546   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04547   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04548   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04549   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04550   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04551   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04552   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04553   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04554   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04555   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04556   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04557   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04558   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04559   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04560   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04561   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04562   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04563   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04564   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04565   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04566   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04567   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04568   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04569   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04570   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04571   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04572   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04573   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04574   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04575   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04576   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04577   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04578   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04579   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04580   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04581   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04582   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04583   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04584   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04585   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04586   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04587   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04588   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04589   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04590   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04591   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04592   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04593   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04594   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04595   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04596   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04597   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04598   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04599   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04600   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04601   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04602   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04603   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04604   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04605   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04606   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04607   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04608   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04609   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04610   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04611   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04612   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04613   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04614   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04615   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04616   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04617   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04618   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04619   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04620   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04621   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04622   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04623   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04624   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04625   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04626   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04627   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04628   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04629   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04630   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04631   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04632   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04633   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04634   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04635   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04636   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04637   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04638   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04639   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04640   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04641   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04642   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04643   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04644   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04645   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04646   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04647   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04648   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04649   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04650   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04651   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04652   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04653   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04654   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04655   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04656   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04657   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04658   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04659   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04660   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04661   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04662   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04663   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04664   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04665   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04666   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04667   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04668   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04669   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04670   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04671   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04672   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04673   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04674   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04675   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04676   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04677   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04678   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04679   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04680   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04681   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04682   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04683   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04684   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04685   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04686   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04687   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04688   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04689   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04690   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04691   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04692   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04693   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04694   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04695   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04696   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04697   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04698   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04699   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04700   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04701   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04702   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04703   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04704   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04705   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04706   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04707   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04708   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04709   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04710   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04711   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04712   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04713   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04714   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04715   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04716   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04717   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04718   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04719   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04720   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04721   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04722   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04723   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04724   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04725   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04726   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04727   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04728   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04729   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04730   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04731   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04732   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04733   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04734   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04735   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04736   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04737   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04738   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04739   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04740   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04741   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04742   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04743   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04744   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04745   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04746   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04747   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04748   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04749   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04750   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04751   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04752   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04753   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04754   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04755   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04756   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04757   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04758   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04759   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04760   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04761   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04762   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04763   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04764   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04765   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04766   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04767   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04768   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04769   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04770   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04771   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04772   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04773   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04774   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04775   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04776   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04777   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04778   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04779   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04780   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04781   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04782   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04783   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04784   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04785   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04786   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04787   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04788   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04789   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04790   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04791   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04792   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04793   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04794   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04795   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04796   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04797   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04798   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04799   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04800   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04801   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04802   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04803   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04804   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04805   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04806   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04807   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04808   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04809   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04810   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04811   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04812   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04813   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04814   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04815   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04816   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04817   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04818   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04819   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04820   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04821   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04822   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04823   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04824   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04825   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04826   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04827   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04828   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04829   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04830   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04831   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04832   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04833   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04834   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04835   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04836   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04837   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04838   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x103
 04839   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04840   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04841   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04842   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04843   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04844   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04845   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04846   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04847   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04848   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04849   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04850   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04851   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04852   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04853   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04854   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04855   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04856   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04857   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04858   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04859   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04860   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04861   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04862   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04863   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04864   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04865   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04866   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04867   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04868   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04869   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04870   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04871   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04872   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04873   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04874   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04875   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04876   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04877   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04878   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04879   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04880   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04881   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04882   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04883   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04884   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04885   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04886   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04887   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04888   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04889   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04890   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04891   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04892   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04893   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04894   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04895   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04896   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04897   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04898   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04899   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04900   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04901   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04902   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04903   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04904   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04905   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04906   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04907   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04908   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04909   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04910   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04911   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04912   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04913   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04914   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04915   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04916   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04917   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04918   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04919   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04920   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04921   588   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04922   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04923   588   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103