Summary:


NtAddAtom(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtAccessCheck(>) 
 5 
NtUserRegisterWindowMessage(>) 
 20 

NtCallbackReturn(>) 
 1 
NtOpenEvent(>) 
 2 
NtGdiGetStockObject(>) 
 5 
NtWaitForSingleObject(>) 
 20 

NtCreateMutant(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 2 
NtUserGetProcessWindowStation(>) 
 5 
NtQueryInformationFile(>) 
 21 

NtCreateProcessEx(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtOpenThreadToken(>) 
 6 
NtQueryInformationProcess(>) 
 22 

NtEnumerateValueKey(>) 
 1 
NtReadFile(>) 
 2 
NtQueryDirectoryFile(>) 
 7 
NtCreateEvent(>) 
 26 

NtFsControlFile(>) 
 1 
NtReadVirtualMemory(>) 
 2 
NtSetEvent(>) 
 7 
NtOpenProcessTokenEx(>) 
 30 

NtGdiCreateBitmap(>) 
 1 
NtSetEventBoostPriority(>) 
 2 
NtUserBuildHwndList(>) 
 7 
NtOpenThreadTokenEx(>) 
 30 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtClearEvent(>) 
 3 
NtOpenMutant(>) 
 8 
NtCreateSection(>) 
 31 

NtGdiInit(>) 
 1 
NtContinue(>) 
 3 
NtQueryVolumeInformationFile(>) 
 8 
NtFreeVirtualMemory(>) 
 34 

NtGdiQueryFontAssocInfo(>) 
 1 
NtCreateThread(>) 
 3 
NtCreateKey(>) 
 9 
NtQueryInformationToken(>) 
 37 

NtGdiSelectBitmap(>) 
 1 
NtDelayExecution(>) 
 3 
NtOpenProcessToken(>) 
 9 
NtQuerySystemInformation(>) 
 42 

NtOpenKeyedEvent(>) 
 1 
NtDuplicateObject(>) 
 3 
NtSetInformationProcess(>) 
 9 
NtOpenSection(>) 
 45 

NtQueryEvent(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtUserCallNoParam(>) 
 9 
NtUserGetAtomName(>) 
 47 

NtQueryInformationJobObject(>) 
 1 
NtGdiDeleteObjectApp(>) 
 3 
NtQueryDefaultUILanguage(>) 
 10 
NtUserUnregisterClass(>) 
 47 

NtQueryInstallUILanguage(>) 
 1 
NtNotifyChangeKey(>) 
 3 
NtReleaseMutant(>) 
 10 
NtUserFindExistingCursorIcon(>) 
 50 

NtQueryObject(>) 
 1 
NtOpenProcess(>) 
 3 
NtUserGetWindowDC(>) 
 10 
NtOpenFile(>) 
 58 

NtQueryTimerResolution(>) 
 1 
NtReleaseSemaphore(>) 
 3 
NtCreateSemaphore(>) 
 11 
NtQueryVirtualMemory(>) 
 58 

NtSecureConnectPort(>) 
 1 
NtResumeThread(>) 
 3 
NtEnumerateKey(>) 
 12 
NtUserRegisterClassExWOW(>) 
 61 

NtTerminateThread(>) 
 1 
NtSetInformationObject(>) 
 3 
NtUserCallOneParam(>) 
 12 
NtMapViewOfSection(>) 
 63 

NtUserBuildNameList(>) 
 1 
NtTerminateProcess(>) 
 3 
NtUserSystemParametersInfo(>) 
 12 
NtQueryAttributesFile(>) 
 74 

NtUserCloseDesktop(>) 
 1 
NtTestAlert(>) 
 3 
NtSetInformationThread(>) 
 13 
NtFlushInstructionCache(>) 
 132 

NtUserGetDC(>) 
 1 
NtUserOpenDesktop(>) 
 3 
NtQueryDebugFilterState(>) 
 17 
NtAllocateVirtualMemory(>) 
 144 

NtUserGetGUIThreadInfo(>) 
 1 
NtWaitForMultipleObjects(>) 
 3 
NtDeviceIoControlFile(>) 
 18 
NtUserValidateHandleSecure(>) 
 152 

NtUserGetObjectInformation(>) 
 1 
NtQueryInformationThread(>) 
 4 
NtQuerySection(>) 
 18 
NtUserQueryWindow(>) 
 186 

NtUserGetThreadDesktop(>) 
 1 
NtQueryPerformanceCounter(>) 
 4 
NtUnmapViewOfSection(>) 
 18 
NtProtectVirtualMemory(>) 
 271 

NtConnectPort(>) 
 2 
NtRegisterThreadTerminatePort(>) 
 4 
NtRequestWaitReplyPort(>) 
 19 
NtOpenKey(>) 
 305 

NtDuplicateToken(>) 
 2 
NtSetValueKey(>) 
 4 
NtCreateFile(>) 
 20 
NtClose(>) 
 350 

NtGdiCreateSolidBrush(>) 
 2 
NtWriteFile(>) 
 4 
NtQueryDefaultLocale(>) 
 20 
NtQueryValueKey(>) 
 424 

NtGdiHfontCreate(>) 
 2 
NtWriteVirtualMemory(>) 
 4 
NtSetInformationFile(>) 
 20 

Trace:
 00001   808   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00003   808   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00004   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00005   808   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 1310720, 4096, ) == 0x0
 00006   808   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00007   808   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1376256, 1048576, ) == 0x0
 00008   808   NtAllocateVirtualMemory  (-1, 1376256, 0, 10248, 4096, 4, ... 1376256, 12288, ) == 0x0
 00009   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00010   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2424832, 65536, ) == 0x0
 00011   808   NtAllocateVirtualMemory  (-1, 2424832, 0, 24576, 4096, 4, ... 2424832, 24576, ) == 0x0
 00012   808   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00013   808   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00014   808   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00015   808   NtClose  (12, ... ) == 0x0
 00016   808   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00017   808   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00018   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00019   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00020   808   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00021   808   NtClose  (16, ... ) == 0x0
 00022   808   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00023   808   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00024   808   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00025   808   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00026   808   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00027   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00028   808   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00029   808   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1313584, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2490368, 19267584}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1313584, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2490368, 19267584}, {0, 0, 0}, 200, 44, ) == 0x0
 00030   808   NtClose  (16, ... ) == 0x0
 00031   808   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00032   808   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00033   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00034   808   NtQueryVirtualMemory  (-1, 0x260000, Basic, 28, ... {BaseAddress=0x260000,AllocationBase=0x260000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00035   808   NtAllocateVirtualMemory  (-1, 2490368, 0, 4096, 4096, 4, ... 2490368, 4096, ) == 0x0
 00036   808   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6&\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" ... {28, 56, reply, 0, 868, 808, 75544, 0} "P\14\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" )  ... {28, 56, reply, 0, 868, 808, 75544, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6&\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" ... {28, 56, reply, 0, 868, 808, 75544, 0} "P\14\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" )  ) == 0x0
 00037   808   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00038   808   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00039   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00040   808   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00041   808   NtClose  (16, ... ) == 0x0
 00042   808   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00043   808   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x270000), 0x0, 90112, ) == 0x0
 00044   808   NtClose  (16, ... ) == 0x0
 00045   808   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00046   808   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00047   808   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x290000), 0x0, 249856, ) == 0x0
 00048   808   NtClose  (16, ... ) == 0x0
 00049   808   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00050   808   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2d0000), 0x0, 266240, ) == 0x0
 00051   808   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00052   808   NtClose  (16, ... ) == 0x0
 00053   808   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00054   808   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x320000), 0x0, 24576, ) == 0x0
 00055   808   NtClose  (16, ... ) == 0x0
 00056   808   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00057   808   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00058   808   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00059   808   NtAllocateVirtualMemory  (-1, 2494464, 0, 8192, 4096, 4, ... 2494464, 8192, ) == 0x0
 00060   808   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6&\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" ... {24, 52, reply, 0, 868, 808, 75546, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" )  ... {24, 52, reply, 0, 868, 808, 75546, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6&\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" ... {24, 52, reply, 0, 868, 808, 75546, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" )  ) == 0x0
 00061   808   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6&\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6&\18\6\0\0" ... {28, 56, reply, 0, 868, 808, 75547, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6&\18\6\0\0" )  ... {28, 56, reply, 0, 868, 808, 75547, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6&\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6&\18\6\0\0" ... {28, 56, reply, 0, 868, 808, 75547, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6&\18\6\0\0" )  ) == 0x0
 00062   808   NtProtectVirtualMemory  (-1, (0x845000), 221184, 4, ... (0x845000), 221184, 128, ) == 0x0
 00063   808   NtProtectVirtualMemory  (-1, (0x845000), 221184, 128, ... (0x845000), 221184, 8, ) == 0x0
 00064   808   NtFlushInstructionCache  (-1, 8671232, 221184, ... ) == 0x0
 00065   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.DLL"}, ... 16, ) }, ... 16, ) == 0x0
 00066   808   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00067   808   NtClose  (16, ... ) == 0x0
 00068   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00069   808   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00070   808   NtClose  (16, ... ) == 0x0
 00071   808   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00072   808   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00073   808   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00074   808   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00075   808   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00076   808   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00077   808   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00078   808   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00079   808   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00080   808   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00081   808   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00082   808   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00083   808   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00084   808   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00085   808   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00086   808   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00087   808   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00088   808   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00089   808   NtProtectVirtualMemory  (-1, (0x845000), 221184, 4, ... (0x845000), 221184, 128, ) == 0x0
 00090   808   NtProtectVirtualMemory  (-1, (0x845000), 221184, 128, ... (0x845000), 221184, 8, ) == 0x0
 00091   808   NtFlushInstructionCache  (-1, 8671232, 221184, ... ) == 0x0
 00092   808   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00093   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00094   808   NtReadFile  (16, 0, 0, 0, 4, {232444, 0}, 0, ... {status=0x0, info=4},  (16, 0, 0, 0, 4, {232444, 0}, 0, ... {status=0x0, info=4}, "\376\201\307P", ) , ) == 0x0
 00095   808   NtClose  (16, ... ) == 0x0
 00096   808   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00097   808   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00098   808   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00099   808   NtClose  (16, ... ) == 0x0
 00100   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00101   808   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00102   808   NtClose  (16, ... ) == 0x0
 00103   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00104   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00105   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00106   808   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 2012282880, 2090320576, 1242028}  (24, {28, 56, new_msg, 0, 2089900645, 2012282880, 2090320576, 1242028} "\210\6&\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6&\1$\1\0\0" ... {28, 56, reply, 0, 868, 808, 75624, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6&\1$\1\0\0" )  ... {28, 56, reply, 0, 868, 808, 75624, 0}  (24, {28, 56, new_msg, 0, 2089900645, 2012282880, 2090320576, 1242028} "\210\6&\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6&\1$\1\0\0" ... {28, 56, reply, 0, 868, 808, 75624, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6&\1$\1\0\0" )  ) == 0x0
 00107   808   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00108   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00109   808   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00110   808   NtClose  (16, ... ) == 0x0
 00111   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0
 00112   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00113   808   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 16, ... 28, ) == 0x0
 00114   808   NtClose  (16, ... ) == 0x0
 00115   808   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x880000), 0x0, 110592, ) == 0x0
 00116   808   NtClose  (28, ... ) == 0x0
 00117   808   NtUnmapViewOfSection  (-1, 0x880000, ... ) == 0x0
 00118   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0
 00119   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00120   808   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 16, ) == 0x0
 00121   808   NtClose  (28, ... ) == 0x0
 00122   808   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x880000), 0x0, 110592, ) == 0x0
 00123   808   NtClose  (16, ... ) == 0x0
 00124   808   NtUnmapViewOfSection  (-1, 0x880000, ... ) == 0x0
 00125   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0
 00126   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00127   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00128   808   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00129   808   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00130   808   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00131   808   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00132   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00133   808   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00134   808   NtClose  (36, ... ) == 0x0
 00135   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00136   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00137   808   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00138   808   NtClose  (36, ... ) == 0x0
 00139   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00140   808   NtClose  (32, ... ) == 0x0
 00141   808   NtClose  (16, ... ) == 0x0
 00142   808   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00143   808   NtClose  (28, ... ) == 0x0
 00144   808   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00145   808   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00146   808   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00147   808   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00148   808   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00149   808   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00150   808   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00151   808   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00152   808   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00153   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00154   808   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00155   808   NtClose  (28, ... ) == 0x0
 00156   808   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00157   808   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00158   808   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00159   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00160   808   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00161   808   NtClose  (28, ... ) == 0x0
 00162   808   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00163   808   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00164   808   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00165   808   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00166   808   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00167   808   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00168   808   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00169   808   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00170   808   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00171   808   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00172   808   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00173   808   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00174   808   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00175   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00176   808   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 00177   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00178   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00179   808   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00180   808   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00181   808   NtClose  (28, ... ) == 0x0
 00182   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00183   808   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00184   808   NtClose  (28, ... ) == 0x0
 00185   808   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00186   808   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00187   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00189   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0
 00191   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00192   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00193   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0
 00194   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00195   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 16, ) }, ... 16, ) == 0x0
 00196   808   NtQueryValueKey  (16,  (16, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00197   808   NtClose  (16, ... ) == 0x0
 00198   808   NtMapViewOfSection  (-2147482576, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x880000), 0x0, 1060864, ) == 0x0
 00199   808   NtClose  (-2147482576, ... ) == 0x0
 00200   808   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 16, ) == 0x0
 00201   808   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00202   808   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482576, ) == 0x0
 00203   808   NtQueryInformationToken  (-2147482576, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00204   808   NtQueryInformationToken  (-2147482576, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00205   808   NtClose  (-2147482576, ... ) == 0x0
 00206   808   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 10027008, 4096, ) == 0x0
 00207   808   NtFreeVirtualMemory  (-1, (0x990000), 4096, 32768, ... (0x990000), 4096, ) == 0x0
 00208   808   NtDuplicateObject  (-1, 32, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00209   808   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 00210   808   NtQueryValueKey  (-2147482576,  (-2147482576, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00211   808   NtClose  (-2147482576, ... ) == 0x0
 00212   808   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 00213   808   NtQueryValueKey  (-2147482576,  (-2147482576, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00214   808   NtClose  (-2147482576, ... ) == 0x0
 00215   808   NtQueryDefaultLocale  (0, -142005940, ... ) == 0x0
 00216   808   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00217   808   NtUserCallNoParam  (24, ... ) == 0x0
 00218   808   NtGdiCreateCompatibleDC  (0, ...
 00219   808   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 10027008, 4096, ) == 0x0
 00218   808   NtGdiCreateCompatibleDC  ... ) == 0xb3010623
 00220   808   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00221   808   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00222   808   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x9f0504fb
 00223   808   NtGdiCreateSolidBrush  (0, 0, ...
 00224   808   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 13238272, 4096, ) == 0x0
 00223   808   NtGdiCreateSolidBrush  ... ) == 0x8210062f
 00225   808   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00226   808   NtGdiCreateCompatibleDC  (0, ... ) == 0x5f01056a
 00227   808   NtGdiSelectBitmap  (1593902442, -1627060997, ... ) == 0x185000f
 00228   808   NtUserGetThreadDesktop  (808, 0, ... ) == 0x24
 00229   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00230   808   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00231   808   NtClose  (44, ... ) == 0x0
 00232   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00233   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x819fc017
 00234   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00235   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x819fc01c
 00236   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00237   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x819fc01e
 00238   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00239   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x819f8002
 00240   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10013
 00241   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x819fc018
 00242   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00243   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x819fc01a
 00244   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00245   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x819fc01d
 00246   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00247   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x819fc026
 00248   808   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00249   808   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x819fc019
 00250   808   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x819fc020
 00251   808   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x819fc022
 00252   808   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x819fc023
 00253   808   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x819fc024
 00254   808   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x819fc025
 00255   808   NtCallbackReturn  (0, 0, 0, ...
 00256   808   NtGdiInit  (... ) == 0x1
 00257   808   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00258   808   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00259   808   NtTestAlert  (... ) == 0x0
 00260   808   NtContinue  (1244464, 1, ...
 00261   808   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x4012f2,}, 4, ... ) == 0x0
 00262   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 44, ) }, ... 44, ) == 0x0
 00263   808   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00264   808   NtClose  (44, ... ) == 0x0
 00265   808   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00266   808   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00267   808   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00268   808   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00269   808   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00270   808   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00271   808   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00272   808   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00273   808   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00274   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 44, ) }, ... 44, ) == 0x0
 00275   808   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00276   808   NtClose  (44, ... ) == 0x0
 00277   808   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00278   808   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00279   808   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00280   808   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00281   808   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00282   808   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00283   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 44, ) }, ... 44, ) == 0x0
 00284   808   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00285   808   NtClose  (44, ... ) == 0x0
 00286   808   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00287   808   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00288   808   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00289   808   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00290   808   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00291   808   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00292   808   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00293   808   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00294   808   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00295   808   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00296   808   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00297   808   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00298   808   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00299   808   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00300   808   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00301   808   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00302   808   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00303   808   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00304   808   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00305   808   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00306   808   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00307   808   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00308   808   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00309   808   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00310   808   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00311   808   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00312   808   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00313   808   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00314   808   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00315   808   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00316   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00317   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00318   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 13303808, 65536, ) == 0x0
 00319   808   NtAllocateVirtualMemory  (-1, 13303808, 0, 4096, 4096, 4, ... 13303808, 4096, ) == 0x0
 00320   808   NtAllocateVirtualMemory  (-1, 13307904, 0, 8192, 4096, 4, ... 13307904, 8192, ) == 0x0
 00321   808   NtAllocateVirtualMemory  (-1, 13316096, 0, 4096, 4096, 4, ... 13316096, 4096, ) == 0x0
 00322   808   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00323   808   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xcc0000), 0x0, 12288, ) == 0x0
 00324   808   NtClose  (44, ... ) == 0x0
 00325   808   NtAllocateVirtualMemory  (-1, 13320192, 0, 4096, 4096, 4, ... 13320192, 4096, ) == 0x0
 00326   808   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00327   808   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00328   808   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00329   808   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00330   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00331   808   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 00332   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 44, {status=0x0, info=0}, ) }, 7, 16, ... 44, {status=0x0, info=0}, ) == 0x0
 00333   808   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\364\307\3]\220\30\2130g)!"\310M\357}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... \310M\357}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 00334   808   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00335   808   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00336   808   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00337   808   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00338   808   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00339   808   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00340   808   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00341   808   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0
 00342   808   NtSetValueKey  (-2147482576,  (-2147482576, "Seed", 0, 3, "\313\32\335\344=\275\245%\11=\302\225(\206\15\303\271\303\320\355$\347\356w\272BT\213\16\353\233\33~\17\364\222\203\344^f\252\24L\35\32\216#r\366\204I]\252\223mV\235a\245\16\136\310'\276\247Y\330\316\360\231\367\10\177\274\37\302\336\301j", 80, ... ) , 0, 3,  (-2147482576, "Seed", 0, 3, "\313\32\335\344=\275\245%\11=\302\225(\206\15\303\271\303\320\355$\347\356w\272BT\213\16\353\233\33~\17\364\222\203\344^f\252\24L\35\32\216#r\366\204I]\252\223mV\235a\245\16\136\310'\276\247Y\330\316\360\231\367\10\177\274\37\302\336\301j", 80, ... ) , 80, ... ) == 0x0
 00343   808   NtClose  (-2147482576, ... ) == 0x0
 00333   808   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\317\373T\234\367\215J\234*\1\20\344\327w\207\260\326\265\351\320S\356\33=\305K\350 \210\4\262\36\17\247\343\24\17\223\31\376\205\250\350\5\304\0\337\237\311;\271\251\354\373\7~bp\220u`\347\244U\331,\365\362\235/OLy\20\376\340-\11\7\353\322+\373|\307\12\323]\356\367zi\242UV\\347\204\324\250\262\36463\3020\264\211<\346\34\15\16\241\343Lk!\243Nbb`)A\312\362\367l\177\307\262*\276\264\2109\274\201\230\352B\276\276\227b'\341,\273\374\4\33[hhqQ>\373\0i\1\6\12\220*\316=\370w\264<\17\10\304\247\20\20\241>\354KM=\251\26\3111\214\33\361\250U\223\267\16\4jRx\301\234\241\224B\32\2\302\222i>\230\10\3635[\205\7\351N\304T\343r\353}\303\266\356\213w\300*\222rd\317 ^\304-\356\354.\336c\252+\372\357\311\252\245\344\216", ) , ) == 0x0
 00344   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00345   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00346   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 48, ) }, ... 48, ) == 0x0
 00347   808   NtQueryValueKey  (48,  (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00348   808   NtClose  (48, ... ) == 0x0
 00349   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 48, ) }, ... 48, ) == 0x0
 00350   808   NtQueryValueKey  (48,  (48, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00351   808   NtClose  (48, ... ) == 0x0
 00352   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00353   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00354   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00355   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00356   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 48, ) }, ... 48, ) == 0x0
 00357   808   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00358   808   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00359   808   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00360   808   NtClose  (48, ... ) == 0x0
 00361   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 48, ) }, ... 48, ) == 0x0
 00362   808   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00363   808   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00364   808   NtClose  (48, ... ) == 0x0
 00365   808   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 48, ) }, ... 48, ) == 0x0
 00366   808   NtOpenEvent  (0x1f0003, {24, 48, 0x0, 0, 0,  (0x1f0003, {24, 48, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00367   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oleaut32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00368   808   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 00369   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00370   808   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00371   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00372   808   NtUserCallOneParam  (0, 41, ... ) == 0x4
 00373   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00374   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 52, ) == 0x0
 00375   808   NtQueryInformationToken  (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00376   808   NtClose  (52, ... ) == 0x0
 00377   808   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 52, ) }, ... 52, ) == 0x0
 00378   808   NtSetInformationObject  (52, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00379   808   NtOpenKey  (0xf0019, {24, 52, 0x40, 0, 0,  (0xf0019, {24, 52, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00380   808   NtOpenKey  (0xf0019, {24, 28, 0x40, 0, 0,  (0xf0019, {24, 28, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00381   808   NtOpenKey  (0xf0019, {24, 52, 0x40, 0, 0,  (0xf0019, {24, 52, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   808   NtOpenProcessToken  (-1, 0x8, ... 56, ) == 0x0
 00383   808   NtQueryInformationToken  (56, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00384   808   NtClose  (56, ... ) == 0x0
 00385   808   NtAllocateVirtualMemory  (-1, 0, 0, 1310704, 4096, 4, ... 13434880, 1310720, ) == 0x0
 00386   808   NtUserCallNoParam  (29, ...
 00387   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242280, ... ) }, 1242280, ... ) == 0x0
 00388   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00389   808   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 56, ... 60, ) == 0x0
 00390   808   NtClose  (56, ... ) == 0x0
 00391   808   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xe10000), 0x0, 221184, ) == 0x0
 00392   808   NtClose  (60, ... ) == 0x0
 00393   808   NtUnmapViewOfSection  (-1, 0xe10000, ... ) == 0x0
 00394   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242588, ... ) }, 1242588, ... ) == 0x0
 00395   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 60, {status=0x0, info=1}, ) }, 5, 96, ... 60, {status=0x0, info=1}, ) == 0x0
 00396   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 60, ... 56, ) == 0x0
 00397   808   NtQuerySection  (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00398   808   NtClose  (60, ... ) == 0x0
 00399   808   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 229376, ) == 0x0
 00400   808   NtClose  (56, ... ) == 0x0
 00401   808   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00402   808   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00403   808   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00404   808   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00405   808   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00406   808   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00407   808   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00408   808   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00409   808   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00410   808   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00411   808   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00412   808   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00413   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uxtheme.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00414   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00415   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00416   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00417   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 56, ) == 0x0
 00418   808   NtQueryInformationToken  (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00419   808   NtClose  (56, ... ) == 0x0
 00420   808   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 56, ) }, ... 56, ) == 0x0
 00421   808   NtOpenKey  (0x1, {24, 56, 0x40, 0, 0,  (0x1, {24, 56, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 60, ) }, ... 60, ) == 0x0
 00422   808   NtQueryValueKey  (60,  (60, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00423   808   NtClose  (60, ... ) == 0x0
 00424   808   NtClose  (56, ... ) == 0x0
 00425   808   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 00426   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00427   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 56, ) == 0x0
 00428   808   NtQueryInformationToken  (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00429   808   NtClose  (56, ... ) == 0x0
 00430   808   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 56, ) }, ... 56, ) == 0x0
 00431   808   NtOpenKey  (0x1, {24, 56, 0x40, 0, 0,  (0x1, {24, 56, 0x40, 0, 0, "Control Panel\Desktop"}, ... 60, ) }, ... 60, ) == 0x0
 00432   808   NtQueryValueKey  (60,  (60, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00433   808   NtClose  (60, ... ) == 0x0
 00434   808   NtClose  (56, ... ) == 0x0
 00435   808   NtUserGetProcessWindowStation  (... ) == 0x20
 00436   808   NtUserGetObjectInformation  (32, 2, 1244376, 64, 1244372, ... ) == 0x1
 00437   808   NtUserGetGUIThreadInfo  (808, 1244396, ... ) == 0x1
 00438   808   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1244240, 64, ... 56, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1244240, 64, ... 56, 0x0, 0x0, 0x0, 64, ) == 0x0
 00439   808   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 808, 75647, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 868, 808, 75647, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 808, 75647, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00440   808   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 808, 75648, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 868, 808, 75648, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 808, 75648, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00441   808   NtUserCallNoParam  (29, ...
 00442   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241636, ... ) }, 1241636, ... ) == 0x0
 00441   808   NtUserCallNoParam  ... ) == 0x0
 00443   808   NtUserSystemParametersInfo  (41, 0, 1524240760, 0, ... ) == 0x1
 00444   808   NtGdiHfontCreate  (1243764, 356, 0, 0, 1394480, ... ) == 0x4f0a0635
 00445   808   NtGdiHfontCreate  (1243764, 356, 0, 0, 1394472, ... ) == 0x6b0a04bc
 00446   808   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 808, 75649, 0} "\0\0\0\0\0\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 868, 808, 75649, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 808, 75649, 0} "\0\0\0\0\0\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00447   808   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xe10000), {0, 0}, 327680, ) == 0x0
 00448   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00449   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00450   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00451   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00452   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00453   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00454   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00455   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00456   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00457   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00458   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00459   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00460   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00461   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00462   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00463   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00464   808   NtAllocateVirtualMemory  (-1, 13324288, 0, 4096, 4096, 4, ... 13324288, 4096, ) == 0x0
 00465   808   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00466   808   NtGdiCreatePatternBrushInternal  (59048383, 0, 0, ... ) == 0x9c1004ac
 00467   808   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00468   808   NtUserCallNoParam  (29, ...
 00469   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241076, ... ) }, 1241076, ... ) == 0x0
 00468   808   NtUserCallNoParam  ... ) == 0x0
 00470   808   NtUserCallNoParam  (29, ...
 00471   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241072, ... ) }, 1241072, ... ) == 0x0
 00470   808   NtUserCallNoParam  ... ) == 0x0
 00386   808   NtUserCallNoParam  ... ) == 0x1
 00472   808   NtCreateEvent  (0x1f0003, {24, 48, 0x80, 0, 0, ""}, 0, 0, ... 64, ) == 0x0
 00473   808   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 68, ) == 0x0
 00474   808   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 72, ) == 0x0
 00475   808   NtQueryPerformanceCounter  (... {1136378873, 16}, {3579545, 0}, ) == 0x0
 00476   808   NtQueryPerformanceCounter  (... {1136379328, 16}, {3579545, 0}, ) == 0x0
 00477   808   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244736,  (0x80100080, {24, 0, 0x40, 0, 1244736, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) == 0x0
 00478   808   NtSetInformationFile  (76, 1244856, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00479   808   NtQueryInformationFile  (76, 1244848, 8, Position, ... {status=0x0, info=8}, ) == 0x0
 00480   808   NtSetInformationFile  (76, 1244848, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00481   808   NtQueryInformationFile  (76, 1244816, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00482   808   NtSetInformationFile  (76, 1244848, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00483   808   NtSetInformationFile  (76, 1244848, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00484   808   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 1052672, 4, ... 2146107392, 1048576, ) == 0x0
 00485   808   NtReadFile  (76, 0, 0, 0, 984576, 0x0, 0, ... {status=0x0, info=984576},  (76, 0, 0, 0, 984576, 0x0, 0, ... {status=0x0, info=984576}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\27\206 \244S\347N\367S\347N\367S\347N\367S\347O\367\332\346N\367\220\350\23\367P\347N\367\220\350\22\367R\347N\367\220\350\20\367R\347N\367\220\350A\367V\347N\367\220\350\21\367\216\347N\367\220\350.\367W\347N\367\220\350\24\367R\347N\367RichS\347N\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\325\233#F\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\12\0"\10\0\0\0\7\0\0\0\0\0\256\265\0\0\0\20\0\0\0\360\7\0\0\0\200|\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0P\17\0\0\4\0\0\223\222\17\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\34&\0\0{l\0\0\314\7\10\0(\0\0\0\0\220\10\0\350^\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\16\0\354[\0\0\2600\10\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\343\4\0@\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\21!\10\0\0\20\0\0\0"\10\0", ) \10\0\0\0\7\0\0\0\0\0\256\265\0\0\0\20\0\0\0\360\7\0\0\0\200|\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0P\17\0\0\4\0\0\223\222\17\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\34&\0\0{l\0\0\314\7\10\0(\0\0\0\0\220\10\0\350^\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\16\0\354[\0\0\2600\10\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\343\4\0@\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\21!\10\0\0\20\0\0\0 (76, 0, 0, 0, 984576, 0x0, 0, ... {status=0x0, info=984576}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\27\206 \244S\347N\367S\347N\367S\347N\367S\347O\367\332\346N\367\220\350\23\367P\347N\367\220\350\22\367R\347N\367\220\350\20\367R\347N\367\220\350A\367V\347N\367\220\350\21\367\216\347N\367\220\350.\367W\347N\367\220\350\24\367R\347N\367RichS\347N\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\325\233#F\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\12\0"\10\0\0\0\7\0\0\0\0\0\256\265\0\0\0\20\0\0\0\360\7\0\0\0\200|\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0P\17\0\0\4\0\0\223\222\17\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\34&\0\0{l\0\0\314\7\10\0(\0\0\0\0\220\10\0\350^\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\16\0\354[\0\0\2600\10\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\343\4\0@\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\21!\10\0\0\20\0\0\0"\10\0", ) , ) == 0x0
 00486   808   NtClose  (76, ... ) == 0x0
 00487   808   NtAllocateVirtualMemory  (-1, 0, 0, 589824, 1052672, 4, ... 2145517568, 589824, ) == 0x0
 00488   808   NtAllocateVirtualMemory  (-1, 0, 0, 524288, 1052672, 4, ... 2144993280, 524288, ) == 0x0
 00489   808   NtAllocateVirtualMemory  (-1, 0, 0, 1003520, 4096, 64, ... 15073280, 1003520, ) == 0x0
 00490   808   NtFreeVirtualMemory  (-1, (0x7fe20000), 0, 32768, ... (0x7fe20000), 589824, ) == 0x0
 00491   808   NtFreeVirtualMemory  (-1, (0x7fda0000), 0, 32768, ... (0x7fda0000), 524288, ) == 0x0
 00492   808   NtFreeVirtualMemory  (-1, (0x7feb0000), 0, 32768, ... (0x7feb0000), 1048576, ) == 0x0
 00493   808   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 16121856, 1048576, ) == 0x0
 00494   808   NtAllocateVirtualMemory  (-1, 17162240, 0, 8192, 4096, 4, ... 17162240, 8192, ) == 0x0
 00495   808   NtProtectVirtualMemory  (-1, (0x105e000), 4096, 260, ... (0x105e000), 4096, 4, ) == 0x0
 00496   808   NtCreateThread  (0x1f03ff, 0x0, -1, 1244016, 1243960, 1, ... 76, {868, 1708}, ) == 0x0
 00497   808   NtQueryInformationThread  (76, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=868,Tid=1708,}, 0x0, ) == 0x0
 00498   808   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244772, 1244776, 32768, 14687264}  (24, {28, 56, new_msg, 0, 1244772, 1244776, 32768, 14687264} "\0\0\0\0\1\0\1\0\371\232\200|\377\377\377\377L\0\0\0d\3\0\0\254\6\0\0" ... {28, 56, reply, 0, 868, 808, 75655, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\377\377\377\377L\0\0\0d\3\0\0\254\6\0\0" )  ... {28, 56, reply, 0, 868, 808, 75655, 0}  (24, {28, 56, new_msg, 0, 1244772, 1244776, 32768, 14687264} "\0\0\0\0\1\0\1\0\371\232\200|\377\377\377\377L\0\0\0d\3\0\0\254\6\0\0" ... {28, 56, reply, 0, 868, 808, 75655, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\377\377\377\377L\0\0\0d\3\0\0\254\6\0\0" )  ) == 0x0
 00499   808   NtResumeThread  (76, ... 1, ) == 0x0
 00500   808   NtDelayExecution  (0, {-10000, -1}, ...
 00501  1708   NtTestAlert  (... ) == 0x0
 00502  1708   NtContinue  (17169712, 1, ...
 00503  1708   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00504  1708   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00505  1708   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00506  1708   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 13314048}  (24, {28, 56, new_msg, 0, 0, 0, 0, 13314048} "\210\6&\1\0\0\0\0x\1\313\0\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" ... {28, 56, reply, 0, 868, 1708, 75656, 0} "\330<\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" )  ... {28, 56, reply, 0, 868, 1708, 75656, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 13314048} "\210\6&\1\0\0\0\0x\1\313\0\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" ... {28, 56, reply, 0, 868, 1708, 75656, 0} "\330<\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" )  ) == 0x0
 00507  1708   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00508  1708   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 80, ) }, ... 80, ) == 0x0
 00509  1708   NtQueryValueKey  (80,  (80, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (80, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00510  1708   NtClose  (80, ... ) == 0x0
 00511  1708   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 80, ) }, ... 80, ) == 0x0
 00512  1708   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1060000), 0x0, 90112, ) == 0x0
 00513  1708   NtClose  (80, ... ) == 0x0
 00514  1708   NtQueryDefaultLocale  (0, 15614888, ... ) == 0x0
 00515  1708   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 80, ) }, ... 80, ) == 0x0
 00516  1708   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1080000), 0x0, 249856, ) == 0x0
 00517  1708   NtClose  (80, ... ) == 0x0
 00518  1708   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 80, ) }, ... 80, ) == 0x0
 00519  1708   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x10c0000), 0x0, 266240, ) == 0x0
 00520  1708   NtQuerySection  (80, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00521  1708   NtClose  (80, ... ) == 0x0
 00522  1708   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 80, ) }, ... 80, ) == 0x0
 00523  1708   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1110000), 0x0, 24576, ) == 0x0
 00524  1708   NtClose  (80, ... ) == 0x0
 00525  1708   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00526  1708   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00527  1708   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00528  1708   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6&\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" ... {24, 52, reply, 0, 868, 1708, 75657, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" )  ... {24, 52, reply, 0, 868, 1708, 75657, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6&\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" ... {24, 52, reply, 0, 868, 1708, 75657, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" )  ) == 0x0
 00529  1708   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 15615648, 1396088, 0, 0}  (24, {28, 56, new_msg, 0, 15615648, 1396088, 0, 0} "\210\6&\1\0\0\0\0\0\0\0\0\5\0\0\0\2\0\0\0\234\6&\18\6\0\0" ... {28, 56, reply, 0, 868, 1708, 75658, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\5\0\0\0\2\0\0\0\234\6&\18\6\0\0" )  ... {28, 56, reply, 0, 868, 1708, 75658, 0}  (24, {28, 56, new_msg, 0, 15615648, 1396088, 0, 0} "\210\6&\1\0\0\0\0\0\0\0\0\5\0\0\0\2\0\0\0\234\6&\18\6\0\0" ... {28, 56, reply, 0, 868, 1708, 75658, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\5\0\0\0\2\0\0\0\234\6&\18\6\0\0" )  ) == 0x0
 00530  1708   NtQueryInformationThread  (-2, AmILastThread, 4, ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00531  1708   NtTerminateThread  (0, 0, ...
 00532  1708   NtFreeVirtualMemory  (-1, (0xf60000), 0, 32768, ... (0xf60000), 1048576, ) == 0x0
 00500   808   NtDelayExecution  ... ) == 0x0
 00533   808   NtQueryInformationThread  (76, Basic, 28, ... {ExitStatus=0x0,TebBaseAddress=0x0,Pid=868,Tid=1708,}, 0x0, ) == 0x0
 00534   808   NtAllocateVirtualMemory  (-1, 1400832, 0, 12288, 4096, 4, ... 1400832, 12288, ) == 0x0
 00535   808   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00536   808   NtAllocateVirtualMemory  (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0
 00537   808   NtAllocateVirtualMemory  (-1, 1216512, 0, 4096, 4096, 260, ... 1216512, 4096, ) == 0x0
 00538   808   NtAllocateVirtualMemory  (-1, 1212416, 0, 4096, 4096, 260, ... 1212416, 4096, ) == 0x0
 00539   808   NtAllocateVirtualMemory  (-1, 1208320, 0, 4096, 4096, 260, ... 1208320, 4096, ) == 0x0
 00540   808   NtAllocateVirtualMemory  (-1, 1204224, 0, 4096, 4096, 260, ... 1204224, 4096, ) == 0x0
 00541   808   NtAllocateVirtualMemory  (-1, 1200128, 0, 4096, 4096, 260, ... 1200128, 4096, ) == 0x0
 00542   808   NtAllocateVirtualMemory  (-1, 1196032, 0, 4096, 4096, 260, ... 1196032, 4096, ) == 0x0
 00543   808   NtAllocateVirtualMemory  (-1, 1191936, 0, 4096, 4096, 260, ... 1191936, 4096, ) == 0x0
 00544   808   NtAllocateVirtualMemory  (-1, 1187840, 0, 4096, 4096, 260, ... 1187840, 4096, ) == 0x0
 00545   808   NtAllocateVirtualMemory  (-1, 1183744, 0, 4096, 4096, 260, ... 1183744, 4096, ) == 0x0
 00546   808   NtAllocateVirtualMemory  (-1, 1179648, 0, 4096, 4096, 260, ... 1179648, 4096, ) == 0x0
 00547   808   NtAllocateVirtualMemory  (-1, 1175552, 0, 4096, 4096, 260, ... 1175552, 4096, ) == 0x0
 00548   808   NtAllocateVirtualMemory  (-1, 1171456, 0, 4096, 4096, 260, ... 1171456, 4096, ) == 0x0
 00549   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 80, {status=0x0, info=1}, ) }, 3, 16417, ... 80, {status=0x0, info=1}, ) == 0x0
 00550   808   NtQueryInformationFile  (80, 1243908, 528, Name, ... {status=0x0, info=6}, ) == 0x0
 00551   808   NtQueryVolumeInformationFile  (80, 1399280, 284, Volume, ... {status=0x0, info=18}, ) == 0x0
 00552   808   NtClose  (80, ... ) == 0x0
 00553   808   NtOpenProcess  (0x1f0fff, {24, 0, 0x0, 0, 0, 0x0}, {868, 0}, ... 80, ) == 0x0
 00554   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00555   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242940, ... ) }, 1242940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00556   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242940, ... ) }, 1242940, ... ) == 0x0
 00557   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 84, {status=0x0, info=1}, ) }, 5, 96, ... 84, {status=0x0, info=1}, ) == 0x0
 00558   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 84, ... 88, ) == 0x0
 00559   808   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00560   808   NtClose  (84, ... ) == 0x0
 00561   808   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00562   808   NtClose  (88, ... ) == 0x0
 00563   808   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00564   808   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00565   808   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00566   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00567   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242124, ... ) }, 1242124, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00568   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242124, ... ) }, 1242124, ... ) == 0x0
 00569   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00570   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 88, ... 84, ) == 0x0
 00571   808   NtQuerySection  (84, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00572   808   NtClose  (88, ... ) == 0x0
 00573   808   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00574   808   NtClose  (84, ... ) == 0x0
 00575   808   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00576   808   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00577   808   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00578   808   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00579   808   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00580   808   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00581   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00582   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00583   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00584   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00585   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00586   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16121856, 65536, ) == 0x0
 00587   808   NtAllocateVirtualMemory  (-1, 16121856, 0, 4096, 4096, 4, ... 16121856, 4096, ) == 0x0
 00588   808   NtAllocateVirtualMemory  (-1, 16125952, 0, 4096, 4096, 4, ... 16125952, 4096, ) == 0x0
 00589   808   NtAllocateVirtualMemory  (-1, 16130048, 0, 4096, 4096, 4, ... 16130048, 4096, ) == 0x0
 00590   808   NtQueryVirtualMemory  (-1, 0x42573c, Basic, 28, ... {BaseAddress=0x425000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00591   808   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00592   808   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00593   808   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00594   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00595   808   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 00596   808   NtClose  (84, ... ) == 0x0
 00597   808   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00598   808   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00599   808   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00600   808   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00601   808   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00602   808   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00603   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00604   808   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00605   808   NtClose  (84, ... ) == 0x0
 00606   808   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00607   808   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00608   808   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00609   808   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00610   808   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00611   808   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00612   808   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00613   808   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00614   808   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00615   808   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00616   808   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00617   808   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00618   808   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00619   808   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00620   808   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00621   808   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00622   808   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00623   808   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00624   808   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00625   808   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00626   808   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00627   808   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00628   808   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00629   808   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00630   808   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00631   808   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00632   808   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00633   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00634   808   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0xf70000), 0x0, 36864, ) == STATUS_IMAGE_NOT_AT_BASE
 00635   808   NtProtectVirtualMemory  (-1, (0xf71000), 18944, 4, ... (0xf71000), 20480, 32, ) == 0x0
 00636   808   NtProtectVirtualMemory  (-1, (0xf77000), 1024, 4, ... (0xf77000), 4096, 2, ) == 0x0
 00637   808   NtProtectVirtualMemory  (-1, (0xf78000), 1536, 4, ... (0xf78000), 4096, 2, ) == 0x0
 00638   808   NtMapViewOfSection  (84, -1, (0xf70000), 0, 0, 0x0, 36864, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00639   808   NtProtectVirtualMemory  (-1, (0xf71000), 18944, 16, ... (0xf71000), 20480, 4, ) == 0x0
 00640   808   NtProtectVirtualMemory  (-1, (0xf77000), 1024, 2, ... (0xf77000), 4096, 8, ) == 0x0
 00641   808   NtProtectVirtualMemory  (-1, (0xf78000), 1536, 2, ... (0xf78000), 4096, 8, ) == 0x0
 00642   808   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00643   808   NtClose  (84, ... ) == 0x0
 00644   808   NtProtectVirtualMemory  (-1, (0xf71000), 160, 4, ... (0xf71000), 4096, 16, ) == 0x0
 00645   808   NtProtectVirtualMemory  (-1, (0xf71000), 4096, 16, ... (0xf71000), 4096, 4, ) == 0x0
 00646   808   NtFlushInstructionCache  (-1, 16191488, 160, ... ) == 0x0
 00647   808   NtProtectVirtualMemory  (-1, (0xf71000), 160, 4, ... (0xf71000), 4096, 16, ) == 0x0
 00648   808   NtProtectVirtualMemory  (-1, (0xf71000), 4096, 16, ... (0xf71000), 4096, 4, ) == 0x0
 00649   808   NtFlushInstructionCache  (-1, 16191488, 160, ... ) == 0x0
 00650   808   NtProtectVirtualMemory  (-1, (0xf71000), 160, 4, ... (0xf71000), 4096, 16, ) == 0x0
 00651   808   NtProtectVirtualMemory  (-1, (0xf71000), 4096, 16, ... (0xf71000), 4096, 4, ) == 0x0
 00652   808   NtFlushInstructionCache  (-1, 16191488, 160, ... ) == 0x0
 00653   808   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00654   808   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00655   808   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00656   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00657   808   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 00658   808   NtClose  (84, ... ) == 0x0
 00659   808   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00660   808   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00661   808   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00662   808   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00663   808   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00664   808   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00665   808   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00666   808   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00667   808   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00668   808   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00669   808   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00670   808   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00671   808   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00672   808   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00673   808   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00674   808   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00675   808   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00676   808   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00677   808   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00678   808   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00679   808   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00680   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00681   808   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00682   808   NtCreateSemaphore  (0x1f0003, {24, 48, 0x80, 1399888, 0,  (0x1f0003, {24, 48, 0x80, 1399888, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 84, ) }, 0, 2147483647, ... 84, ) == STATUS_OBJECT_NAME_EXISTS
 00683   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00684   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00685   808   NtQueryPerformanceCounter  (... {1136798728, 16}, {3579545, 0}, ) == 0x0
 00686   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininet.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00687   808   NtQueryPerformanceCounter  (... {1136799205, 16}, {3579545, 0}, ) == 0x0
 00688   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00689   808   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17956864, 1048576, ) == 0x0
 00690   808   NtAllocateVirtualMemory  (-1, 17956864, 0, 4096, 4096, 4, ... 17956864, 4096, ) == 0x0
 00691   808   NtAllocateVirtualMemory  (-1, 17960960, 0, 8192, 4096, 4, ... 17960960, 8192, ) == 0x0
 00692   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 88, ) == 0x0
 00693   808   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239844,  (0xc0100080, {24, 0, 0x40, 0, 1239844, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 92, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 92, {status=0x0, info=0}, ) == 0x0
 00694   808   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 96, ) == 0x0
 00695   808   NtDeviceIoControlFile  (92, 96, 0x0, 0x12eb84, 0x22414c,  (92, 96, 0x0, 0x12eb84, 0x22414c, "\314\353\22\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00696   808   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 00697   808   NtQueryValueKey  (-2147482576,  (-2147482576, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00698   808   NtQueryValueKey  (-2147482576,  (-2147482576, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00699   808   NtClose  (-2147482576, ... ) == 0x0
 00700   808   NtClose  (1072, ... ) == 0x0
 00695   808   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, "\230U\204\341\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#Seed\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00701   808   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240060,  (0xc0100080, {24, 0, 0x40, 0, 1240060, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 104, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 104, {status=0x0, info=0}, ) == 0x0
 00702   808   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 108, ) == 0x0
 00703   808   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 112, ) == 0x0
 00704   808   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 116, ) == 0x0
 00705   808   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 120, ) == 0x0
 00706   808   NtAllocateVirtualMemory  (-1, 17969152, 0, 8192, 4096, 4, ... 17969152, 8192, ) == 0x0
 00707   808   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19005440, 1048576, ) == 0x0
 00708   808   NtAllocateVirtualMemory  (-1, 20045824, 0, 8192, 4096, 4, ... 20045824, 8192, ) == 0x0
 00709   808   NtProtectVirtualMemory  (-1, (0x131e000), 4096, 260, ... (0x131e000), 4096, 4, ) == 0x0
 00710   808   NtCreateThread  (0x1f03ff, 0x0, -1, 1239144, 1239088, 1, ... 124, {868, 1676}, ) == 0x0
 00711   808   NtQueryInformationThread  (124, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=868,Tid=1676,}, 0x0, ) == 0x0
 00712   808   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 17957240}  (24, {28, 56, new_msg, 0, 0, 0, 0, 17957240} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0|\0\0\0d\3\0\0\214\6\0\0" ... {28, 56, reply, 0, 868, 808, 75661, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0|\0\0\0d\3\0\0\214\6\0\0" )  ... {28, 56, reply, 0, 868, 808, 75661, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 17957240} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0|\0\0\0d\3\0\0\214\6\0\0" ... {28, 56, reply, 0, 868, 808, 75661, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0|\0\0\0d\3\0\0\214\6\0\0" )  ) == 0x0
 00713   808   NtResumeThread  (124, ... 1, ) == 0x0
 00714   808   NtClose  (124, ...
 00715  1676   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 128, ) == 0x0
 00716  1676   NtWaitForSingleObject  (128, 0, 0x0, ...
 00714   808   NtClose  ... ) == 0x0
 00717   808   NtSetEvent  (108, ... 0x0, ) == 0x0
 00718   808   NtSetEvent  (88, ... 0x0, ) == 0x0
 00719   808   NtClose  (88, ... ) == 0x0
 00720   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 88, ) == 0x0
 00721   808   NtAllocateVirtualMemory  (-1, 17977344, 0, 4096, 4096, 4, ... 17977344, 4096, ) == 0x0
 00722   808   NtDeviceIoControlFile  (92, 96, 0x0, 0x12eb84, 0x22414c,  (92, 96, 0x0, 0x12eb84, 0x22414c, "\314\353\22\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00723   808   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 00724   808   NtQueryValueKey  (-2147482576,  (-2147482576, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00725   808   NtQueryValueKey  (-2147482576,  (-2147482576, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00726   808   NtClose  (-2147482576, ... ) == 0x0
 00727   808   NtClose  (1072, ... ) == 0x0
 00722   808   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, "0\253\235\341\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344xk3\341tup\0\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0|\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00728   808   NtSetEvent  (108, ... 0x0, ) == 0x0
 00729   808   NtSetEvent  (88, ... 0x0, ) == 0x0
 00730   808   NtClose  (88, ... ) == 0x0
 00731   808   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 00732   808   NtOpenProcessToken  (-1, 0xa, ... 88, ) == 0x0
 00733   808   NtDuplicateToken  (88, 0xc, {24, 0, 0x0, 0, 1240328, 0x0}, 0, 2, ... 132, ) == 0x0
 00734   808   NtClose  (88, ... ) == 0x0
 00735   808   NtAccessCheck  (1405712, 132, 0x1, 1240404, 1240456, 56, 1240436, ... (0x1), ) == 0x0
 00736   808   NtClose  (132, ... ) == 0x0
 00737   808   NtQueryDefaultUILanguage  (1239208, ...
 00738   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00739   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482576, ) == 0x0
 00740   808   NtQueryInformationToken  (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00741   808   NtClose  (-2147482576, ... ) == 0x0
 00742   808   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 00743   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x240, 0, 0,  (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00744   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x640, 0, 0,  (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0
 00745   808   NtQueryValueKey  (-2147482648,  (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00746   808   NtClose  (-2147482648, ... ) == 0x0
 00747   808   NtClose  (-2147482576, ... ) == 0x0
 00737   808   NtQueryDefaultUILanguage  ... ) == 0x0
 00748   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00749   808   NtQueryDefaultUILanguage  (2090319928, ...
 00750   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00751   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482576, ) == 0x0
 00752   808   NtQueryInformationToken  (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00753   808   NtClose  (-2147482576, ... ) == 0x0
 00754   808   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 00755   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x240, 0, 0,  (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00756   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x640, 0, 0,  (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0
 00757   808   NtQueryValueKey  (-2147482648,  (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00758   808   NtClose  (-2147482648, ... ) == 0x0
 00759   808   NtClose  (-2147482576, ... ) == 0x0
 00749   808   NtQueryDefaultUILanguage  ... ) == 0x0
 00760   808   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00761   808   NtQueryDefaultLocale  (1, 1237304, ... ) == 0x0
 00762   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00763   808   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064}  (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064} "\210\6&\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6&\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6&\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 868, 808, 75662, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6&\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6&\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 868, 808, 75662, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064} "\210\6&\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6&\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6&\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 868, 808, 75662, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6&\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6&\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" )  ) == 0x0
 00764   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00765   808   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00766   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00767   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00768   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236532, ... ) }, 1236532, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00769   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00770   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00771   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00772   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1236596, ... ) }, 1236596, ... ) == 0x0
 00773   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 132, {status=0x0, info=1}, ) }, 3, 33, ... 132, {status=0x0, info=1}, ) == 0x0
 00774   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00775   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00776   808   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 88, ... 136, ) == 0x0
 00777   808   NtClose  (88, ... ) == 0x0
 00778   808   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1320000), 0x0, 1056768, ) == 0x0
 00779   808   NtClose  (136, ... ) == 0x0
 00780   808   NtUnmapViewOfSection  (-1, 0x1320000, ... ) == 0x0
 00781   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 136, {status=0x0, info=1}, ) }, 5, 96, ... 136, {status=0x0, info=1}, ) == 0x0
 00782   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 136, ... 88, ) == 0x0
 00783   808   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00784   808   NtClose  (136, ... ) == 0x0
 00785   808   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 00786   808   NtClose  (88, ... ) == 0x0
 00787   808   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00788   808   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00789   808   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00790   808   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00791   808   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00792   808   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00793   808   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00794   808   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00795   808   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00796   808   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00797   808   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00798   808   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00799   808   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00800   808   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00801   808   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00802   808   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00803   808   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00804   808   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00805   808   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00806   808   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00807   808   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00808   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00809   808   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1238076, ... ) , 42, 1238076, ... ) == 0x0
 00810   808   NtQueryDefaultUILanguage  (1236760, ...
 00811   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00812   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482576, ) == 0x0
 00813   808   NtQueryInformationToken  (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00814   808   NtClose  (-2147482576, ... ) == 0x0
 00815   808   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 00816   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x240, 0, 0,  (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00817   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x640, 0, 0,  (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0
 00818   808   NtQueryValueKey  (-2147482648,  (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00819   808   NtClose  (-2147482648, ... ) == 0x0
 00820   808   NtClose  (-2147482576, ... ) == 0x0
 00810   808   NtQueryDefaultUILanguage  ... ) == 0x0
 00821   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1235600, ... ) }, 1235600, ... ) == 0x0
 00822   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00823   808   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 88, ... 136, ) == 0x0
 00824   808   NtClose  (88, ... ) == 0x0
 00825   808   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xf90000), 0x0, 4096, ) == 0x0
 00826   808   NtClose  (136, ... ) == 0x0
 00827   808   NtUnmapViewOfSection  (-1, 0xf90000, ... ) == 0x0
 00828   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1235196, ... ) }, 1235196, ... ) == 0x0
 00829   808   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1235940,  (0x80100080, {24, 0, 0x40, 0, 1235940, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 136, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 136, {status=0x0, info=1}, ) == 0x0
 00830   808   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 136, ... 88, ) == 0x0
 00831   808   NtClose  (136, ... ) == 0x0
 00832   808   NtMapViewOfSection  (88, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xf90000), {0, 0}, 4096, ) == 0x0
 00833   808   NtClose  (88, ... ) == 0x0
 00834   808   NtUnmapViewOfSection  (-1, 0xf90000, ... ) == 0x0
 00835   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 88, {status=0x0, info=1}, ) }, 1, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00836   808   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 88, ... 136, ) == 0x0
 00837   808   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xf90000), 0x0, 4096, ) == 0x0
 00838   808   NtQueryInformationFile  (88, 1235592, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00839   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00840   808   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1235892, 1179817, 1235616}  (24, {128, 156, new_msg, 0, 2088850039, 1235892, 1179817, 1235616} "\210\6&\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6&\1X\0\0\0\210\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6&\1\0\0\0\0\0\0\0\0\250\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 868, 808, 75663, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6&\1X\0\0\0\210\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6&\1\0\0\0\0\0\0\0\0\250\337\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 868, 808, 75663, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1235892, 1179817, 1235616} "\210\6&\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6&\1X\0\0\0\210\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6&\1\0\0\0\0\0\0\0\0\250\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 868, 808, 75663, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6&\1X\0\0\0\210\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6&\1\0\0\0\0\0\0\0\0\250\337\22\0\0\0\0\0" )  ) == 0x0
 00841   808   NtClose  (88, ... ) == 0x0
 00842   808   NtClose  (136, ... ) == 0x0
 00843   808   NtUnmapViewOfSection  (-1, 0xf90000, ... ) == 0x0
 00844   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00845   808   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00846   808   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 00847   808   NtUserGetDC  (0, ... ) == 0x1010054
 00848   808   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 00849   808   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 00850   808   NtUserSystemParametersInfo  (66, 12, 1237592, 0, ... ) == 0x1
 00851   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00852   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 136, ) == 0x0
 00853   808   NtQueryInformationToken  (136, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00854   808   NtClose  (136, ... ) == 0x0
 00855   808   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 136, ) }, ... 136, ) == 0x0
 00856   808   NtOpenProcessToken  (-1, 0x8, ... 88, ) == 0x0
 00857   808   NtAccessCheck  (1405712, 88, 0x1, 1237424, 1237476, 56, 1237456, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00858   808   NtClose  (88, ... ) == 0x0
 00859   808   NtOpenKey  (0x20019, {24, 136, 0x40, 0, 0,  (0x20019, {24, 136, 0x40, 0, 0, "Control Panel\Desktop"}, ... 88, ) }, ... 88, ) == 0x0
 00860   808   NtQueryValueKey  (88,  (88, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00861   808   NtClose  (88, ... ) == 0x0
 00862   808   NtUserSystemParametersInfo  (41, 500, 1237620, 0, ... ) == 0x1
 00863   808   NtOpenProcessToken  (-1, 0x8, ... 88, ) == 0x0
 00864   808   NtAccessCheck  (1405712, 88, 0x1, 1237424, 1237476, 56, 1237456, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00865   808   NtClose  (88, ... ) == 0x0
 00866   808   NtOpenKey  (0x20019, {24, 136, 0x40, 0, 0,  (0x20019, {24, 136, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 88, ) }, ... 88, ) == 0x0
 00867   808   NtQueryValueKey  (88,  (88, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00868   808   NtClose  (88, ... ) == 0x0
 00869   808   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 00870   808   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 00871   808   NtClose  (136, ... ) == 0x0
 00872   808   NtUserSystemParametersInfo  (4130, 0, 1238124, 0, ... ) == 0x1
 00873   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 136, ) }, ... 136, ) == 0x0
 00874   808   NtEnumerateValueKey  (136, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00875   808   NtClose  (136, ... ) == 0x0
 00876   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00877   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc03b
 00878   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc03d
 00879   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00880   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc03f
 00881   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00882   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc041
 00883   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00884   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc043
 00885   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc045
 00886   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00887   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc047
 00888   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00889   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc049
 00890   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00891   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc04b
 00892   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00893   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc04d
 00894   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00895   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc04f
 00896   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc051
 00897   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00898   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc053
 00899   808   NtUserFindExistingCursorIcon  (1237368, 1237384, 1237432, ... ) == 0x10011
 00900   808   NtUserRegisterClassExWOW  (1237312, 1237380, 1237396, 1237412, 0, 384, 0, ... ) == 0x819fc055
 00901   808   NtUserFindExistingCursorIcon  (1237368, 1237384, 1237432, ... ) == 0x10011
 00902   808   NtUserRegisterClassExWOW  (1237312, 1237380, 1237396, 1237412, 0, 384, 0, ... ) == 0x819fc057
 00903   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00904   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc059
 00905   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10013
 00906   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc05b
 00907   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00908   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc05d
 00909   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00910   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc05f
 00911   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00912   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc017
 00913   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00914   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc019
 00915   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10013
 00916   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc018
 00917   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00918   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc01a
 00919   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00920   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc01c
 00921   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00922   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc01e
 00923   808   NtUserFindExistingCursorIcon  (1237364, 1237380, 1237428, ... ) == 0x10011
 00924   808   NtUserRegisterClassExWOW  (1237364, 1237432, 1237448, 1237464, 0, 384, 0, ... ) == 0x819fc01b
 00925   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00926   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc068
 00927   808   NtUserFindExistingCursorIcon  (1237372, 1237388, 1237436, ... ) == 0x10011
 00928   808   NtUserRegisterClassExWOW  (1237316, 1237384, 1237400, 1237416, 0, 384, 0, ... ) == 0x819fc06a
 00929   808   NtCreateKey  (0x2001f, {24, 52, 0x40, 0, 0,  (0x2001f, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 136, 2, ) }, 0, 0x0, 0, ... 136, 2, ) == 0x0
 00930   808   NtSetEventBoostPriority  (128, ...
 00716  1676   NtWaitForSingleObject  ... ) == 0x0
 00931  1676   NtTestAlert  (... ) == 0x0
 00932  1676   NtContinue  (20053296, 1, ...
 00933  1676   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00934  1676   NtDeviceIoControlFile  (104, 116, 0x0, 0x77e466a0, 0x228144,  (104, 116, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0p\0\0\0\0\0\0\0|\0\0\0\0\0\0\0d\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00930   808   NtSetEventBoostPriority  ... ) == 0x0
 00935   808   NtQueryValueKey  (136,  (136, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00936   808   NtQueryValueKey  (136,  (136, "SecureProtocols", Partial, 144, ... TitleIdx=0, Type=4, Data="\240\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "SecureProtocols", Partial, 144, ... TitleIdx=0, Type=4, Data="\240\0\0\0"}, 16, ) }, 16, ) == 0x0
 00937   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies"}, ... 88, ) }, ... 88, ) == 0x0
 00938   808   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Policies"}, ... 140, ) }, ... 140, ) == 0x0
 00939  1676   NtWaitForMultipleObjects  (2, (108, 116, ), 1, 1, {1294967296, -1}, ... ) == 0x0
 00940  1676   NtDeviceIoControlFile  (104, 120, 0x0, 0x77e46680, 0x228144,  (104, 120, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0p\0\0\0\0\0\0\0|\0\0\0\0\0\0\0d\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00941  1676   NtWaitForMultipleObjects  (2, (108, 120, ), 1, 1, {1294967296, -1}, ...
 00942   808   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software"}, ... 144, ) }, ... 144, ) == 0x0
 00943   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software"}, ... 148, ) }, ... 148, ) == 0x0
 00944   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00945   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00946   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00947   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 152, ) }, ... 152, ) == 0x0
 00948   808   NtQueryValueKey  (152,  (152, "CertificateRevocation", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "CertificateRevocation", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00949   808   NtClose  (152, ... ) == 0x0
 00950   808   NtQueryValueKey  (136,  (136, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00951   808   NtQueryValueKey  (136,  (136, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00952   808   NtQueryValueKey  (136,  (136, "IdnEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00953   808   NtQueryValueKey  (136,  (136, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00954   808   NtQueryValueKey  (136,  (136, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00955   808   NtQueryValueKey  (136,  (136, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00956   808   NtQueryValueKey  (136,  (136, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00957   808   NtQueryValueKey  (136,  (136, "DisableBasicOverClearChannel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00958   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00959   808   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00960   808   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00961   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 152, ) }, ... 152, ) == 0x0
 00962   808   NtQueryValueKey  (152,  (152, "Feature_ClientAuthCertFilter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00963   808   NtClose  (152, ... ) == 0x0
 00964   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00965   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1239848, ... ) }, 1239848, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00966   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 1239848, ... ) }, 1239848, ... ) == 0x0
 00967   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 00968   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 152, ... 156, ) == 0x0
 00969   808   NtQuerySection  (156, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00970   808   NtClose  (152, ... ) == 0x0
 00971   808   NtMapViewOfSection  (156, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77fe0000), 0x0, 69632, ) == 0x0
 00972   808   NtClose  (156, ... ) == 0x0
 00973   808   NtProtectVirtualMemory  (-1, (0x77fe1000), 388, 4, ... (0x77fe1000), 4096, 32, ) == 0x0
 00974   808   NtProtectVirtualMemory  (-1, (0x77fe1000), 4096, 32, ... (0x77fe1000), 4096, 4, ) == 0x0
 00975   808   NtFlushInstructionCache  (-1, 2013138944, 388, ... ) == 0x0
 00976   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00977   808   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 156, ) == 0x0
 00978   808   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 152, ) == 0x0
 00979   808   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 160, ) }, ... 160, ) == 0x0
 00980   808   NtQueryEvent  (160, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 00981   808   NtClose  (160, ... ) == 0x0
 00982   808   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1241420, 140, ... 160, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241420, 140, ... 160, 0x0, 0x0, 256, 140, ) == 0x0
 00983   808   NtRequestWaitReplyPort  (160, {28, 52, new_msg, 0, 0, 0, 0, 0}  (160, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\10\2\210\6\24\0" ... {188, 212, reply, 0, 868, 808, 75665, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ... {188, 212, reply, 0, 868, 808, 75665, 0}  (160, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\10\2\210\6\24\0" ... {188, 212, reply, 0, 868, 808, 75665, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ) == 0x0
 00984   808   NtQueryValueKey  (136,  (136, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00985   808   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 164, ) }, ... 164, ) == 0x0
 00986   808   NtQueryValueKey  (164,  (164, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00987   808   NtClose  (164, ... ) == 0x0
 00988   808   NtOpenKey  (0xf, {24, 28, 0x40, 0, 0,  (0xf, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 164, ) }, ... 164, ) == 0x0
 00989   808   NtOpenKey  (0xf, {24, 52, 0x40, 0, 0,  (0xf, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 168, ) }, ... 168, ) == 0x0
 00990   808   NtOpenKey  (0x9, {24, 52, 0x40, 0, 0,  (0x9, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 172, ) }, ... 172, ) == 0x0
 00991   808   NtQueryValueKey  (172,  (172, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 00992   808   NtQueryValueKey  (172,  (172, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 00993   808   NtClose  (172, ... ) == 0x0
 00994   808   NtOpenKey  (0xf, {24, 168, 0x40, 0, 0,  (0xf, {24, 168, 0x40, 0, 0, "Content"}, ... 172, ) }, ... 172, ) == 0x0
 00995   808   NtQueryValueKey  (172,  (172, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00996   808   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "Content"}, ... 176, ) }, ... 176, ) == 0x0
 00997   808   NtQueryValueKey  (176,  (176, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00998   808   NtClose  (176, ... ) == 0x0
 00999   808   NtClose  (172, ... ) == 0x0
 01000   808   NtOpenKey  (0xf, {24, 168, 0x40, 0, 0,  (0xf, {24, 168, 0x40, 0, 0, "Content"}, ... 172, ) }, ... 172, ) == 0x0
 01001   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHELL32.dll"}, ... 176, ) }, ... 176, ) == 0x0
 01002   808   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c9c0000), 0x0, 8482816, ) == 0x0
 01003   808   NtClose  (176, ... ) == 0x0
 01004   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01005   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01006   808   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01007   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01008   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01009   808   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01010   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01011   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01012   808   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01013   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01014   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01015   808   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01016   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01017   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01018   808   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01019   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01020   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01021   808   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01022   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01023   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01024   808   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01025   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01026   808   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01027   808   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01028   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01029   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 176, ) }, ... 176, ) == 0x0
 01030   808   NtQueryValueKey  (176,  (176, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01031   808   NtClose  (176, ... ) == 0x0
 01032   808   NtQueryDefaultUILanguage  (1236444, ...
 01033   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01034   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482576, ) == 0x0
 01035   808   NtQueryInformationToken  (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01036   808   NtClose  (-2147482576, ... ) == 0x0
 01037   808   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 01038   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x240, 0, 0,  (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01039   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x640, 0, 0,  (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0
 01040   808   NtQueryValueKey  (-2147482648,  (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01041   808   NtClose  (-2147482648, ... ) == 0x0
 01042   808   NtClose  (-2147482576, ... ) == 0x0
 01032   808   NtQueryDefaultUILanguage  ... ) == 0x0
 01043   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll"}, 1, 96, ... 176, {status=0x0, info=1}, ) }, 1, 96, ... 176, {status=0x0, info=1}, ) == 0x0
 01044   808   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 176, ... 180, ) == 0x0
 01045   808   NtMapViewOfSection  (180, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x1320000), 0x0, 8462336, ) == 0x0
 01046   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01047   808   NtQueryDefaultLocale  (1, 1234540, ... ) == 0x0
 01048   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01049   808   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1235576, 1179817, 1235300}  (24, {128, 156, new_msg, 0, 2088850039, 1235576, 1179817, 1235300} "\210\6&\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6&\1\260\0\0\0\377\377\377\377\0\0\0\0@ U\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6&\1\0\0\0\0\0\0\0\0l\336\22\0\0\0\0\0" ... {128, 156, reply, 0, 868, 808, 75666, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6&\1\260\0\0\0\377\377\377\377\0\0\0\0@ U\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6&\1\0\0\0\0\0\0\0\0l\336\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 868, 808, 75666, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1235576, 1179817, 1235300} "\210\6&\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6&\1\260\0\0\0\377\377\377\377\0\0\0\0@ U\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6&\1\0\0\0\0\0\0\0\0l\336\22\0\0\0\0\0" ... {128, 156, reply, 0, 868, 808, 75666, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6&\1\260\0\0\0\377\377\377\377\0\0\0\0@ U\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6&\1\0\0\0\0\0\0\0\0l\336\22\0\0\0\0\0" )  ) == 0x0
 01050   808   NtClose  (176, ... ) == 0x0
 01051   808   NtClose  (180, ... ) == 0x0
 01052   808   NtUnmapViewOfSection  (-1, 0x1320000, ... ) == 0x0
 01053   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01054   808   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01055   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01056   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01057   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1233732, ... ) }, 1233732, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01058   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01059   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01060   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01061   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1233796, ... ) }, 1233796, ... ) == 0x0
 01062   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 180, {status=0x0, info=1}, ) }, 3, 33, ... 180, {status=0x0, info=1}, ) == 0x0
 01063   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01064   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 176, ) }, ... 176, ) == 0x0
 01065   808   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 01066   808   NtClose  (176, ... ) == 0x0
 01067   808   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01068   808   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01069   808   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01070   808   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01071   808   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01072   808   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01073   808   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01074   808   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01075   808   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01076   808   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01077   808   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01078   808   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01079   808   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01080   808   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01081   808   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01082   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01083   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01084   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16449536, 65536, ) == 0x0
 01085   808   NtAllocateVirtualMemory  (-1, 16449536, 0, 4096, 4096, 4, ... 16449536, 4096, ) == 0x0
 01086   808   NtAllocateVirtualMemory  (-1, 16453632, 0, 8192, 4096, 4, ... 16453632, 8192, ) == 0x0
 01087   808   NtAllocateVirtualMemory  (-1, 16461824, 0, 4096, 4096, 4, ... 16461824, 4096, ) == 0x0
 01088   808   NtAllocateVirtualMemory  (-1, 16465920, 0, 4096, 4096, 4, ... 16465920, 4096, ) == 0x0
 01089   808   NtQueryDefaultUILanguage  (1234572, ...
 01090   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01091   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482576, ) == 0x0
 01092   808   NtQueryInformationToken  (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01093   808   NtClose  (-2147482576, ... ) == 0x0
 01094   808   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0
 01095   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x240, 0, 0,  (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01096   808   NtOpenKey  (0x80000000, {24, -2147482576, 0x640, 0, 0,  (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0
 01097   808   NtQueryValueKey  (-2147482648,  (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01098   808   NtClose  (-2147482648, ... ) == 0x0
 01099   808   NtClose  (-2147482576, ... ) == 0x0
 01089   808   NtQueryDefaultUILanguage  ... ) == 0x0
 01100   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll"}, 1, 96, ... 176, {status=0x0, info=1}, ) }, 1, 96, ... 176, {status=0x0, info=1}, ) == 0x0
 01101   808   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 176, ... 184, ) == 0x0
 01102   808   NtMapViewOfSection  (184, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xfc0000), 0x0, 618496, ) == 0x0
 01103   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01104   808   NtQueryDefaultLocale  (1, 1232668, ... ) == 0x0
 01105   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01106   808   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1233704, 1179817, 1233428}  (24, {128, 156, new_msg, 0, 2088850039, 1233704, 1179817, 1233428} "\210\6&\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6&\1\260\0\0\0\377\377\377\377\0\0\0\0\340q\3\1\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6&\1\0\0\0\0\0\0\0\0\34\327\22\0\0\0\0\0" ... {128, 156, reply, 0, 868, 808, 75667, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6&\1\260\0\0\0\377\377\377\377\0\0\0\0\340q\3\1\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6&\1\0\0\0\0\0\0\0\0\34\327\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 868, 808, 75667, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1233704, 1179817, 1233428} "\210\6&\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6&\1\260\0\0\0\377\377\377\377\0\0\0\0\340q\3\1\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6&\1\0\0\0\0\0\0\0\0\34\327\22\0\0\0\0\0" ... {128, 156, reply, 0, 868, 808, 75667, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6&\1\260\0\0\0\377\377\377\377\0\0\0\0\340q\3\1\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6&\1\0\0\0\0\0\0\0\0\34\327\22\0\0\0\0\0" )  ) == 0x0
 01107   808   NtClose  (176, ... ) == 0x0
 01108   808   NtClose  (184, ... ) == 0x0
 01109   808   NtUnmapViewOfSection  (-1, 0xfc0000, ... ) == 0x0
 01110   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01111   808   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {868, 0}, ... 184, ) == 0x0
 01112   808   NtQueryInformationProcess  (184, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01113   808   NtClose  (184, ... ) == 0x0
 01114   808   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01115   808   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 01116   808   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 01117   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01118   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 184, ) == 0x0
 01119   808   NtQueryInformationToken  (184, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01120   808   NtClose  (184, ... ) == 0x0
 01121   808   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 184, ) }, ... 184, ) == 0x0
 01122   808   NtOpenProcessToken  (-1, 0x8, ... 176, ) == 0x0
 01123   808   NtAccessCheck  (1405712, 176, 0x1, 1235764, 1235816, 56, 1235796, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01124   808   NtClose  (176, ... ) == 0x0
 01125   808   NtOpenKey  (0x20019, {24, 184, 0x40, 0, 0,  (0x20019, {24, 184, 0x40, 0, 0, "Control Panel\Desktop"}, ... 176, ) }, ... 176, ) == 0x0
 01126   808   NtQueryValueKey  (176,  (176, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01127   808   NtClose  (176, ... ) == 0x0
 01128   808   NtUserSystemParametersInfo  (41, 500, 1235944, 0, ... ) == 0x1
 01129   808   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 01130   808   NtClose  (184, ... ) == 0x0
 01131   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01132   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc03b
 01133   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc03d
 01134   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01135   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc03f
 01136   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01137   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc041
 01138   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01139   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc043
 01140   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc045
 01141   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01142   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc047
 01143   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01144   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc049
 01145   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01146   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc04b
 01147   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01148   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc04d
 01149   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01150   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc04f
 01151   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc051
 01152   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01153   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc053
 01154   808   NtUserFindExistingCursorIcon  (1235692, 1235708, 1235756, ... ) == 0x10011
 01155   808   NtUserRegisterClassExWOW  (1235636, 1235704, 1235720, 1235736, 0, 384, 0, ... ) == 0x819fc055
 01156   808   NtUserFindExistingCursorIcon  (1235692, 1235708, 1235756, ... ) == 0x10011
 01157   808   NtUserRegisterClassExWOW  (1235636, 1235704, 1235720, 1235736, 0, 384, 0, ... ) == 0x819fc057
 01158   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01159   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc059
 01160   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10013
 01161   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc05b
 01162   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01163   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc05d
 01164   808   NtUserFindExistingCursorIcon  (1235696, 1235712, 1235760, ... ) == 0x10011
 01165   808   NtUserRegisterClassExWOW  (1235640, 1235708, 1235724, 1235740, 0, 384, 0, ... ) == 0x819fc05f
 01166   808   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01167   808   NtCreateSemaphore  (0x1f0003, {24, 48, 0x80, 1399888, 0,  (0x1f0003, {24, 48, 0x80, 1399888, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 184, ) }, 0, 2147483647, ... 184, ) == STATUS_OBJECT_NAME_EXISTS
 01168   808   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 01169   808   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 01170   808   NtCreateKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01171   808   NtQueryValueKey  (176,  (176, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (176, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01172   808   NtClose  (176, ... ) == 0x0
 01173   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1239516, ... ) }, 1239516, ... ) == 0x0
 01174   808   NtCreateKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01175   808   NtSetValueKey  (176,  (176, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 162, ... ) , 0, 1,  (176, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 162, ... ) , 162, ... ) == 0x0
 01176   808   NtClose  (176, ... ) == 0x0
 01177   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1240208, ... ) }, 1240208, ... ) == 0x0
 01178   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1239416, ... ) }, 1239416, ... ) == 0x0
 01179   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 176, {status=0x0, info=1}, ) }, 7, 2113568, ... 176, {status=0x0, info=1}, ) == 0x0
 01180   808   NtSetInformationFile  (176, 1239388, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01181   808   NtClose  (176, ... ) == 0x0
 01182   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\desktop.ini"}, 1239412, ... ) }, 1239412, ... ) == 0x0
 01183   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 1240208, ... ) }, 1240208, ... ) == 0x0
 01184   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 1239416, ... ) }, 1239416, ... ) == 0x0
 01185   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 7, 2113568, ... 176, {status=0x0, info=1}, ) }, 7, 2113568, ... 176, {status=0x0, info=1}, ) == 0x0
 01186   808   NtSetInformationFile  (176, 1239388, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01187   808   NtClose  (176, ... ) == 0x0
 01188   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1239412, ... ) }, 1239412, ... ) == 0x0
 01189   808   NtQueryValueKey  (172,  (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01190   808   NtQueryValueKey  (172,  (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01191   808   NtQueryValueKey  (172,  (172, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\260\376\3\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\260\376\3\0"}, 16, ) }, 16, ) == 0x0
 01192   808   NtOpenKey  (0xf, {24, 168, 0x40, 0, 0,  (0xf, {24, 168, 0x40, 0, 0, "Cookies"}, ... 176, ) }, ... 176, ) == 0x0
 01193   808   NtQueryValueKey  (176,  (176, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01194   808   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "Cookies"}, ... 188, ) }, ... 188, ) == 0x0
 01195   808   NtQueryValueKey  (188,  (188, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01196   808   NtClose  (188, ... ) == 0x0
 01197   808   NtClose  (176, ... ) == 0x0
 01198   808   NtClose  (172, ... ) == 0x0
 01199   808   NtOpenKey  (0xf, {24, 168, 0x40, 0, 0,  (0xf, {24, 168, 0x40, 0, 0, "Cookies"}, ... 172, ) }, ... 172, ) == 0x0
 01200   808   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01201   808   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 01202   808   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 01203   808   NtCreateKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01204   808   NtQueryValueKey  (176,  (176, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (176, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01205   808   NtClose  (176, ... ) == 0x0
 01206   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies"}, 1239516, ... ) }, 1239516, ... ) == 0x0
 01207   808   NtCreateKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01208   808   NtSetValueKey  (176,  (176, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 98, ... ) , 0, 1,  (176, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 98, ... ) , 98, ... ) == 0x0
 01209   808   NtClose  (176, ... ) == 0x0
 01210   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies"}, 1240208, ... ) }, 1240208, ... ) == 0x0
 01211   808   NtQueryValueKey  (172,  (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01212   808   NtQueryValueKey  (172,  (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01213   808   NtQueryValueKey  (172,  (172, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01214   808   NtOpenKey  (0xf, {24, 168, 0x40, 0, 0,  (0xf, {24, 168, 0x40, 0, 0, "History"}, ... 176, ) }, ... 176, ) == 0x0
 01215   808   NtQueryValueKey  (176,  (176, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01216   808   NtOpenKey  (0xf, {24, 164, 0x40, 0, 0,  (0xf, {24, 164, 0x40, 0, 0, "History"}, ... 188, ) }, ... 188, ) == 0x0
 01217   808   NtQueryValueKey  (188,  (188, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01218   808   NtClose  (188, ... ) == 0x0
 01219   808   NtClose  (176, ... ) == 0x0
 01220   808   NtClose  (172, ... ) == 0x0
 01221   808   NtOpenKey  (0xf, {24, 168, 0x40, 0, 0,  (0xf, {24, 168, 0x40, 0, 0, "History"}, ... 172, ) }, ... 172, ) == 0x0
 01222   808   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01223   808   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 01224   808   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 01225   808   NtCreateKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01226   808   NtQueryValueKey  (176,  (176, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (176, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01227   808   NtClose  (176, ... ) == 0x0
 01228   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1239516, ... ) }, 1239516, ... ) == 0x0
 01229   808   NtCreateKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01230   808   NtSetValueKey  (176,  (176, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 128, ... ) , 0, 1,  (176, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 128, ... ) , 128, ... ) == 0x0
 01231   808   NtClose  (176, ... ) == 0x0
 01232   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1240208, ... ) }, 1240208, ... ) == 0x0
 01233   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1239416, ... ) }, 1239416, ... ) == 0x0
 01234   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 7, 2113568, ... 176, {status=0x0, info=1}, ) }, 7, 2113568, ... 176, {status=0x0, info=1}, ) == 0x0
 01235   808   NtSetInformationFile  (176, 1239388, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01236   808   NtClose  (176, ... ) == 0x0
 01237   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\desktop.ini"}, 1239412, ... ) }, 1239412, ... ) == 0x0
 01238   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 1240208, ... ) }, 1240208, ... ) == 0x0
 01239   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 1239416, ... ) }, 1239416, ... ) == 0x0
 01240   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 7, 2113568, ... 176, {status=0x0, info=1}, ) }, 7, 2113568, ... 176, {status=0x0, info=1}, ) == 0x0
 01241   808   NtSetInformationFile  (176, 1239388, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01242   808   NtClose  (176, ... ) == 0x0
 01243   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\desktop.ini"}, 1239412, ... ) }, 1239412, ... ) == 0x0
 01244   808   NtQueryValueKey  (172,  (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01245   808   NtQueryValueKey  (172,  (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01246   808   NtQueryValueKey  (172,  (172, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01247   808   NtClose  (172, ... ) == 0x0
 01248   808   NtClose  (168, ... ) == 0x0
 01249   808   NtClose  (164, ... ) == 0x0
 01250   808   NtOpenMutant  (0x100000, {24, 48, 0x0, 0, 0,  (0x100000, {24, 48, 0x0, 0, 0, "Local\_!MSFTHISTORY!_"}, ... 164, ) }, ... 164, ) == 0x0
 01251   808   NtOpenMutant  (0x100000, {24, 48, 0x0, 0, 0,  (0x100000, {24, 48, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!local settings!temporary internet files!content.ie5!"}, ... 168, ) }, ... 168, ) == 0x0
 01252   808   NtWaitForSingleObject  (168, 0, 0x0, ... ) == 0x0
 01253   808   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ... 1413120, 4096, ) == 0x0
 01254   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241516, ... ) }, 1241516, ... ) == 0x0
 01255   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 172, {status=0x0, info=1}, ) }, 7, 2113568, ... 172, {status=0x0, info=1}, ) == 0x0
 01256   808   NtSetInformationFile  (172, 1241492, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01257   808   NtClose  (172, ... ) == 0x0
 01258   808   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241432,  (0xc0100080, {24, 0, 0x40, 0, 1241432, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 172, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 172, {status=0x0, info=1}, ) == 0x0
 01259   808   NtSetInformationFile  (172, 1241484, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01260   808   NtQueryInformationFile  (172, 1241484, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01261   808   NtOpenSection  (0x2, {24, 48, 0x0, 0, 0,  (0x2, {24, 48, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Local Settings_Temporary Internet Files_Content.IE5_index.dat_802816"}, ... 176, ) }, ... 176, ) == 0x0
 01262   808   NtMapViewOfSection  (176, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1330000), {0, 0}, 802816, ) == 0x0
 01263   808   NtReleaseMutant  (168, ... 0x0, ) == 0x0
 01264   808   NtOpenMutant  (0x100000, {24, 48, 0x0, 0, 0,  (0x100000, {24, 48, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!cookies!"}, ... 188, ) }, ... 188, ) == 0x0
 01265   808   NtWaitForSingleObject  (188, 0, 0x0, ... ) == 0x0
 01266   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies\"}, 1241516, ... ) }, 1241516, ... ) == 0x0
 01267   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies\"}, 7, 2113568, ... 192, {status=0x0, info=1}, ) }, 7, 2113568, ... 192, {status=0x0, info=1}, ) == 0x0
 01268   808   NtSetInformationFile  (192, 1241492, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01269   808   NtClose  (192, ... ) == 0x0
 01270   808   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241432,  (0xc0100080, {24, 0, 0x40, 0, 1241432, "\??\C:\Documents and Settings\Martim Carbone\Cookies\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) == 0x0
 01271   808   NtSetInformationFile  (192, 1241484, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01272   808   NtQueryInformationFile  (192, 1241484, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01273   808   NtOpenSection  (0x2, {24, 48, 0x0, 0, 0,  (0x2, {24, 48, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Cookies_index.dat_32768"}, ... 196, ) }, ... 196, ) == 0x0
 01274   808   NtMapViewOfSection  (196, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xfc0000), {0, 0}, 32768, ) == 0x0
 01275   808   NtReleaseMutant  (188, ... 0x0, ) == 0x0
 01276   808   NtOpenMutant  (0x100000, {24, 48, 0x0, 0, 0,  (0x100000, {24, 48, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!local settings!history!history.ie5!"}, ... 200, ) }, ... 200, ) == 0x0
 01277   808   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 01278   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 1241516, ... ) }, 1241516, ... ) == 0x0
 01279   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 7, 2113568, ... 204, {status=0x0, info=1}, ) }, 7, 2113568, ... 204, {status=0x0, info=1}, ) == 0x0
 01280   808   NtSetInformationFile  (204, 1241492, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01281   808   NtClose  (204, ... ) == 0x0
 01282   808   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241432,  (0xc0100080, {24, 0, 0x40, 0, 1241432, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 204, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 204, {status=0x0, info=1}, ) == 0x0
 01283   808   NtSetInformationFile  (204, 1241484, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01284   808   NtQueryInformationFile  (204, 1241484, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01285   808   NtOpenSection  (0x2, {24, 48, 0x0, 0, 0,  (0x2, {24, 48, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Local Settings_History_History.IE5_index.dat_81920"}, ... 208, ) }, ... 208, ) == 0x0
 01286   808   NtMapViewOfSection  (208, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xfd0000), {0, 0}, 81920, ) == 0x0
 01287   808   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 01288   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241092, ... ) }, 1241092, ... ) == 0x0
 01289   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 01290   808   NtSetInformationFile  (212, 1241064, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01291   808   NtClose  (212, ... ) == 0x0
 01292   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1241088, ... ) }, 1241088, ... ) == 0x0
 01293   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 1241092, ... ) }, 1241092, ... ) == 0x0
 01294   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 01295   808   NtSetInformationFile  (212, 1241064, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01296   808   NtClose  (212, ... ) == 0x0
 01297   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\desktop.ini"}, 1241088, ... ) }, 1241088, ... ) == 0x0
 01298   808   NtWaitForSingleObject  (168, 0, 0x0, ... ) == 0x0
 01299   808   NtReleaseMutant  (168, ... 0x0, ) == 0x0
 01300   808   NtOpenKey  (0xf, {24, 52, 0x40, 0, 0,  (0xf, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 212, ) }, ... 212, ) == 0x0
 01301   808   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "Extensible Cache"}, ... 216, ) }, ... 216, ) == 0x0
 01302   808   NtClose  (212, ... ) == 0x0
 01303   808   NtWaitForSingleObject  (164, 0, {-600000000, -1}, ... ) == 0x0
 01304   808   NtEnumerateKey  (216, 0, Basic, 288, ... {LastWrite={0x47401762,0x1c74db1}, TitleIdx=0, Name= (216, 0, Basic, 288, ... {LastWrite={0x47401762,0x1c74db1}, TitleIdx=0, Name="feedplat"}, 32, ) }, 32, ) == 0x0
 01305   808   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "feedplat"}, ... 212, ) }, ... 212, ) == 0x0
 01306   808   NtQueryValueKey  (212,  (212, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01307   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01308   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (212, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) }, 148, ) == 0x0
 01309   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01310   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (212, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) }, 148, ) == 0x0
 01311   808   NtQueryValueKey  (212,  (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) }, 32, ) == 0x0
 01312   808   NtQueryValueKey  (212,  (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) }, 32, ) == 0x0
 01313   808   NtQueryValueKey  (212,  (212, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01314   808   NtQueryValueKey  (212,  (212, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01315   808   NtClose  (212, ... ) == 0x0
 01316   808   NtEnumerateKey  (216, 1, Basic, 288, ... {LastWrite={0x4121a6b6,0x1c8903b}, TitleIdx=0, Name= (216, 1, Basic, 288, ... {LastWrite={0x4121a6b6,0x1c8903b}, TitleIdx=0, Name="MSHist012008032720080328"}, 64, ) }, 64, ) == 0x0
 01317   808   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "MSHist012008032720080328"}, ... 212, ) }, ... 212, ) == 0x0
 01318   808   NtQueryValueKey  (212,  (212, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01319   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01320   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\03\02\07\02\00\00\08\00\03\02\08\0\0\0"}, 160, ) , Partial, 160, ... TitleIdx=0, Type=2, Data= (212, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\03\02\07\02\00\00\08\00\03\02\08\0\0\0"}, 160, ) }, 160, ) == 0x0
 01321   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01322   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\03\02\07\02\00\00\08\00\03\02\08\0\0\0"}, 160, ) , Partial, 160, ... TitleIdx=0, Type=2, Data= (212, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\03\02\07\02\00\00\08\00\03\02\08\0\0\0"}, 160, ) }, 160, ) == 0x0
 01323   808   NtQueryValueKey  (212,  (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\03\02\07\02\00\00\08\00\03\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\03\02\07\02\00\00\08\00\03\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01324   808   NtQueryValueKey  (212,  (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\03\02\07\02\00\00\08\00\03\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\03\02\07\02\00\00\08\00\03\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01325   808   NtQueryValueKey  (212,  (212, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01326   808   NtQueryValueKey  (212,  (212, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 01327   808   NtClose  (212, ... ) == 0x0
 01328   808   NtEnumerateKey  (216, 2, Basic, 288, ... {LastWrite={0x2030327f,0x1c7701e}, TitleIdx=0, Name= (216, 2, Basic, 288, ... {LastWrite={0x2030327f,0x1c7701e}, TitleIdx=0, Name="UserData"}, 32, ) }, 32, ) == 0x0
 01329   808   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "UserData"}, ... 212, ) }, ... 212, ) == 0x0
 01330   808   NtQueryValueKey  (212,  (212, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01331   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01332   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (212, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) }, 148, ) == 0x0
 01333   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01334   808   NtQueryValueKey  (212,  (212, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (212, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) }, 148, ) == 0x0
 01335   808   NtQueryValueKey  (212,  (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) }, 30, ) == 0x0
 01336   808   NtQueryValueKey  (212,  (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) }, 30, ) == 0x0
 01337   808   NtQueryValueKey  (212,  (212, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\350\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\350\3\0\0"}, 16, ) }, 16, ) == 0x0
 01338   808   NtQueryValueKey  (212,  (212, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\10\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\10\0\0\0"}, 16, ) }, 16, ) == 0x0
 01339   808   NtClose  (212, ... ) == 0x0
 01340   808   NtEnumerateKey  (216, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 01341   808   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 01342   808   NtClose  (216, ... ) == 0x0
 01343   808   NtWaitForSingleObject  (168, 0, 0x0, ... ) == 0x0
 01344   808   NtReleaseMutant  (168, ... 0x0, ) == 0x0
 01345   808   NtWaitForSingleObject  (168, 0, 0x0, ... ) == 0x0
 01346   808   NtReleaseMutant  (168, ... 0x0, ) == 0x0
 01347   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01348   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01349   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01350   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01351   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01352   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01353   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01354   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 216, ) }, ... 216, ) == 0x0
 01355   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01356   808   NtOpenKey  (0x1, {24, 216, 0x40, 0, 0,  (0x1, {24, 216, 0x40, 0, 0, "RETRY_HEADERONLYPOST_ONCONNECTIONRESET"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01357   808   NtClose  (216, ... ) == 0x0
 01358   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01359   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01360   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 216, ) }, ... 216, ) == 0x0
 01361   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01362   808   NtOpenKey  (0x1, {24, 216, 0x40, 0, 0,  (0x1, {24, 216, 0x40, 0, 0, "FEATURE_BUFFERBREAKING_818408"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01363   808   NtClose  (216, ... ) == 0x0
 01364   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01365   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01366   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 216, ) }, ... 216, ) == 0x0
 01367   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01368   808   NtOpenKey  (0x1, {24, 216, 0x40, 0, 0,  (0x1, {24, 216, 0x40, 0, 0, "FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01369   808   NtClose  (216, ... ) == 0x0
 01370   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01371   808   NtQueryValueKey  (136,  (136, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01372   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01373   808   NtQueryValueKey  (216,  (216, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01374   808   NtClose  (216, ... ) == 0x0
 01375   808   NtQueryValueKey  (136,  (136, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01376   808   NtQueryValueKey  (136,  (136, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01377   808   NtQueryValueKey  (136,  (136, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01378   808   NtQueryValueKey  (136,  (136, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01379   808   NtQueryValueKey  (136,  (136, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01380   808   NtQueryValueKey  (136,  (136, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01381   808   NtQueryValueKey  (136,  (136, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01382   808   NtQueryValueKey  (136,  (136, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01383   808   NtQueryValueKey  (136,  (136, "ConnectTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01384   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01385   808   NtQueryValueKey  (216,  (216, "ConnectTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01386   808   NtClose  (216, ... ) == 0x0
 01387   808   NtQueryValueKey  (136,  (136, "ConnectRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01388   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01389   808   NtQueryValueKey  (216,  (216, "ConnectRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01390   808   NtClose  (216, ... ) == 0x0
 01391   808   NtQueryValueKey  (136,  (136, "SendTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01392   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01393   808   NtQueryValueKey  (216,  (216, "SendTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01394   808   NtClose  (216, ... ) == 0x0
 01395   808   NtQueryValueKey  (136,  (136, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01396   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01397   808   NtQueryValueKey  (216,  (216, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01398   808   NtClose  (216, ... ) == 0x0
 01399   808   NtQueryValueKey  (136,  (136, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01400   808   NtQueryValueKey  (136,  (136, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01401   808   NtQueryValueKey  (136,  (136, "CertCacheNoValidate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01402   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 216, ) }, ... 216, ) == 0x0
 01403   808   NtQueryValueKey  (216,  (216, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01404   808   NtClose  (216, ... ) == 0x0
 01405   808   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ... 1417216, 4096, ) == 0x0
 01406   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01407   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01408   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01409   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 216, ) }, ... 216, ) == 0x0
 01410   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 212, ) }, ... 212, ) == 0x0
 01411   808   NtQueryValueKey  (212,  (212, "ScavengeCacheFileLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01412   808   NtQueryValueKey  (216,  (216, "ScavengeCacheFileLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01413   808   NtClose  (216, ... ) == 0x0
 01414   808   NtClose  (212, ... ) == 0x0
 01415   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01416   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01417   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 212, ) }, ... 212, ) == 0x0
 01418   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01419   808   NtOpenKey  (0x1, {24, 212, 0x40, 0, 0,  (0x1, {24, 212, 0x40, 0, 0, "FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01420   808   NtClose  (212, ... ) == 0x0
 01421   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01422   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01423   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 212, ) }, ... 212, ) == 0x0
 01424   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01425   808   NtOpenKey  (0x1, {24, 212, 0x40, 0, 0,  (0x1, {24, 212, 0x40, 0, 0, "FEATURE_USE_CNAME_FOR_SPN_KB911149"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01426   808   NtClose  (212, ... ) == 0x0
 01427   808   NtQueryValueKey  (136,  (136, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01428   808   NtQueryValueKey  (136,  (136, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01429   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01430   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01431   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 212, ) }, ... 212, ) == 0x0
 01432   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01433   808   NtOpenKey  (0x1, {24, 212, 0x40, 0, 0,  (0x1, {24, 212, 0x40, 0, 0, "FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01434   808   NtClose  (212, ... ) == 0x0
 01435   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01436   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01437   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 212, ) }, ... 212, ) == 0x0
 01438   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01439   808   NtOpenKey  (0x1, {24, 212, 0x40, 0, 0,  (0x1, {24, 212, 0x40, 0, 0, "FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK"}, ... 216, ) }, ... 216, ) == 0x0
 01440   808   NtQueryValueKey  (216,  (216, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01441   808   NtQueryValueKey  (216,  (216, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01442   808   NtClose  (216, ... ) == 0x0
 01443   808   NtClose  (212, ... ) == 0x0
 01444   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01445   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01446   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 212, ) }, ... 212, ) == 0x0
 01447   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01448   808   NtOpenKey  (0x1, {24, 212, 0x40, 0, 0,  (0x1, {24, 212, 0x40, 0, 0, "FEATURE_DIGEST_NO_EXTRAS_IN_URI"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01449   808   NtClose  (212, ... ) == 0x0
 01450   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01451   808   NtQueryValueKey  (212,  (212, "DisableCachingOfSSLPages", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "DisableCachingOfSSLPages", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01452   808   NtClose  (212, ... ) == 0x0
 01453   808   NtQueryValueKey  (136,  (136, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01454   808   NtQueryValueKey  (136,  (136, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01455   808   NtQueryValueKey  (136,  (136, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01456   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01457   808   NtQueryValueKey  (212,  (212, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01458   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01459   808   NtQueryValueKey  (216,  (216, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01460   808   NtClose  (212, ... ) == 0x0
 01461   808   NtClose  (216, ... ) == 0x0
 01462   808   NtQueryValueKey  (136,  (136, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01463   808   NtQueryValueKey  (136,  (136, "BypassFtpTimeCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01464   808   NtQueryValueKey  (136,  (136, "ReleaseSocketDuringAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01465   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01466   808   NtQueryValueKey  (216,  (216, "ReleaseSocketDuring401Auth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01467   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01468   808   NtQueryValueKey  (212,  (212, "ReleaseSocketDuring401Auth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01469   808   NtClose  (216, ... ) == 0x0
 01470   808   NtClose  (212, ... ) == 0x0
 01471   808   NtQueryValueKey  (136,  (136, "WpadSearchAllDomains", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01472   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01473   808   NtQueryValueKey  (212,  (212, "DisableLegacyPreAuthAsServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01474   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01475   808   NtQueryValueKey  (216,  (216, "DisableLegacyPreAuthAsServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01476   808   NtClose  (212, ... ) == 0x0
 01477   808   NtClose  (216, ... ) == 0x0
 01478   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01479   808   NtQueryValueKey  (216,  (216, "BypassHTTPNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01480   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01481   808   NtQueryValueKey  (212,  (212, "BypassHTTPNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01482   808   NtClose  (216, ... ) == 0x0
 01483   808   NtClose  (212, ... ) == 0x0
 01484   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01485   808   NtQueryValueKey  (212,  (212, "BypassSSLNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01486   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01487   808   NtQueryValueKey  (216,  (216, "BypassSSLNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01488   808   NtClose  (212, ... ) == 0x0
 01489   808   NtClose  (216, ... ) == 0x0
 01490   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01491   808   NtQueryValueKey  (216,  (216, "EnableHttpTrace", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01492   808   NtClose  (216, ... ) == 0x0
 01493   808   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 216, ) }, ... 216, ) == 0x0
 01494   808   NtQueryValueKey  (216,  (216, "NoCheckAutodialOverRide", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01495   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01496   808   NtQueryValueKey  (212,  (212, "NoCheckAutodialOverRide", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01497   808   NtClose  (216, ... ) == 0x0
 01498   808   NtClose  (212, ... ) == 0x0
 01499   808   NtQueryValueKey  (136,  (136, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01500   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01501   808   NtQueryValueKey  (212,  (212, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01502   808   NtClose  (212, ... ) == 0x0
 01503   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01504   808   NtQueryValueKey  (212,  (212, "ShareCredsWithWinHttp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01505   808   NtClose  (212, ... ) == 0x0
 01506   808   NtQueryValueKey  (136,  (136, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01507   808   NtQueryValueKey  (136,  (136, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01508   808   NtQueryValueKey  (136,  (136, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01509   808   NtQueryValueKey  (136,  (136, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01510   808   NtQueryValueKey  (136,  (136, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01511   808   NtQueryValueKey  (136,  (136, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01512   808   NtQueryValueKey  (136,  (136, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01513   808   NtQueryValueKey  (136,  (136, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01514   808   NtQueryValueKey  (136,  (136, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (136, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01515   808   NtQueryValueKey  (136,  (136, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01516   808   NtQueryValueKey  (136,  (136, "WarnOnZoneCrossing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "WarnOnZoneCrossing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01517   808   NtQueryValueKey  (136,  (136, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01518   808   NtQueryValueKey  (136,  (136, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01519   808   NtQueryValueKey  (136,  (136, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01520   808   NtQueryValueKey  (136,  (136, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01521   808   NtQueryValueKey  (136,  (136, "WarnOnHTTPSToHTTPRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01522   808   NtOpenMutant  (0x100000, {24, 48, 0x0, 0, 0,  (0x100000, {24, 48, 0x0, 0, 0, "Local\WininetStartupMutex"}, ... 212, ) }, ... 212, ) == 0x0
 01523   808   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 216, ) }, ... 216, ) == 0x0
 01524   808   NtQueryValueKey  (216,  (216, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (216, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01525   808   NtQueryValueKey  (216,  (216, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (216, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01526   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 220, ) == 0x0
 01527   808   NtOpenKey  (0x2000000, {24, 216, 0x40, 0, 0,  (0x2000000, {24, 216, 0x40, 0, 0, "Protocol_Catalog9"}, ... 224, ) }, ... 224, ) == 0x0
 01528   808   NtQueryValueKey  (224,  (224, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (224, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01529   808   NtNotifyChangeKey  (224, 220, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01530   808   NtQueryValueKey  (224,  (224, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (224, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01531   808   NtOpenKey  (0x2000000, {24, 224, 0x40, 0, 0,  (0x2000000, {24, 224, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01532   808   NtQueryValueKey  (224,  (224, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (224, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01533   808   NtQueryValueKey  (224,  (224, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (224, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01534   808   NtOpenKey  (0x2000000, {24, 224, 0x40, 0, 0,  (0x2000000, {24, 224, 0x40, 0, 0, "Catalog_Entries"}, ... 228, ) }, ... 228, ) == 0x0
 01535   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000001"}, ... 232, ) }, ... 232, ) == 0x0
 01536   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01537   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01538   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\3\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\3\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\4\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\4\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\5\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\5\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\6\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\3\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\3\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\4\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\4\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\5\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\5\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\6\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\5\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\6\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\3\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\3\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\4\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\4\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\5\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\5\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\6\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01539   808   NtClose  (232, ... ) == 0x0
 01540   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000002"}, ... 232, ) }, ... 232, ) == 0x0
 01541   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01542   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01543   808   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ... 1421312, 4096, ) == 0x0
 01544   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\11\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\11\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\12\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\12\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\13\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\13\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\14\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\11\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\11\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\12\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\12\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\13\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\13\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\14\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\13\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\14\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\11\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\11\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\12\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\12\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\13\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\13\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\14\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01545   808   NtClose  (232, ... ) == 0x0
 01546   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000003"}, ... 232, ) }, ... 232, ) == 0x0
 01547   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01548   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01549   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\16\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\16\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\17\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\17\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\20\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\20\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\21\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\16\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\16\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\17\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\17\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\20\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\20\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\21\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\20\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\21\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\16\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\16\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\17\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\17\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\20\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\20\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\21\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01550   808   NtClose  (232, ... ) == 0x0
 01551   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000004"}, ... 232, ) }, ... 232, ) == 0x0
 01552   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01553   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01554   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\23\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\23\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\24\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\24\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\25\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\25\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\26\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\23\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\23\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\24\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\24\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\25\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\25\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\26\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\25\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\26\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\23\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\23\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\24\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\24\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\25\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\25\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\26\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01555   808   NtClose  (232, ... ) == 0x0
 01556   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000005"}, ... 232, ) }, ... 232, ) == 0x0
 01557   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01558   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01559   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\30\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\30\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\31\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\31\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\32\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\32\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\33\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\30\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\30\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\31\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\31\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\32\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\32\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\33\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\32\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\33\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\30\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\30\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\31\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\31\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0\32\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\32\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\33\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01560   808   NtClose  (232, ... ) == 0x0
 01561   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000006"}, ... 232, ) }, ... 232, ) == 0x0
 01562   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01563   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01564   808   NtAllocateVirtualMemory  (-1, 1425408, 0, 4096, 4096, 4, ... 1425408, 4096, ) == 0x0
 01565   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\36\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\36\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\37\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\37\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0 \6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0 \6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0!\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\36\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\36\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\37\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\37\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0 \6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0 \6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0!\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0 \6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0!\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\36\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\36\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\37\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\37\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0 \6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0 \6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0!\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01566   808   NtClose  (232, ... ) == 0x0
 01567   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000007"}, ... 232, ) }, ... 232, ) == 0x0
 01568   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01569   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01570   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0#\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0#\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0$\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0$\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0%\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0%\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0&\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0#\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0#\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0$\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0$\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0%\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0%\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0&\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0%\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0&\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0#\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0#\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0$\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0$\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0%\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0%\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0&\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01571   808   NtClose  (232, ... ) == 0x0
 01572   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000008"}, ... 232, ) }, ... 232, ) == 0x0
 01573   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01574   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01575   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0(\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0(\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0)\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0)\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0*\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0*\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0+\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0(\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0(\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0)\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0)\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0*\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0*\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0+\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0*\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0+\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0(\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0(\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0)\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0)\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0*\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0*\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0+\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01576   808   NtClose  (232, ... ) == 0x0
 01577   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000009"}, ... 232, ) }, ... 232, ) == 0x0
 01578   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01579   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01580   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0-\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0-\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0.\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0.\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0/\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0/\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\00\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0-\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0-\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0.\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0.\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0/\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0/\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\00\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0/\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\00\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0-\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0-\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0.\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0.\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0/\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0/\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\00\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01581   808   NtClose  (232, ... ) == 0x0
 01582   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000010"}, ... 232, ) }, ... 232, ) == 0x0
 01583   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01584   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01585   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\02\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\02\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\03\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\03\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\04\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\04\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\05\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\02\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\02\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\03\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\03\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\04\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\04\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\05\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\04\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\05\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\02\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\02\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\03\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\03\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\04\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\04\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\05\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01586   808   NtClose  (232, ... ) == 0x0
 01587   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000011"}, ... 232, ) }, ... 232, ) == 0x0
 01588   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01589   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01590   808   NtAllocateVirtualMemory  (-1, 1429504, 0, 4096, 4096, 4, ... 1429504, 4096, ) == 0x0
 01591   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\08\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\08\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\09\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\09\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0:\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0:\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0;\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\08\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\08\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\09\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\09\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0:\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0:\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0;\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0:\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0;\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\08\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\08\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\09\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\09\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0:\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0:\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0;\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01592   808   NtClose  (232, ... ) == 0x0
 01593   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000012"}, ... 232, ) }, ... 232, ) == 0x0
 01594   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01595   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01596   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0=\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0=\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0>\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0>\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0?\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0?\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0@\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0=\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0=\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0>\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0>\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0?\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0?\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0@\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0?\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0@\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0=\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0=\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0>\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0>\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0?\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0?\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0@\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01597   808   NtClose  (232, ... ) == 0x0
 01598   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000013"}, ... 232, ) }, ... 232, ) == 0x0
 01599   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01600   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01601   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0B\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0B\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0C\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0C\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0D\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0D\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0E\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0B\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0B\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0C\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0C\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0D\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0D\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0E\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0D\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0E\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0B\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0B\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0C\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0C\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0D\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0D\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0E\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01602   808   NtClose  (232, ... ) == 0x0
 01603   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000014"}, ... 232, ) }, ... 232, ) == 0x0
 01604   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01605   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01606   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0G\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0G\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0H\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0I\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0I\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0G\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0G\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0H\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0I\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0I\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0I\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0G\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0G\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0H\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0I\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0I\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01607   808   NtClose  (232, ... ) == 0x0
 01608   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000015"}, ... 232, ) }, ... 232, ) == 0x0
 01609   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01610   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01611   808   NtAllocateVirtualMemory  (-1, 1433600, 0, 4096, 4096, 4, ... 1433600, 4096, ) == 0x0
 01612   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0M\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0M\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0N\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0N\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0O\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0O\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0P\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0M\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0M\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0N\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0N\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0O\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0O\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0P\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0O\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0P\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0M\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0M\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0N\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0N\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0O\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0O\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0P\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01613   808   NtClose  (232, ... ) == 0x0
 01614   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000016"}, ... 232, ) }, ... 232, ) == 0x0
 01615   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01616   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01617   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0R\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0R\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0S\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0S\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0T\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0T\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0U\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0R\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0R\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0S\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0S\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0T\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0T\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0U\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0T\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0U\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0R\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0R\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0S\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0S\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0T\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0T\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0U\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01618   808   NtClose  (232, ... ) == 0x0
 01619   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000017"}, ... 232, ) }, ... 232, ) == 0x0
 01620   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01621   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01622   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0W\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0W\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0X\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0X\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0Y\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0Y\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Z\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0W\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0W\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0X\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0X\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0Y\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0Y\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Z\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0Y\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Z\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0W\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0W\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0X\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0X\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0Y\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0Y\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Z\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01623   808   NtClose  (232, ... ) == 0x0
 01624   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000018"}, ... 232, ) }, ... 232, ) == 0x0
 01625   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01626   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01627   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0]\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0]\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0^\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0^\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0_\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0]\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0]\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0^\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0^\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0_\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0^\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0_\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0\\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0]\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0]\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0^\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0^\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0_\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01628   808   NtClose  (232, ... ) == 0x0
 01629   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000019"}, ... 232, ) }, ... 232, ) == 0x0
 01630   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01631   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01632   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0a\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0a\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0b\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0c\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0c\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0a\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0a\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0b\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0c\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0c\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0c\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0a\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0a\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0b\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0c\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0c\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01633   808   NtClose  (232, ... ) == 0x0
 01634   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000020"}, ... 232, ) }, ... 232, ) == 0x0
 01635   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01636   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01637   808   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ... 1437696, 4096, ) == 0x0
 01638   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0g\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0g\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0h\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0h\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0i\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0i\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0j\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0g\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0g\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0h\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0h\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0i\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0i\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0j\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0i\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0j\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0g\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0g\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0h\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0h\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0i\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0i\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0j\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01639   808   NtClose  (232, ... ) == 0x0
 01640   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000021"}, ... 232, ) }, ... 232, ) == 0x0
 01641   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01642   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01643   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0l\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0l\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0m\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0m\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0n\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0n\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0o\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0l\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0l\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0m\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0m\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0n\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0n\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0o\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0n\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0o\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0 (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0l\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0l\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0m\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\344\0\0\0L\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\244\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0m\6\0\0d\3\0\0(\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\350\0\0\0n\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0n\6\0\0d\3\0\0(\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0o\6\0\0d\3\0\0(\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\350\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01644   808   NtClose  (232, ... ) == 0x0
 01645   808   NtOpenKey  (0x20019, {24, 228, 0x40, 0, 0,  (0x20019, {24, 228, 0x40, 0, 0, "000000000022"}, ... 232, ) }, ... 232, ) == 0x0
 01646   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01647   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01648   808   NtQueryValueKey  (232,  (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0q\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0q\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0r\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0r\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\6\0\0d\3\0\0(\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\334\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0s\6\0\0d\3\0\0(\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0t\6\0\0d\3\0\0(\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0t\6\0\0d\3\0\0(\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0u\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\330\0\0\0t\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\320\210\25\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (232, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0q\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0q\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0r\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0r\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\6\0\0d\3\0\0(\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\334\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0s\6\0\0d\3\0\0(\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0t\6\0\0d\3\0\0(\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0t\6\0\0d\3\0\0(\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0u\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\330\0\0\0t\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\320\210\25\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0q\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\350\0\0\0q\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0r\6\0\0d\3\0\0(\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\344\0\0\0r\6\0\0d\3\0\0(\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\6\0\0d\3\0\0(\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\334\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0s\6\0\0d\3\0\0(\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0t\6\0\0d\3\0\0(\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0t\6\0\0d\3\0\0(\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\344\0\0\0u\6\0\0d\3\0\0(\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\330\0\0\0t\361\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\320\210\25\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 01649   808   NtClose  (232, ... ) == 0x0
 01650   808   NtClose  (228, ... ) == 0x0
 01651   808   NtWaitForSingleObject  (220, 0, {0, 0}, ... ) == 0x102
 01652   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 228, ) == 0x0
 01653   808   NtOpenKey  (0x2000000, {24, 216, 0x40, 0, 0,  (0x2000000, {24, 216, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 232, ) }, ... 232, ) == 0x0
 01654   808   NtQueryValueKey  (232,  (232, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01655   808   NtNotifyChangeKey  (232, 228, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01656   808   NtQueryValueKey  (232,  (232, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01657   808   NtOpenKey  (0x2000000, {24, 232, 0x40, 0, 0,  (0x2000000, {24, 232, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01658   808   NtQueryValueKey  (232,  (232, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01659   808   NtOpenKey  (0x2000000, {24, 232, 0x40, 0, 0,  (0x2000000, {24, 232, 0x40, 0, 0, "Catalog_Entries"}, ... 236, ) }, ... 236, ) == 0x0
 01660   808   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000001"}, ... 240, ) }, ... 240, ) == 0x0
 01661   808   NtQueryValueKey  (240,  (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01662   808   NtQueryValueKey  (240,  (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01663   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01664   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01665   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01666   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01667   808   NtQueryValueKey  (240,  (240, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (240, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01668   808   NtQueryValueKey  (240,  (240, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01669   808   NtQueryValueKey  (240,  (240, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01670   808   NtQueryValueKey  (240,  (240, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01671   808   NtQueryValueKey  (240,  (240, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01672   808   NtQueryValueKey  (240,  (240, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01673   808   NtClose  (240, ... ) == 0x0
 01674   808   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000002"}, ... 240, ) }, ... 240, ) == 0x0
 01675   808   NtQueryValueKey  (240,  (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01676   808   NtQueryValueKey  (240,  (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01677   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01678   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01679   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01680   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01681   808   NtQueryValueKey  (240,  (240, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (240, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01682   808   NtQueryValueKey  (240,  (240, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01683   808   NtQueryValueKey  (240,  (240, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01684   808   NtQueryValueKey  (240,  (240, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01685   808   NtQueryValueKey  (240,  (240, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01686   808   NtQueryValueKey  (240,  (240, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01687   808   NtClose  (240, ... ) == 0x0
 01688   808   NtAllocateVirtualMemory  (-1, 1441792, 0, 4096, 4096, 4, ... 1441792, 4096, ) == 0x0
 01689   808   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000003"}, ... 240, ) }, ... 240, ) == 0x0
 01690   808   NtQueryValueKey  (240,  (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01691   808   NtQueryValueKey  (240,  (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01692   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01693   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01694   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01695   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01696   808   NtQueryValueKey  (240,  (240, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (240, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01697   808   NtQueryValueKey  (240,  (240, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01698   808   NtQueryValueKey  (240,  (240, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01699   808   NtQueryValueKey  (240,  (240, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01700   808   NtQueryValueKey  (240,  (240, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01701   808   NtQueryValueKey  (240,  (240, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01702   808   NtClose  (240, ... ) == 0x0
 01703   808   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000004"}, ... 240, ) }, ... 240, ) == 0x0
 01704   808   NtQueryValueKey  (240,  (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01705   808   NtQueryValueKey  (240,  (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01706   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01707   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01708   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01709   808   NtQueryValueKey  (240,  (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (240, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01710   808   NtQueryValueKey  (240,  (240, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (240, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01711   808   NtQueryValueKey  (240,  (240, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01712   808   NtQueryValueKey  (240,  (240, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01713   808   NtQueryValueKey  (240,  (240, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01714   808   NtQueryValueKey  (240,  (240, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01715   808   NtQueryValueKey  (240,  (240, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01716   808   NtClose  (240, ... ) == 0x0
 01717   808   NtClose  (236, ... ) == 0x0
 01718   808   NtWaitForSingleObject  (228, 0, {0, 0}, ... ) == 0x102
 01719   808   NtClose  (216, ... ) == 0x0
 01720   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01721   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01722   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 216, ) }, ... 216, ) == 0x0
 01723   808   NtQueryValueKey  (216,  (216, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01724   808   NtClose  (216, ... ) == 0x0
 01725   808   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 216, ) == 0x0
 01726   808   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 236, ) == 0x0
 01727   808   NtQueryValueKey  (136,  (136, "GlobalUserOffline", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "GlobalUserOffline", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01728   808   NtWaitForSingleObject  (168, 0, 0x0, ... ) == 0x0
 01729   808   NtReleaseMutant  (168, ... 0x0, ) == 0x0
 01730   808   NtOpenMutant  (0x100000, {24, 48, 0x0, 0, 0,  (0x100000, {24, 48, 0x0, 0, 0, "Local\WininetConnectionMutex"}, ... 240, ) }, ... 240, ) == 0x0
 01731   808   NtOpenMutant  (0x100000, {24, 48, 0x0, 0, 0,  (0x100000, {24, 48, 0x0, 0, 0, "Local\WininetProxyRegistryMutex"}, ... 244, ) }, ... 244, ) == 0x0
 01732   808   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 248, ) == 0x0
 01733   808   NtQueryValueKey  (136,  (136, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01734   808   NtQueryValueKey  (136,  (136, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01735   808   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 252, ) == 0x0
 01736   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 256, ) }, ... 256, ) == 0x0
 01737   808   NtQueryValueKey  (256,  (256, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (256, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 01738   808   NtQueryValueKey  (256,  (256, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (256, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 01739   808   NtClose  (256, ... ) == 0x0
 01740   808   NtQueryValueKey  (136,  (136, "TruncateFileName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01741   808   NtAllocateVirtualMemory  (-1, 1445888, 0, 4096, 4096, 4, ... 1445888, 4096, ) == 0x0
 01742   808   NtQueryValueKey  (136,  (136, "BadProxyExpiresTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01743   808   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 256, ) == 0x0
 01744   808   NtWaitForSingleObject  (256, 0, 0x0, ... ) == 0x0
 01745   808   NtClearEvent  (256, ... ) == 0x0
 01746   808   NtSetEvent  (256, ... 0x0, ) == 0x0
 01747   808   NtClearEvent  (236, ... ) == 0x0
 01748   808   NtSetEvent  (236, ... 0x0, ) == 0x0
 01749   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "icmp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01750   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\icmp.dll"}, 1240404, ... ) }, 1240404, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01751   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\icmp.dll"}, 1240404, ... ) }, 1240404, ... ) == 0x0
 01752   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\icmp.dll"}, 5, 96, ... 260, {status=0x0, info=1}, ) }, 5, 96, ... 260, {status=0x0, info=1}, ) == 0x0
 01753   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 260, ... 264, ) == 0x0
 01754   808   NtQuerySection  (264, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01755   808   NtClose  (260, ... ) == 0x0
 01756   808   NtMapViewOfSection  (264, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74290000), 0x0, 16384, ) == 0x0
 01757   808   NtClose  (264, ... ) == 0x0
 01758   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01759   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\iphlpapi.dll"}, 1240876, ... ) }, 1240876, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01760   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 1240876, ... ) }, 1240876, ... ) == 0x0
 01761   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 5, 96, ... 264, {status=0x0, info=1}, ) }, 5, 96, ... 264, {status=0x0, info=1}, ) == 0x0
 01762   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 264, ... 260, ) == 0x0
 01763   808   NtQuerySection  (260, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01764   808   NtClose  (264, ... ) == 0x0
 01765   808   NtMapViewOfSection  (260, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d60000), 0x0, 102400, ) == 0x0
 01766   808   NtClose  (260, ... ) == 0x0
 01767   808   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01768   808   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01769   808   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01770   808   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01771   808   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01772   808   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01773   808   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01774   808   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01775   808   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01776   808   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01777   808   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01778   808   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01779   808   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01780   808   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01781   808   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01782   808   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01783   808   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01784   808   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01785   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01786   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01787   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16711680, 65536, ) == 0x0
 01788   808   NtAllocateVirtualMemory  (-1, 16711680, 0, 4096, 4096, 4, ... 16711680, 4096, ) == 0x0
 01789   808   NtAllocateVirtualMemory  (-1, 16715776, 0, 8192, 4096, 4, ... 16715776, 8192, ) == 0x0
 01790   808   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 260, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 260, {status=0x0, info=0}, ) == 0x0
 01791   808   NtCreateFile  (0x40000000, {24, 0, 0x40, 0, 0,  (0x40000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 264, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 264, {status=0x0, info=0}, ) == 0x0
 01792   808   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 268, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 268, {status=0x0, info=0}, ) == 0x0
 01793   808   NtCreateFile  (0x100003, {24, 0, 0x40, 0, 0,  (0x100003, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 272, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 272, {status=0x0, info=0}, ) == 0x0
 01794   808   NtCreateFile  (0x20100080, {24, 0, 0x40, 0, 1241600,  (0x20100080, {24, 0, 0x40, 0, 1241600, "\??\Ip"}, 0x0, 128, 3, 1, 64, 0, 0, ... 276, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 64, 0, 0, ... 276, {status=0x0, info=0}, ) == 0x0
 01795   808   NtAllocateVirtualMemory  (-1, 16723968, 0, 36864, 4096, 4, ... 16723968, 36864, ) == 0x0
 01796   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 280, ) == 0x0
 01797   808   NtDeviceIoControlFile  (260, 280, 0x0, 0x0, 0x120003,  (260, 280, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (260, 280, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 01798   808   NtClose  (280, ... ) == 0x0
 01799   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 280, ) == 0x0
 01800   808   NtDeviceIoControlFile  (260, 280, 0x0, 0x0, 0x120003,  (260, 280, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , 36, 348, ... {status=0x0, info=118},  (260, 280, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , ) == 0x0
 01801   808   NtClose  (280, ... ) == 0x0
 01802   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 280, ) == 0x0
 01803   808   NtDeviceIoControlFile  (260, 280, 0x0, 0x0, 0x120003,  (260, 280, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363\222\201\1\0\0\0\5\0\0\0\232A\250\25\307\206F\3)\304\0\0\201\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0w:-\0\364J\0\0\234\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , 36, 348, ... {status=0x0, info=158},  (260, 280, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363\222\201\1\0\0\0\5\0\0\0\232A\250\25\307\206F\3)\304\0\0\201\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0w:-\0\364J\0\0\234\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , ) == 0x0
 01804   808   NtClose  (280, ... ) == 0x0
 01805   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 280, ) == 0x0
 01806   808   NtDeviceIoControlFile  (260, 280, 0x0, 0x0, 0x120003,  (260, 280, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (260, 280, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 01807   808   NtClose  (280, ... ) == 0x0
 01808   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 280, ) == 0x0
 01809   808   NtDeviceIoControlFile  (260, 280, 0x0, 0x0, 0x120003,  (260, 280, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , 36, 4, ... {status=0x0, info=4},  (260, 280, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , ) == 0x0
 01810   808   NtClose  (280, ... ) == 0x0
 01811   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 280, ) == 0x0
 01812   808   NtDeviceIoControlFile  (260, 280, 0x0, 0x0, 0x120003,  (260, 280, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , 36, 8, ... {status=0x0, info=8},  (260, 280, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , ) == 0x0
 01813   808   NtClose  (280, ... ) == 0x0
 01814   808   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 280, ) == 0x0
 01815   808   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 284, ) == 0x0
 01816   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01817   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01818   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01819   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01820   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01821   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01822   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01823   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01824   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01825   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01826   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01827   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01828   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01829   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01830   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01831   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01832   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01833   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01834   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01835   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01836   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01837   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01838   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01839   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01840   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01841   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01842   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01843   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01844   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01845   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01846   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01847   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01848   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01849   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01850   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01851   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01852   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01853   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01854   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01855   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01856   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01857   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01858   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01859   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01860   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01861   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01862   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01863   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01864   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01865   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01866   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01867   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01868   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01869   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01870   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01871   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01872   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01873   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01874   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01875   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01876   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01877   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01878   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01879   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01880   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01881   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01882   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01883   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01884   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01885   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01886   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01887   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01888   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01889   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01890   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01891   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01892   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01893   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01894   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01895   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01896   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01897   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01898   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01899   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01900   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01901   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01902   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01903   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01904   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01905   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01906   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01907   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01908   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01909   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01910   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01911   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01912   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01913   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01914   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01915   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01916   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01917   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01918   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01919   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01920   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01921   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01922   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01923   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01924   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01925   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01926   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01927   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01928   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01929   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01930   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01931   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01932   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01933   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01934   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01935   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01936   808   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 16777216, 65536, ) == 0x0
 01937   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01938   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 1, 4096, 4, ... 16777216, 4096, ) == 0x0
 01939   808   NtQueryVirtualMemory  (-1, 0x1000000, Basic, 28, ... {BaseAddress=0x1000000,AllocationBase=0x1000000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01940   808   NtFreeVirtualMemory  (-1, (0x1000000), 0, 32768, ... (0x1000000), 65536, ) == 0x0
 01941   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Linkage"}, ... 288, ) }, ... 288, ) == 0x0
 01942   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\"}, ... 292, ) }, ... 292, ) == 0x0
 01943   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces"}, ... 296, ) }, ... 296, ) == 0x0
 01944   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters"}, ... 300, ) }, ... 300, ) == 0x0
 01945   808   NtQueryDefaultLocale  (1, 1241580, ... ) == 0x0
 01946   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01947   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "netapi32.dll"}, ... 304, ) }, ... 304, ) == 0x0
 01948   808   NtMapViewOfSection  (304, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0
 01949   808   NtClose  (304, ... ) == 0x0
 01950   808   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01951   808   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01952   808   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01953   808   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01954   808   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01955   808   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01956   808   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01957   808   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01958   808   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01959   808   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01960   808   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01961   808   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01962   808   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01963   808   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01964   808   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01965   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netapi32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01966   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "dnsapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01967   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\dnsapi.dll"}, 1240404, ... ) }, 1240404, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01968   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dnsapi.dll"}, 1240404, ... ) }, 1240404, ... ) == 0x0
 01969   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dnsapi.dll"}, 5, 96, ... 304, {status=0x0, info=1}, ) }, 5, 96, ... 304, {status=0x0, info=1}, ) == 0x0
 01970   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 304, ... 308, ) == 0x0
 01971   808   NtQuerySection  (308, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01972   808   NtClose  (304, ... ) == 0x0
 01973   808   NtMapViewOfSection  (308, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 01974   808   NtClose  (308, ... ) == 0x0
 01975   808   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01976   808   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01977   808   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01978   808   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01979   808   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01980   808   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01981   808   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01982   808   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01983   808   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01984   808   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01985   808   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01986   808   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01987   808   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01988   808   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01989   808   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01990   808   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01991   808   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01992   808   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01993   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dnsapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01994   808   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 308, 2, ) }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 308, 2, ) , 0, ... 308, 2, ) == 0x0
 01995   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 304, ) }, ... 304, ) == 0x0
 01996   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01997   808   NtQueryValueKey  (304,  (304, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01998   808   NtQueryValueKey  (308,  (308, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01999   808   NtQueryValueKey  (304,  (304, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02000   808   NtQueryValueKey  (308,  (308, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (308, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02001   808   NtQueryValueKey  (304,  (304, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02002   808   NtQueryValueKey  (308,  (308, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02003   808   NtQueryValueKey  (304,  (304, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02004   808   NtQueryValueKey  (308,  (308, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02005   808   NtQueryValueKey  (304,  (304, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02006   808   NtQueryValueKey  (304,  (304, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02007   808   NtQueryValueKey  (304,  (304, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02008   808   NtQueryValueKey  (304,  (304, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02009   808   NtQueryValueKey  (304,  (304, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02010   808   NtQueryValueKey  (304,  (304, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02011   808   NtQueryValueKey  (304,  (304, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02012   808   NtQueryValueKey  (304,  (304, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02013   808   NtQueryValueKey  (304,  (304, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02014   808   NtQueryValueKey  (308,  (308, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02015   808   NtQueryValueKey  (304,  (304, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02016   808   NtQueryValueKey  (304,  (304, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02017   808   NtQueryValueKey  (308,  (308, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02018   808   NtQueryValueKey  (304,  (304, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02019   808   NtQueryValueKey  (308,  (308, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02020   808   NtQueryValueKey  (304,  (304, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02021   808   NtQueryValueKey  (308,  (308, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02022   808   NtQueryValueKey  (304,  (304, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02023   808   NtQueryValueKey  (308,  (308, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02024   808   NtQueryValueKey  (304,  (304, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02025   808   NtQueryValueKey  (308,  (308, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02026   808   NtQueryValueKey  (304,  (304, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02027   808   NtQueryValueKey  (308,  (308, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02028   808   NtQueryValueKey  (304,  (304, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02029   808   NtQueryValueKey  (308,  (308, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02030   808   NtQueryValueKey  (304,  (304, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02031   808   NtQueryValueKey  (304,  (304, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02032   808   NtQueryValueKey  (304,  (304, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02033   808   NtQueryValueKey  (304,  (304, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02034   808   NtQueryValueKey  (304,  (304, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02035   808   NtQueryValueKey  (304,  (304, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02036   808   NtQueryValueKey  (304,  (304, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02037   808   NtQueryValueKey  (304,  (304, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02038   808   NtQueryValueKey  (304,  (304, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02039   808   NtQueryValueKey  (304,  (304, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02040   808   NtQueryValueKey  (304,  (304, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02041   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 312, ) }, ... 312, ) == 0x0
 02042   808   NtQueryValueKey  (312,  (312, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02043   808   NtClose  (312, ... ) == 0x0
 02044   808   NtClose  (308, ... ) == 0x0
 02045   808   NtClose  (304, ... ) == 0x0
 02046   808   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 304, ) }, ... 304, ) == 0x0
 02047   808   NtQueryValueKey  (304,  (304, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02048   808   NtQueryValueKey  (304,  (304, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02049   808   NtQueryValueKey  (304,  (304, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02050   808   NtClose  (304, ... ) == 0x0
 02051   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "mpr.dll"}, ... 304, ) }, ... 304, ) == 0x0
 02052   808   NtMapViewOfSection  (304, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 73728, ) == 0x0
 02053   808   NtClose  (304, ... ) == 0x0
 02054   808   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 02055   808   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 02056   808   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 02057   808   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 02058   808   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 02059   808   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 02060   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02061   808   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 304, ) == 0x0
 02062   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 308, ) == 0x0
 02063   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 312, ) }, ... 312, ) == 0x0
 02064   808   NtNotifyChangeKey  (312, 308, 0, 0, 2011455960, 4, 0, 0, 0, 1, ... ) == 0x103
 02065   808   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 02066   808   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 316, ) == 0x0
 02067   808   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 320, ) == 0x0
 02068   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "odbc32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02069   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\odbc32.dll"}, 1240404, ... ) }, 1240404, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02070   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbc32.dll"}, 1240404, ... ) }, 1240404, ... ) == 0x0
 02071   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbc32.dll"}, 5, 96, ... 324, {status=0x0, info=1}, ) }, 5, 96, ... 324, {status=0x0, info=1}, ) == 0x0
 02072   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 324, ... 328, ) == 0x0
 02073   808   NtQuerySection  (328, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02074   808   NtClose  (324, ... ) == 0x0
 02075   808   NtMapViewOfSection  (328, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74320000), 0x0, 249856, ) == 0x0
 02076   808   NtClose  (328, ... ) == 0x0
 02077   808   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02078   808   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02079   808   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02080   808   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02081   808   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02082   808   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02083   808   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02084   808   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02085   808   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02086   808   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02087   808   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02088   808   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02089   808   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02090   808   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02091   808   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02092   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comdlg32.dll"}, ... 328, ) }, ... 328, ) == 0x0
 02093   808   NtMapViewOfSection  (328, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x763b0000), 0x0, 299008, ) == 0x0
 02094   808   NtClose  (328, ... ) == 0x0
 02095   808   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02096   808   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02097   808   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02098   808   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02099   808   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02100   808   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02101   808   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02102   808   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02103   808   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02104   808   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02105   808   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02106   808   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02107   808   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02108   808   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02109   808   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02110   808   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02111   808   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02112   808   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02113   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comdlg32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02114   808   NtUserRegisterWindowMessage  ( ("WOWLFChange", ... ) , ... ) == 0xc06c
 02115   808   NtUserRegisterWindowMessage  ( ("WOWDirChange", ... ) , ... ) == 0xc06d
 02116   808   NtUserRegisterWindowMessage  ( ("WOWCHOOSEFONT_GETLOGFONT", ... ) , ... ) == 0xc06e
 02117   808   NtUserRegisterWindowMessage  ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06f
 02118   808   NtUserRegisterWindowMessage  ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc070
 02119   808   NtUserRegisterWindowMessage  ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc071
 02120   808   NtUserRegisterWindowMessage  ( ("commdlg_ColorOK", ... ) , ... ) == 0xc072
 02121   808   NtUserRegisterWindowMessage  ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc073
 02122   808   NtUserRegisterWindowMessage  ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06f
 02123   808   NtUserRegisterWindowMessage  ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc070
 02124   808   NtUserRegisterWindowMessage  ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc071
 02125   808   NtUserRegisterWindowMessage  ( ("commdlg_ColorOK", ... ) , ... ) == 0xc072
 02126   808   NtUserRegisterWindowMessage  ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc073
 02127   808   NtUserRegisterWindowMessage  ( ("Shell IDList Array", ... ) , ... ) == 0xc074
 02128   808   NtUserRegisterWindowMessage  ( ("commdlg_help", ... ) , ... ) == 0xc075
 02129   808   NtUserRegisterWindowMessage  ( ("commdlg_help", ... ) , ... ) == 0xc075
 02130   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\odbc32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02131   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\BidInterface\Loader"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02132   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\MDAC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02133   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02134   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02135   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02136   808   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 16777216, 262144, ) == 0x0
 02137   808   NtAllocateVirtualMemory  (-1, 16777216, 0, 4096, 4096, 4, ... 16777216, 4096, ) == 0x0
 02138   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02139   808   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 20971520, 262144, ) == 0x0
 02140   808   NtAllocateVirtualMemory  (-1, 20971520, 0, 4096, 4096, 4, ... 20971520, 4096, ) == 0x0
 02141   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02142   808   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 21233664, 262144, ) == 0x0
 02143   808   NtAllocateVirtualMemory  (-1, 21233664, 0, 4096, 4096, 4, ... 21233664, 4096, ) == 0x0
 02144   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02145   808   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 21495808, 262144, ) == 0x0
 02146   808   NtAllocateVirtualMemory  (-1, 21495808, 0, 4096, 4096, 4, ... 21495808, 4096, ) == 0x0
 02147   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02148   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02149   808   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02150   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02151   808   NtAllocateVirtualMemory  (-1, 1449984, 0, 4096, 4096, 4, ... 1449984, 4096, ) == 0x0
 02152   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 1236776, ... ) }, 1236776, ... ) == 0x0
 02153   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 5, 96, ... 328, {status=0x0, info=1}, ) }, 5, 96, ... 328, {status=0x0, info=1}, ) == 0x0
 02154   808   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 328, ... 324, ) == 0x0
 02155   808   NtClose  (328, ... ) == 0x0
 02156   808   NtMapViewOfSection  (324, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1040000), 0x0, 94208, ) == 0x0
 02157   808   NtClose  (324, ... ) == 0x0
 02158   808   NtUnmapViewOfSection  (-1, 0x1040000, ... ) == 0x0
 02159   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 1237084, ... ) }, 1237084, ... ) == 0x0
 02160   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 5, 96, ... 324, {status=0x0, info=1}, ) }, 5, 96, ... 324, {status=0x0, info=1}, ) == 0x0
 02161   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 324, ... 328, ) == 0x0
 02162   808   NtQuerySection  (328, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02163   808   NtClose  (324, ... ) == 0x0
 02164   808   NtMapViewOfSection  (328, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x20000000), 0x0, 94208, ) == 0x0
 02165   808   NtClose  (328, ... ) == 0x0
 02166   808   NtQueryDefaultLocale  (1, 1238916, ... ) == 0x0
 02167   808   NtAllocateVirtualMemory  (-1, 16781312, 0, 4096, 4096, 4, ... 16781312, 4096, ) == 0x0
 02168   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE"}, ... 328, ) }, ... 328, ) == 0x0
 02169   808   NtClose  (328, ... ) == 0x0
 02170   808   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02171   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02172   808   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02173   808   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02174   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\odbcint.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02175   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "avicap32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02176   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\avicap32.dll"}, 1240404, ... ) }, 1240404, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02177   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\avicap32.dll"}, 1240404, ... ) }, 1240404, ... ) == 0x0
 02178   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\avicap32.dll"}, 5, 96, ... 328, {status=0x0, info=1}, ) }, 5, 96, ... 328, {status=0x0, info=1}, ) == 0x0
 02179   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 328, ... 324, ) == 0x0
 02180   808   NtQuerySection  (324, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02181   808   NtClose  (328, ... ) == 0x0
 02182   808   NtMapViewOfSection  (324, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x73b80000), 0x0, 73728, ) == 0x0
 02183   808   NtClose  (324, ... ) == 0x0
 02184   808   NtProtectVirtualMemory  (-1, (0x73b81000), 732, 4, ... (0x73b81000), 4096, 32, ) == 0x0
 02185   808   NtProtectVirtualMemory  (-1, (0x73b81000), 4096, 32, ... (0x73b81000), 4096, 4, ) == 0x0
 02186   808   NtFlushInstructionCache  (-1, 1941442560, 732, ... ) == 0x0
 02187   808   NtProtectVirtualMemory  (-1, (0x73b81000), 732, 4, ... (0x73b81000), 4096, 32, ) == 0x0
 02188   808   NtProtectVirtualMemory  (-1, (0x73b81000), 4096, 32, ... (0x73b81000), 4096, 4, ) == 0x0
 02189   808   NtFlushInstructionCache  (-1, 1941442560, 732, ... ) == 0x0
 02190   808   NtProtectVirtualMemory  (-1, (0x73b81000), 732, 4, ... (0x73b81000), 4096, 32, ) == 0x0
 02191   808   NtProtectVirtualMemory  (-1, (0x73b81000), 4096, 32, ... (0x73b81000), 4096, 4, ) == 0x0
 02192   808   NtFlushInstructionCache  (-1, 1941442560, 732, ... ) == 0x0
 02193   808   NtProtectVirtualMemory  (-1, (0x73b81000), 732, 4, ... (0x73b81000), 4096, 32, ) == 0x0
 02194   808   NtProtectVirtualMemory  (-1, (0x73b81000), 4096, 32, ... (0x73b81000), 4096, 4, ) == 0x0
 02195   808   NtFlushInstructionCache  (-1, 1941442560, 732, ... ) == 0x0
 02196   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINMM.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02197   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINMM.dll"}, 1239588, ... ) }, 1239588, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02198   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINMM.dll"}, 1239588, ... ) }, 1239588, ... ) == 0x0
 02199   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINMM.dll"}, 5, 96, ... 324, {status=0x0, info=1}, ) }, 5, 96, ... 324, {status=0x0, info=1}, ) == 0x0
 02200   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 324, ... 328, ) == 0x0
 02201   808   NtQuerySection  (328, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02202   808   NtClose  (324, ... ) == 0x0
 02203   808   NtMapViewOfSection  (328, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b40000), 0x0, 184320, ) == 0x0
 02204   808   NtClose  (328, ... ) == 0x0
 02205   808   NtProtectVirtualMemory  (-1, (0x76b41000), 860, 4, ... (0x76b41000), 4096, 32, ) == 0x0
 02206   808   NtProtectVirtualMemory  (-1, (0x76b41000), 4096, 32, ... (0x76b41000), 4096, 4, ) == 0x0
 02207   808   NtFlushInstructionCache  (-1, 1991512064, 860, ... ) == 0x0
 02208   808   NtProtectVirtualMemory  (-1, (0x76b41000), 860, 4, ... (0x76b41000), 4096, 32, ) == 0x0
 02209   808   NtProtectVirtualMemory  (-1, (0x76b41000), 4096, 32, ... (0x76b41000), 4096, 4, ) == 0x0
 02210   808   NtFlushInstructionCache  (-1, 1991512064, 860, ... ) == 0x0
 02211   808   NtProtectVirtualMemory  (-1, (0x76b41000), 860, 4, ... (0x76b41000), 4096, 32, ) == 0x0
 02212   808   NtProtectVirtualMemory  (-1, (0x76b41000), 4096, 32, ... (0x76b41000), 4096, 4, ) == 0x0
 02213   808   NtFlushInstructionCache  (-1, 1991512064, 860, ... ) == 0x0
 02214   808   NtProtectVirtualMemory  (-1, (0x76b41000), 860, 4, ... (0x76b41000), 4096, 32, ) == 0x0
 02215   808   NtProtectVirtualMemory  (-1, (0x76b41000), 4096, 32, ... (0x76b41000), 4096, 4, ) == 0x0
 02216   808   NtFlushInstructionCache  (-1, 1991512064, 860, ... ) == 0x0
 02217   808   NtProtectVirtualMemory  (-1, (0x73b81000), 732, 4, ... (0x73b81000), 4096, 32, ) == 0x0
 02218   808   NtProtectVirtualMemory  (-1, (0x73b81000), 4096, 32, ... (0x73b81000), 4096, 4, ) == 0x0
 02219   808   NtFlushInstructionCache  (-1, 1941442560, 732, ... ) == 0x0
 02220   808   NtProtectVirtualMemory  (-1, (0x73b81000), 732, 4, ... (0x73b81000), 4096, 32, ) == 0x0
 02221   808   NtProtectVirtualMemory  (-1, (0x73b81000), 4096, 32, ... (0x73b81000), 4096, 4, ) == 0x0
 02222   808   NtFlushInstructionCache  (-1, 1941442560, 732, ... ) == 0x0
 02223   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "VERSION.dll"}, ... 328, ) }, ... 328, ) == 0x0
 02224   808   NtMapViewOfSection  (328, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 32768, ) == 0x0
 02225   808   NtClose  (328, ... ) == 0x0
 02226   808   NtProtectVirtualMemory  (-1, (0x77c01000), 304, 4, ... (0x77c01000), 4096, 32, ) == 0x0
 02227   808   NtProtectVirtualMemory  (-1, (0x77c01000), 4096, 32, ... (0x77c01000), 4096, 4, ) == 0x0
 02228   808   NtFlushInstructionCache  (-1, 2009075712, 304, ... ) == 0x0
 02229   808   NtProtectVirtualMemory  (-1, (0x73b81000), 732, 4, ... (0x73b81000), 4096, 32, ) == 0x0
 02230   808   NtProtectVirtualMemory  (-1, (0x73b81000), 4096, 32, ... (0x73b81000), 4096, 4, ) == 0x0
 02231   808   NtFlushInstructionCache  (-1, 1941442560, 732, ... ) == 0x0
 02232   808   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVFW32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02233   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\MSVFW32.dll"}, 1239588, ... ) }, 1239588, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02234   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSVFW32.dll"}, 1239588, ... ) }, 1239588, ... ) == 0x0
 02235   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSVFW32.dll"}, 5, 96, ... 328, {status=0x0, info=1}, ) }, 5, 96, ... 328, {status=0x0, info=1}, ) == 0x0
 02236   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 328, ... 324, ) == 0x0
 02237   808   NtQuerySection  (324, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02238   808   NtClose  (328, ... ) == 0x0
 02239   808   NtMapViewOfSection  (324, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 135168, ) == 0x0
 02240   808   NtClose  (324, ... ) == 0x0
 02241   808   NtProtectVirtualMemory  (-1, (0x75a71000), 1008, 4, ... (0x75a71000), 4096, 32, ) == 0x0
 02242   808   NtProtectVirtualMemory  (-1, (0x75a71000), 4096, 32, ... (0x75a71000), 4096, 4, ) == 0x0
 02243   808   NtFlushInstructionCache  (-1, 1973882880, 1008, ... ) == 0x0
 02244   808   NtProtectVirtualMemory  (-1, (0x75a71000), 1008, 4, ... (0x75a71000), 4096, 32, ) == 0x0
 02245   808   NtProtectVirtualMemory  (-1, (0x75a71000), 4096, 32, ... (0x75a71000), 4096, 4, ) == 0x0
 02246   808   NtFlushInstructionCache  (-1, 1973882880, 1008, ... ) == 0x0
 02247   808   NtProtectVirtualMemory  (-1, (0x75a71000), 1008, 4, ... (0x75a71000), 4096, 32, ) == 0x0
 02248   808   NtProtectVirtualMemory  (-1, (0x75a71000), 4096, 32, ... (0x75a71000), 4096, 4, ) == 0x0
 02249   808   NtFlushInstructionCache  (-1, 1973882880, 1008, ... ) == 0x0
 02250   808   NtProtectVirtualMemory  (-1, (0x75a71000), 1008, 4, ... (0x75a71000), 4096, 32, ) == 0x0
 02251   808   NtProtectVirtualMemory  (-1, (0x75a71000), 4096, 32, ... (0x75a71000), 4096, 4, ) == 0x0
 02252   808   NtFlushInstructionCache  (-1, 1973882880, 1008, ... ) == 0x0
 02253   808   NtProtectVirtualMemory  (-1, (0x75a71000), 1008, 4, ... (0x75a71000), 4096, 32, ) == 0x0
 02254   808   NtProtectVirtualMemory  (-1, (0x75a71000), 4096, 32, ... (0x75a71000), 4096, 4, ) == 0x0
 02255   808   NtFlushInstructionCache  (-1, 1973882880, 1008, ... ) == 0x0
 02256   808   NtProtectVirtualMemory  (-1, (0x73b81000), 732, 4, ... (0x73b81000), 4096, 32, ) == 0x0
 02257   808   NtProtectVirtualMemory  (-1, (0x73b81000), 4096, 32, ... (0x73b81000), 4096, 4, ) == 0x0
 02258   808   NtFlushInstructionCache  (-1, 1941442560, 732, ... ) == 0x0
 02259   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINMM.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02260   808   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 324, ) == 0x0
 02261   808   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 328, ) == 0x0
 02262   808   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 332, ) == 0x0
 02263   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32"}, ... 336, ) }, ... 336, ) == 0x0
 02264   808   NtQueryValueKey  (336,  (336, "wave", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "wave", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02265   808   NtAllocateVirtualMemory  (-1, 0, 0, 524280, 8192, 4, ... 21757952, 524288, ) == 0x0
 02266   808   NtAllocateVirtualMemory  (-1, 21757952, 0, 4096, 4096, 4, ... 21757952, 4096, ) == 0x0
 02267   808   NtQueryValueKey  (336,  (336, "wave", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "wave", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02268   808   NtQueryValueKey  (336,  (336, "wave1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "wave1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02269   808   NtQueryValueKey  (336,  (336, "wave1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "wave1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02270   808   NtQueryValueKey  (336,  (336, "wave2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02271   808   NtQueryValueKey  (336,  (336, "wave3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02272   808   NtQueryValueKey  (336,  (336, "wave4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02273   808   NtQueryValueKey  (336,  (336, "wave5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02274   808   NtQueryValueKey  (336,  (336, "wave6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02275   808   NtQueryValueKey  (336,  (336, "wave7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02276   808   NtQueryValueKey  (336,  (336, "wave8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02277   808   NtQueryValueKey  (336,  (336, "wave9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02278   808   NtQueryValueKey  (336,  (336, "midi", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "midi", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02279   808   NtQueryValueKey  (336,  (336, "midi", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "midi", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02280   808   NtQueryValueKey  (336,  (336, "midi1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "midi1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02281   808   NtQueryValueKey  (336,  (336, "midi1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "midi1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02282   808   NtQueryValueKey  (336,  (336, "midi2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02283   808   NtQueryValueKey  (336,  (336, "midi3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02284   808   NtQueryValueKey  (336,  (336, "midi4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02285   808   NtQueryValueKey  (336,  (336, "midi5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02286   808   NtQueryValueKey  (336,  (336, "midi6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02287   808   NtQueryValueKey  (336,  (336, "midi7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02288   808   NtQueryValueKey  (336,  (336, "midi8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02289   808   NtQueryValueKey  (336,  (336, "midi9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02290   808   NtQueryTimerResolution  (... 156250, 10000, 156250, ) == 0x0
 02291   808   NtQueryValueKey  (336,  (336, "aux", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "aux", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02292   808   NtQueryValueKey  (336,  (336, "aux", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "aux", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02293   808   NtQueryValueKey  (336,  (336, "aux1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "aux1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02294   808   NtQueryValueKey  (336,  (336, "aux1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "aux1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02295   808   NtQueryValueKey  (336,  (336, "aux2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02296   808   NtQueryValueKey  (336,  (336, "aux3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02297   808   NtQueryValueKey  (336,  (336, "aux4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02298   808   NtQueryValueKey  (336,  (336, "aux5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02299   808   NtQueryValueKey  (336,  (336, "aux6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02300   808   NtQueryValueKey  (336,  (336, "aux7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02301   808   NtQueryValueKey  (336,  (336, "aux8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02302   808   NtQueryValueKey  (336,  (336, "aux9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02303   808   NtUserRegisterWindowMessage  ( ("MSJSTICK_VJOYD_MSGSTR", ... ) , ... ) == 0xc076
 02304   808   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm"}, ... 340, ) }, ... 340, ) == 0x0
 02305   808   NtQueryValueKey  (340,  (340, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (340, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02306   808   NtClose  (340, ... ) == 0x0
 02307   808   NtCreateEvent  (0x1f0003, {24, 48, 0x80, 0, 0,  (0x1f0003, {24, 48, 0x80, 0, 0, "DINPUTWINMM"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 02308   808   NtQueryValueKey  (336,  (336, "mixer", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "mixer", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02309   808   NtQueryValueKey  (336,  (336, "mixer", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "mixer", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02310   808   NtQueryValueKey  (336,  (336, "mixer1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "mixer1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02311   808   NtQueryValueKey  (336,  (336, "mixer1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) , Partial, 536, ... TitleIdx=0, Type=1, Data= (336, "mixer1", Partial, 536, ... TitleIdx=0, Type=1, Data="w\0d\0m\0a\0u\0d\0.\0d\0r\0v\0\0\0"}, 34, ) }, 34, ) == 0x0
 02312   808   NtQueryValueKey  (336,  (336, "mixer2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02313   808   NtQueryValueKey  (336,  (336, "mixer3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02314   808   NtQueryValueKey  (336,  (336, "mixer4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02315   808   NtQueryValueKey  (336,  (336, "mixer5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02316   808   NtQueryValueKey  (336,  (336, "mixer6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02317   808   NtQueryValueKey  (336,  (336, "mixer7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02318   808   NtQueryValueKey  (336,  (336, "mixer8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02319   808   NtQueryValueKey  (336,  (336, "mixer9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02320   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02321   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVFW32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02322   808   NtQueryDefaultLocale  (1, 1240436, ... ) == 0x0
 02323   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avicap32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02324   808   NtQueryDefaultLocale  (1, 1240440, ... ) == 0x0
 02325   808   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02326   808   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02327   808   NtCreateMutant  (0x1f0001, {24, 48, 0x80, 0, 0,  (0x1f0001, {24, 48, 0x80, 0, 0, "scavertss"}, 0, ... 340, ) }, 0, ... 340, ) == 0x0
 02328   808   NtWaitForSingleObject  (340, 0, {-300000000, -1}, ... ) == 0x0
 02329   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\snduekenk.exe"}, 1242412, ... ) }, 1242412, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02330   808   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241300,  (0x80100080, {24, 0, 0x40, 0, 1241300, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 344, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 344, {status=0x0, info=1}, ) == 0x0
 02331   808   NtQueryInformationFile  (344, 1241736, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 02332   808   NtQueryInformationFile  (344, 1241652, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02333   808   NtQueryInformationFile  (344, 1241468, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02334   808   NtAllocateVirtualMemory  (-1, 1454080, 0, 8192, 4096, 4, ... 1454080, 8192, ) == 0x0
 02335   808   NtQueryInformationFile  (344, 1450440, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 02336   808   NtQueryInformationFile  (344, 1239916, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02337   808   NtQueryInformationFile  (344, 1240192, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 02338   808   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240068,  (0x40110080, {24, 0, 0x40, 0, 1240068, "\??\C:\WINDOWS\system32\snduekenk.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 02339   808   NtClose  (-2147482576, ... ) == 0x0
 02338   808   NtCreateFile  ... 348, {status=0x0, info=2}, ) == 0x0
 02340   808   NtQueryVolumeInformationFile  (348, 1240220, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 02341   808   NtQueryInformationFile  (348, 1239804, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02342   808   NtQueryVolumeInformationFile  (344, 1240220, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 02343   808   NtQueryVolumeInformationFile  (344, 1239564, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02344   808   NtSetInformationFile  (348, 1240120, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02345   808   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 344, ... 352, ) == 0x0
 02346   808   NtMapViewOfSection  (352, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x1540000), {0, 0}, 233472, ) == 0x0
 02347   808   NtClose  (352, ... ) == 0x0
 02348   808   NtWriteFile  (348, 0, 0, 0,  (348, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\7\0\357v\24:\0\0\0\0\0\0\0\0\340\0\17\1\13\1\1)\0 \14\0\0d\13\0\0\0\0\0\362\22\0\0\0\20\0\0\0\200\2\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\1\0\10\0\4\0\0\0\0\0\0\0\0\260G\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\20\0\0\0\20\0\0\3254\16rO\36\10\4\0\0\0\0\0\0\0\0\11iG\0\254E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\235\256G\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 02349   808   NtWriteFile  (348, 0, 0, 0,  (348, 0, 0, 0, "\245\362\364\230I$G\244{\205\215\247=Dt{raem\337\22\310\254\347d\302[\373\37\212 \365\230Y1\14\22\234\336\300E\32\377\177\254\13\243F`\231 \370+#\231B\356JfM^\14\37\253\30\2%"\27T\15I\372F\256S\353\252\340\276\306\3225\12\200"\12jZ\V\242_\24\242\347\2\22\200\\266\5\243\240\360[\206KtT\37pK\322\220\10D\270\27^\6;\274e\34\256\22\201\315\32\16\252cq\r\205\324\230\301<\201\341\241\332Z\345\312Q\203\353]\227~\323C\353\30\223}\582\\334^.\255Y\311\377dNl\217\2149P\24t7\271\247\313\224\11\316\374M9\232!\234\2331\2101\343A\202=\177\21\271a\21\241)\245I\257\21\255\365\30O\223Nw9\16#\302'\250NX\261\305\221z\254K\207iB\242\210\257C\206\27p\2015\33\350\303\342[\244\222;\235\272\233\31\5&\24\270^\26\5o\343a\224\3610\331\35I\26\3135\364\311+\221\344\264\26%4\332\352uBK\27\216\334;\201\321(b\336\241\332~\330!\320Q\10\350\27\16\230r\5\252\247\2760\225\177,\11\2\312[\24QF\356s\232\352R\333\227(\332U\227*\30&\273\27\21\210\316\217\14\0\32\303\234\230/\261\207\335\1\236\262"\265\207\205\324\362\304\210V$w\325?>58\225\21\200q\15\243\257\310\3342Vz\223\330du\341\221x\33661\2105^J+I\306w\322T\227(\35\302\224\341\311~\3566\331\315\241Ch\0\276\312JLH\371\202(\334?\3\256o\217\262\264l\265\342\301\362",\370\250\313\242\273\274, 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \27T\15I\372F\256S\353\252\340\276\306\3225\12\200 (348, 0, 0, 0, "\245\362\364\230I$G\244{\205\215\247=Dt{raem\337\22\310\254\347d\302[\373\37\212 \365\230Y1\14\22\234\336\300E\32\377\177\254\13\243F`\231 \370+#\231B\356JfM^\14\37\253\30\2%"\27T\15I\372F\256S\353\252\340\276\306\3225\12\200"\12jZ\V\242_\24\242\347\2\22\200\\266\5\243\240\360[\206KtT\37pK\322\220\10D\270\27^\6;\274e\34\256\22\201\315\32\16\252cq\r\205\324\230\301<\201\341\241\332Z\345\312Q\203\353]\227~\323C\353\30\223}\582\\334^.\255Y\311\377dNl\217\2149P\24t7\271\247\313\224\11\316\374M9\232!\234\2331\2101\343A\202=\177\21\271a\21\241)\245I\257\21\255\365\30O\223Nw9\16#\302'\250NX\261\305\221z\254K\207iB\242\210\257C\206\27p\2015\33\350\303\342[\244\222;\235\272\233\31\5&\24\270^\26\5o\343a\224\3610\331\35I\26\3135\364\311+\221\344\264\26%4\332\352uBK\27\216\334;\201\321(b\336\241\332~\330!\320Q\10\350\27\16\230r\5\252\247\2760\225\177,\11\2\312[\24QF\356s\232\352R\333\227(\332U\227*\30&\273\27\21\210\316\217\14\0\32\303\234\230/\261\207\335\1\236\262"\265\207\205\324\362\304\210V$w\325?>58\225\21\200q\15\243\257\310\3342Vz\223\330du\341\221x\33661\2105^J+I\306w\322T\227(\35\302\224\341\311~\3566\331\315\241Ch\0\276\312JLH\371\202(\334?\3\256o\217\262\264l\265\342\301\362",\370\250\313\242\273\274, 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \265\207\205\324\362\304\210V$w\325?>58\225\21\200q\15\243\257\310\3342Vz\223\330du\341\221x\33661\2105^J+I\306w\322T\227(\35\302\224\341\311~\3566\331\315\241Ch\0\276\312JLH\371\202(\334?\3\256o\217\262\264l\265\342\301\362 (348, 0, 0, 0, "\245\362\364\230I$G\244{\205\215\247=Dt{raem\337\22\310\254\347d\302[\373\37\212 \365\230Y1\14\22\234\336\300E\32\377\177\254\13\243F`\231 \370+#\231B\356JfM^\14\37\253\30\2%"\27T\15I\372F\256S\353\252\340\276\306\3225\12\200"\12jZ\V\242_\24\242\347\2\22\200\\266\5\243\240\360[\206KtT\37pK\322\220\10D\270\27^\6;\274e\34\256\22\201\315\32\16\252cq\r\205\324\230\301<\201\341\241\332Z\345\312Q\203\353]\227~\323C\353\30\223}\582\\334^.\255Y\311\377dNl\217\2149P\24t7\271\247\313\224\11\316\374M9\232!\234\2331\2101\343A\202=\177\21\271a\21\241)\245I\257\21\255\365\30O\223Nw9\16#\302'\250NX\261\305\221z\254K\207iB\242\210\257C\206\27p\2015\33\350\303\342[\244\222;\235\272\233\31\5&\24\270^\26\5o\343a\224\3610\331\35I\26\3135\364\311+\221\344\264\26%4\332\352uBK\27\216\334;\201\321(b\336\241\332~\330!\320Q\10\350\27\16\230r\5\252\247\2760\225\177,\11\2\312[\24QF\356s\232\352R\333\227(\332U\227*\30&\273\27\21\210\316\217\14\0\32\303\234\230/\261\207\335\1\236\262"\265\207\205\324\362\304\210V$w\325?>58\225\21\200q\15\243\257\310\3342Vz\223\330du\341\221x\33661\2105^J+I\306w\322T\227(\35\302\224\341\311~\3566\331\315\241Ch\0\276\312JLH\371\202(\334?\3\256o\217\262\264l\265\342\301\362",\370\250\313\242\273\274, 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 02350   808   NtWriteFile  (348, 0, 0, 0,  (348, 0, 0, 0, "\270\245\11Y\311\234\351\272c\332\31\370\6\313;N\5\33m\32\307\225q\346\311\201N09`\325\30\237\320=\277\254\372/2\215\272i\205_=\304\350\266\347\242\7\277\231\253\14;!\216a*\377J\363;\362R\330\315\241\334\263\1|\243\302\34_3\227R\33\21\212\351k{\337\205\25\33=\272\34t\353\276\344\31\360\36\12\264\3367^HKX\273y\6\311\356\211;\356\7\344C\355\241\200\312A\273\356\334\306S`[\36I\227Cd^X)\266"D\201\200\33\244j\305(S\236\327\321\344\2738\330$k\345Ui\323\26\24\2308\11hT\5\320j\36=KT\342\360\351\00\200\270\301*\317&\306\6u\\350\332aHY\334\260?\11\376\276\323\307b\217R*A\352\257\213t\203&\307\342\202\206t\211\237\314\321\\344\330\345\210\222xx<\177"C\374*II\302h\366\277\261\246\274\332\245\20iv\344,\325\330\345\246\10\36"\276\35\304P\2175\332k\336\260\311F\20\221u\311lR\27\221\232\357\223@\237D\243\233r\244\5osX<\261>\353\2\267\236\204\1cu\10\251\244\326;K\320J\323\15zi\223\331\27@)P\263]-\272\37V\216\365g(\211\360Pf\7\333\236?\2\304B3\362\257J\210/\277Ti\270\365C\0\375\253\260\316\203\365%\304\355\2422W\14r\206\233\4\33\224\326\250\203\372\35\305\315\232;}\260G\310\202V\331E\326\246\324@\214\234\304\325\370\267W\3125Ei\374\30yO\\277~\12\352\356s\304\208\177c$Uc{'\344O \25\17U\3129\244\353w\356\364}\27\254,\261}~\250g\227\346\212\347\316\371;\24l7.\340\311w\236\243\336\25\264\7~\352}]\270\215\240\270\227\21\222Is\4.Q\216\375\25u\242\333\344\370w", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) D\201\200\33\244j\305(S\236\327\321\344\2738\330$k\345Ui\323\26\24\2308\11hT\5\320j\36=KT\342\360\351\00\200\270\301*\317&\306\6u\\350\332aHY\334\260?\11\376\276\323\307b\217R*A\352\257\213t\203&\307\342\202\206t\211\237\314\321\\344\330\345\210\222xx<\177 (348, 0, 0, 0, "\270\245\11Y\311\234\351\272c\332\31\370\6\313;N\5\33m\32\307\225q\346\311\201N09`\325\30\237\320=\277\254\372/2\215\272i\205_=\304\350\266\347\242\7\277\231\253\14;!\216a*\377J\363;\362R\330\315\241\334\263\1|\243\302\34_3\227R\33\21\212\351k{\337\205\25\33=\272\34t\353\276\344\31\360\36\12\264\3367^HKX\273y\6\311\356\211;\356\7\344C\355\241\200\312A\273\356\334\306S`[\36I\227Cd^X)\266"D\201\200\33\244j\305(S\236\327\321\344\2738\330$k\345Ui\323\26\24\2308\11hT\5\320j\36=KT\342\360\351\00\200\270\301*\317&\306\6u\\350\332aHY\334\260?\11\376\276\323\307b\217R*A\352\257\213t\203&\307\342\202\206t\211\237\314\321\\344\330\345\210\222xx<\177"C\374*II\302h\366\277\261\246\274\332\245\20iv\344,\325\330\345\246\10\36"\276\35\304P\2175\332k\336\260\311F\20\221u\311lR\27\221\232\357\223@\237D\243\233r\244\5osX<\261>\353\2\267\236\204\1cu\10\251\244\326;K\320J\323\15zi\223\331\27@)P\263]-\272\37V\216\365g(\211\360Pf\7\333\236?\2\304B3\362\257J\210/\277Ti\270\365C\0\375\253\260\316\203\365%\304\355\2422W\14r\206\233\4\33\224\326\250\203\372\35\305\315\232;}\260G\310\202V\331E\326\246\324@\214\234\304\325\370\267W\3125Ei\374\30yO\\277~\12\352\356s\304\208\177c$Uc{'\344O \25\17U\3129\244\353w\356\364}\27\254,\261}~\250g\227\346\212\347\316\371;\24l7.\340\311w\236\243\336\25\264\7~\352}]\270\215\240\270\227\21\222Is\4.Q\216\375\25u\242\333\344\370w", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \276\35\304P\2175\332k\336\260\311F\20\221u\311lR\27\221\232\357\223@\237D\243\233r\244\5osX<\261>\353\2\267\236\204\1cu\10\251\244\326;K\320J\323\15zi\223\331\27@)P\263]-\272\37V\216\365g(\211\360Pf\7\333\236?\2\304B3\362\257J\210/\277Ti\270\365C\0\375\253\260\316\203\365%\304\355\2422W\14r\206\233\4\33\224\326\250\203\372\35\305\315\232;}\260G\310\202V\331E\326\246\324@\214\234\304\325\370\267W\3125Ei\374\30yO\\277~\12\352\356s\304\208\177c$Uc{'\344O \25\17U\3129\244\353w\356\364}\27\254,\261}~\250g\227\346\212\347\316\371;\24l7.\340\311w\236\243\336\25\264\7~\352}]\270\215\240\270\227\21\222Is\4.Q\216\375\25u\242\333\344\370w", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 02351   808   NtWriteFile  (348, 0, 0, 0,  (348, 0, 0, 0, "K\105\222\274R\333\367#\230\375\306F\237\22v\327\226\254\331\351yW!j\5\301\31\254\317\201\275U\273}\235S+E\203\344$\354\204\216\5\353\20h\352*.C\275\203Z\300\26M\0\373\321\221i\327\254\223\365\350\1|\336\331=\23\337\221\311`\253\277u\233nY\\306_^iSn\302t\232F\31I\377\205\24s\364\7\1\225M\0b\303\12\231\376:>B2\277WQ\310\326\332\10\355-z\317\252\33\321\10\13\256\221|\216\363\20\230xdw\307\300\373i^\314\35\217\326\350\230\5\346\313\342\200\347\345:"Nkl`\243\273\215\304S\15m\270\36\316i\335\317{5\346d\234\274\240\5\301\26\232Q\331\246\31\227cZ\307DrTE\217\222\10n\14\327\252\251{n\206gm\321\276\0\277\3<\321\20\357\260\313\35\343s\255(\270\312\377|\355k@\325\233u\5\7\366\246l\246N:-pCES\216\33W\276\177\323d\354\5LC0\17\325\234\215\335BN\26\261m3|X\207|\227\201\240!\331\260x\\261)\362\307\214\21\22mj\233\314M"\321$(\361<\267\302\317\260\12\343\334\343\236q\22\255\233G\32\342MK\322\335=\221\344\200\224\26\210\337\272k\347\345\354\352\7]B\335v\264\301\241\300\252r\374\6\36\2203\37\10v\256\246\245\255\327\244j\213\240\357\330\220\366\312\305\220d\202\316aZ+\374Z\246\32Z@\23#\273\334\267D\11\367\360\14\270\277\252\242\203?CL\361)6p\305\202\323S\4Y\226\20\247z\366\210\210:d\266dyT\320\35\227p\337HL\255\225\222\4\305\342\244,)v\25\327r\237\207\257=\226L*\21[I\222\344\347L\316\204&\204\12gpK\250\17\22.\376\374\3\242\357\355\337-\32\2673\266\324\34\264\210\272\376\240\4\20H\30o", 48128, 0x0, 0, ... {status=0x0, info=48128}, ) Nkl`\243\273\215\304S\15m\270\36\316i\335\317{5\346d\234\274\240\5\301\26\232Q\331\246\31\227cZ\307DrTE\217\222\10n\14\327\252\251{n\206gm\321\276\0\277\3<\321\20\357\260\313\35\343s\255(\270\312\377|\355k@\325\233u\5\7\366\246l\246N:-pCES\216\33W\276\177\323d\354\5LC0\17\325\234\215\335BN\26\261m3|X\207|\227\201\240!\331\260x\\261)\362\307\214\21\22mj\233\314M (348, 0, 0, 0, "K\105\222\274R\333\367#\230\375\306F\237\22v\327\226\254\331\351yW!j\5\301\31\254\317\201\275U\273}\235S+E\203\344$\354\204\216\5\353\20h\352*.C\275\203Z\300\26M\0\373\321\221i\327\254\223\365\350\1|\336\331=\23\337\221\311`\253\277u\233nY\\306_^iSn\302t\232F\31I\377\205\24s\364\7\1\225M\0b\303\12\231\376:>B2\277WQ\310\326\332\10\355-z\317\252\33\321\10\13\256\221|\216\363\20\230xdw\307\300\373i^\314\35\217\326\350\230\5\346\313\342\200\347\345:"Nkl`\243\273\215\304S\15m\270\36\316i\335\317{5\346d\234\274\240\5\301\26\232Q\331\246\31\227cZ\307DrTE\217\222\10n\14\327\252\251{n\206gm\321\276\0\277\3<\321\20\357\260\313\35\343s\255(\270\312\377|\355k@\325\233u\5\7\366\246l\246N:-pCES\216\33W\276\177\323d\354\5LC0\17\325\234\215\335BN\26\261m3|X\207|\227\201\240!\331\260x\\261)\362\307\214\21\22mj\233\314M"\321$(\361<\267\302\317\260\12\343\334\343\236q\22\255\233G\32\342MK\322\335=\221\344\200\224\26\210\337\272k\347\345\354\352\7]B\335v\264\301\241\300\252r\374\6\36\2203\37\10v\256\246\245\255\327\244j\213\240\357\330\220\366\312\305\220d\202\316aZ+\374Z\246\32Z@\23#\273\334\267D\11\367\360\14\270\277\252\242\203?CL\361)6p\305\202\323S\4Y\226\20\247z\366\210\210:d\266dyT\320\35\227p\337HL\255\225\222\4\305\342\244,)v\25\327r\237\207\257=\226L*\21[I\222\344\347L\316\204&\204\12gpK\250\17\22.\376\374\3\242\357\355\337-\32\2673\266\324\34\264\210\272\376\240\4\20H\30o", 48128, 0x0, 0, ... {status=0x0, info=48128}, ) , 48128, 0x0, 0, ... {status=0x0, info=48128}, ) == 0x0
 02352   808   NtUnmapViewOfSection  (-1, 0x1540000, ... ) == 0x0
 02353   808   NtSetInformationFile  (348, 1241468, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02354   808   NtClose  (344, ... ) == 0x0
 02355   808   NtClose  (348, ... ) == 0x0
 02356   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\explorer.exe"}, 1241288, ... ) }, 1241288, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02357   808   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "explorer.exe"}, 1241288, ... ) }, 1241288, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02358   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\explorer.exe"}, 1241288, ... ) }, 1241288, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02359   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\explorer.exe"}, 1241288, ... ) }, 1241288, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02360   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\explorer.exe"}, 1241288, ... ) }, 1241288, ... ) == 0x0
 02361   808   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1242088,  (0x80100080, {24, 0, 0x40, 0, 1242088, "\??\C:\WINDOWS\explorer.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 348, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 348, {status=0x0, info=1}, ) == 0x0
 02362   808   NtQueryInformationFile  (348, 1242140, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02363   808   NtClose  (348, ... ) == 0x0
 02364   808   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1242088,  (0x40100080, {24, 0, 0x40, 0, 1242088, "\??\C:\WINDOWS\system32\snduekenk.exe"}, 0x0, 128, 2, 1, 96, 0, 0, ... 348, {status=0x0, info=1}, ) }, 0x0, 128, 2, 1, 96, 0, 0, ... 348, {status=0x0, info=1}, ) == 0x0
 02365   808   NtSetInformationFile  (348, 1242140, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02366   808   NtClose  (348, ... ) == 0x0
 02367   808   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\snduekenk.exe"}, 7, 2113568, ... 348, {status=0x0, info=1}, ) }, 7, 2113568, ... 348, {status=0x0, info=1}, ) == 0x0
 02368   808   NtSetInformationFile  (348, 1242388, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02369   808   NtClose  (348, ... ) == 0x0
 02370   808   NtOpenProcess  (0x100000, {24, 0, 0x2, 0, 0, 0x0}, {868, 0}, ... 348, ) == 0x0
 02371   808   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 02372   808   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\snduekenk.exe"}, 5, 96, ... 344, {status=0x0, info=1}, ) }, 5, 96, ... 344, {status=0x0, info=1}, ) == 0x0
 02373   808   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 344, ... 352, ) == 0x0
 02374   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02375   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 356, ) }, ... 356, ) == 0x0
 02376   808   NtQueryValueKey  (356,  (356, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02377   808   NtClose  (356, ... ) == 0x0
 02378   808   NtQueryVolumeInformationFile  (344, 1238764, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02379   808   NtOpenMutant  (0x120001, {24, 48, 0x0, 0, 0,  (0x120001, {24, 48, 0x0, 0, 0, "ShimCacheMutex"}, ... 356, ) }, ... 356, ) == 0x0
 02380   808   NtWaitForSingleObject  (356, 0, {-1000000, -1}, ... ) == 0x0
 02381   808   NtOpenSection  (0x2, {24, 48, 0x0, 0, 0,  (0x2, {24, 48, 0x0, 0, 0, "ShimSharedMemory"}, ... 360, ) }, ... 360, ) == 0x0
 02382   808   NtMapViewOfSection  (360, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1040000), {0, 0}, 57344, ) == 0x0
 02383   808   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 02384   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1236696, ... ) }, 1236696, ... ) == 0x0
 02385   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0
 02386   808   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 364, ... 368, ) == 0x0
 02387   808   NtClose  (364, ... ) == 0x0
 02388   808   NtMapViewOfSection  (368, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1540000), 0x0, 126976, ) == 0x0
 02389   808   NtClose  (368, ... ) == 0x0
 02390   808   NtUnmapViewOfSection  (-1, 0x1540000, ... ) == 0x0
 02391   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1237004, ... ) }, 1237004, ... ) == 0x0
 02392   808   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 368, {status=0x0, info=1}, ) }, 5, 96, ... 368, {status=0x0, info=1}, ) == 0x0
 02393   808   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 368, ... 364, ) == 0x0
 02394   808   NtQuerySection  (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02395   808   NtClose  (368, ... ) == 0x0
 02396   808   NtMapViewOfSection  (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 02397   808   NtClose  (364, ... ) == 0x0
 02398   808   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 02399   808   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 02400   808   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 02401   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02402   808   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 364, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 364, {status=0x0, info=1}, ) == 0x0
 02403   808   NtQueryInformationFile  (364, 1237020, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02404   808   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 364, ... 368, ) == 0x0
 02405   808   NtMapViewOfSection  (368, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1540000), 0x0, 1191936, ) == 0x0
 02406   808   NtQueryInformationFile  (364, 1237120, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02407   808   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02408   808   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02409   808   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02410   808   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02411   808   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 372, ) }, ... 372, ) == 0x0
 02412   808   NtQueryValueKey  (372,  (372, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (372, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02413   808   NtClose  (372, ... ) == 0x0
 02414   808   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02415   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 372, {status=0x0, info=1}, ) }, 3, 16417, ... 372, {status=0x0, info=1}, ) == 0x0
 02416   808   NtQueryDirectoryFile  (372, 0, 0, 0, 1234716, 616, BothDirectory, 1,  (372, 0, 0, 0, 1234716, 616, BothDirectory, 1, "snduekenk.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0
 02417   808   NtClose  (372, ... ) == 0x0
 02418   808   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02419   808   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02420   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\snduekenk.exe"}, 1235092, ... ) }, 1235092, ... ) == 0x0
 02421   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 372, {status=0x0, info=1}, ) }, 3, 16417, ... 372, {status=0x0, info=1}, ) == 0x0
 02422   808   NtQueryDirectoryFile  (372, 0, 0, 0, 1234520, 616, BothDirectory, 1,  (372, 0, 0, 0, 1234520, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02423   808   NtClose  (372, ... ) == 0x0
 02424   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 372, {status=0x0, info=1}, ) }, 3, 16417, ... 372, {status=0x0, info=1}, ) == 0x0
 02425   808   NtQueryDirectoryFile  (372, 0, 0, 0, 1234520, 616, BothDirectory, 1,  (372, 0, 0, 0, 1234520, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02426   808   NtClose  (372, ... ) == 0x0
 02427   808   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02428   808   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02429   808   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02430   808   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02431   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02432   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 372, ) == 0x0
 02433   808   NtQueryInformationToken  (372, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02434   808   NtClose  (372, ... ) == 0x0
 02435   808   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02436   808   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\snduekenk.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02437   808   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02438   808   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02439   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\snduekenk.exe"}, 1236344, ... ) }, 1236344, ... ) == 0x0
 02440   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 372, {status=0x0, info=1}, ) }, 3, 16417, ... 372, {status=0x0, info=1}, ) == 0x0
 02441   808   NtQueryDirectoryFile  (372, 0, 0, 0, 1235772, 616, BothDirectory, 1,  (372, 0, 0, 0, 1235772, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02442   808   NtClose  (372, ... ) == 0x0
 02443   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 372, {status=0x0, info=1}, ) }, 3, 16417, ... 372, {status=0x0, info=1}, ) == 0x0
 02444   808   NtQueryDirectoryFile  (372, 0, 0, 0, 1235772, 616, BothDirectory, 1,  (372, 0, 0, 0, 1235772, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02445   808   NtClose  (372, ... ) == 0x0
 02446   808   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02447   808   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02448   808   NtWaitForSingleObject  (356, 0, {-1000000, -1}, ... ) == 0x0
 02449   808   NtQueryVolumeInformationFile  (344, 1237000, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02450   808   NtQueryInformationFile  (344, 1236980, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02451   808   NtQueryInformationFile  (344, 1237020, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02452   808   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 02453   808   NtUnmapViewOfSection  (-1, 0x1540000, ... ) == 0x0
 02454   808   NtClose  (368, ... ) == 0x0
 02455   808   NtClose  (364, ... ) == 0x0
 02456   808   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 02457   808   NtOpenProcessToken  (-1, 0xa, ... 364, ) == 0x0
 02458   808   NtQueryInformationToken  (364, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 02459   808   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02460   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 368, ) }, ... 368, ) == 0x0
 02461   808   NtQueryValueKey  (368,  (368, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (368, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02462   808   NtQueryValueKey  (368,  (368, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (368, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02463   808   NtClose  (368, ... ) == 0x0
 02464   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02465   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 368, ) }, ... 368, ) == 0x0
 02466   808   NtQueryValueKey  (368,  (368, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02467   808   NtClose  (368, ... ) == 0x0
 02468   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02469   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02470   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02471   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02472   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02473   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02474   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02475   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02476   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02477   808   NtQueryDefaultLocale  (1, 1238192, ... ) == 0x0
 02478   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 368, ) }, ... 368, ) == 0x0
 02479   808   NtEnumerateKey  (368, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (368, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 02480   808   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 372, ) }, ... 372, ) == 0x0
 02481   808   NtQueryValueKey  (372,  (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 02482   808   NtQueryValueKey  (372,  (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02483   808   NtClose  (372, ... ) == 0x0
 02484   808   NtEnumerateKey  (368, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 02485   808   NtClose  (368, ... ) == 0x0
 02486   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 368, ) }, ... 368, ) == 0x0
 02487   808   NtEnumerateKey  (368, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (368, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 02488   808   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 372, ) }, ... 372, ) == 0x0
 02489   808   NtQueryValueKey  (372,  (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 02490   808   NtQueryValueKey  (372,  (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02491   808   NtQueryValueKey  (372,  (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02492   808   NtQueryValueKey  (372,  (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02493   808   NtClose  (372, ... ) == 0x0
 02494   808   NtEnumerateKey  (368, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (368, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 02495   808   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 372, ) }, ... 372, ) == 0x0
 02496   808   NtQueryValueKey  (372,  (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 02497   808   NtQueryValueKey  (372,  (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02498   808   NtQueryValueKey  (372,  (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02499   808   NtQueryValueKey  (372,  (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02500   808   NtClose  (372, ... ) == 0x0
 02501   808   NtEnumerateKey  (368, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (368, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 02502   808   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 372, ) }, ... 372, ) == 0x0
 02503   808   NtQueryValueKey  (372,  (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 02504   808   NtQueryValueKey  (372,  (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02505   808   NtQueryValueKey  (372,  (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02506   808   NtQueryValueKey  (372,  (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02507   808   NtClose  (372, ... ) == 0x0
 02508   808   NtEnumerateKey  (368, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (368, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 02509   808   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 372, ) }, ... 372, ) == 0x0
 02510   808   NtQueryValueKey  (372,  (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 02511   808   NtQueryValueKey  (372,  (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02512   808   NtQueryValueKey  (372,  (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02513   808   NtQueryValueKey  (372,  (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02514   808   NtClose  (372, ... ) == 0x0
 02515   808   NtEnumerateKey  (368, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (368, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 02516   808   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 372, ) }, ... 372, ) == 0x0
 02517   808   NtQueryValueKey  (372,  (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (372, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 02518   808   NtQueryValueKey  (372,  (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02519   808   NtQueryValueKey  (372,  (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (372, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02520   808   NtQueryValueKey  (372,  (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (372, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02521   808   NtClose  (372, ... ) == 0x0
 02522   808   NtEnumerateKey  (368, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 02523   808   NtClose  (368, ... ) == 0x0
 02524   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02525   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02526   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02527   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02528   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02529   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02530   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02531   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02532   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02533   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02534   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02535   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02536   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02537   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02538   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02539   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02540   808   NtClose  (368, ... ) == 0x0
 02541   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02542   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02543   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02544   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02545   808   NtClose  (368, ... ) == 0x0
 02546   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02547   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02548   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02549   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02550   808   NtClose  (368, ... ) == 0x0
 02551   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02552   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02553   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02554   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02555   808   NtClose  (368, ... ) == 0x0
 02556   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02557   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02558   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02559   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02560   808   NtClose  (368, ... ) == 0x0
 02561   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02562   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02563   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02564   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02565   808   NtClose  (368, ... ) == 0x0
 02566   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02567   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02568   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02569   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02570   808   NtClose  (368, ... ) == 0x0
 02571   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02572   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02573   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02574   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02575   808   NtClose  (368, ... ) == 0x0
 02576   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02577   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02578   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02579   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02580   808   NtClose  (368, ... ) == 0x0
 02581   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02582   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02583   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02584   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02585   808   NtClose  (368, ... ) == 0x0
 02586   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02587   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02588   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02589   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02590   808   NtClose  (368, ... ) == 0x0
 02591   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02592   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02593   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02594   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02595   808   NtClose  (368, ... ) == 0x0
 02596   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02597   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02598   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02599   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02600   808   NtClose  (368, ... ) == 0x0
 02601   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02602   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02603   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02604   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02605   808   NtClose  (368, ... ) == 0x0
 02606   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02607   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02608   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02609   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02610   808   NtClose  (368, ... ) == 0x0
 02611   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02612   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 368, ) }, ... 368, ) == 0x0
 02613   808   NtQueryValueKey  (368,  (368, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (368, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (368, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 02614   808   NtClose  (368, ... ) == 0x0
 02615   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02616   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 368, ) == 0x0
 02617   808   NtQueryInformationToken  (368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02618   808   NtClose  (368, ... ) == 0x0
 02619   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02620   808   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 02621   808   NtOpenProcessToken  (-1, 0xa, ... 368, ) == 0x0
 02622   808   NtDuplicateToken  (368, 0xc, {24, 0, 0x0, 0, 1238624, 0x0}, 0, 2, ... 372, ) == 0x0
 02623   808   NtClose  (368, ... ) == 0x0
 02624   808   NtAccessCheck  (1458512, 372, 0x1, 1238700, 1238752, 56, 1238732, ... (0x1), ) == 0x0
 02625   808   NtClose  (372, ... ) == 0x0
 02626   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 372, ) }, ... 372, ) == 0x0
 02627   808   NtQueryValueKey  (372,  (372, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (372, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02628   808   NtClose  (372, ... ) == 0x0
 02629   808   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 372, ) }, ... 372, ) == 0x0
 02630   808   NtQuerySymbolicLinkObject  (372, ...  (372, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 02631   808   NtClose  (372, ... ) == 0x0
 02632   808   NtQueryVolumeInformationFile  (344, 1236456, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02633   808   NtQueryInformationFile  (344, 1236572, 528, Name, ... {status=0x0, info=66}, ) == 0x0
 02634   808   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02635   808   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02636   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\snduekenk.exe"}, 1235744, ... ) }, 1235744, ... ) == 0x0
 02637   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 372, {status=0x0, info=1}, ) }, 3, 16417, ... 372, {status=0x0, info=1}, ) == 0x0
 02638   808   NtQueryDirectoryFile  (372, 0, 0, 0, 1235172, 616, BothDirectory, 1,  (372, 0, 0, 0, 1235172, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02639   808   NtClose  (372, ... ) == 0x0
 02640   808   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 372, {status=0x0, info=1}, ) }, 3, 16417, ... 372, {status=0x0, info=1}, ) == 0x0
 02641   808   NtQueryDirectoryFile  (372, 0, 0, 0, 1235172, 616, BothDirectory, 1,  (372, 0, 0, 0, 1235172, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02642   808   NtClose  (372, ... ) == 0x0
 02643   808   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02644   808   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02645   808   NtQueryInformationFile  (344, 1238612, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02646   808   NtCreateSection  (0xf0005, 0x0, {232448, 0}, 2, 134217728, 344, ... 372, ) == 0x0
 02647   808   NtMapViewOfSection  (372, -1, (0x0), 0, 0, {0, 0}, 232448, 1, 0, 2, ... (0x1540000), {0, 0}, 233472, ) == 0x0
 02648   808   NtClose  (372, ... ) == 0x0
 02649   808   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02650   808   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 372, ) == 0x0
 02651   808   NtQueryInformationToken  (372, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02652   808   NtClose  (372, ... ) == 0x0
 02653   808   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 372, ) }, ... 372, ) == 0x0
 02654   808   NtOpenKey  (0x20019, {24, 372, 0x40, 0, 0,  (0x20019, {24, 372, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 368, ) }, ... 368, ) == 0x0
 02655   808   NtClose  (372, ... ) == 0x0
 02656   808   NtQueryValueKey  (368,  (368, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02657   808   NtQueryValueKey  (368,  (368, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (368, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 02658   808   NtClose  (368, ... ) == 0x0
 02659   808   NtUnmapViewOfSection  (-1, 0x1540000, ... ) == 0x0
 02660   808   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 17104896, 4096, ) == 0x0
 02661   808   NtAllocateVirtualMemory  (-1, 17104896, 0, 4096, 4096, 4, ... 17104896, 4096, ) == 0x0
 02662   808   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 368, ) }, ... 368, ) == 0x0
 02663   808   NtQueryValueKey  (368,  (368, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02664   808   NtClose  (368, ... ) == 0x0
 02665   808   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02666   808   NtQueryInformationToken  (364, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 02667   808   NtQueryInformationToken  (364, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 02668   808   NtClose  (364, ... ) == 0x0
 02669   808   NtQuerySection  (352, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02670   808   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snduekenk.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02671   808   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 02672   808   NtCreateProcessEx  (1240536, 2035711, 0, -1, 4, 352, 0, 0, 0, ... ) == 0x0
 02673   808   NtSetInformationProcess  (364, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0
 02674   808   NtQueryInformationProcess  (364, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffde000,AffinityMask=0x1,BasePriority=8,Pid=1020,ParentPid=868,}, 0x0, ) == 0x0
 02675   808   NtReadVirtualMemory  (364, 0x7ffde008, 4, ...  (364, 0x7ffde008, 4, ... "\0\0@\0", 0x0, ) , 0x0, ) == 0x0
 02676   808   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\snduekenk.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02677   808   NtAllocateVirtualMemory  (-1, 1462272, 0, 8192, 4096, 4, ... 1462272, 8192, ) == 0x0
 02678   808   NtReadVirtualMemory  (364, 0x400000, 4096, ...  (364, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\7\0\357v\24:\0\0\0\0\0\0\0\0\340\0\17\1\13\1\1)\0 \14\0\0d\13\0\0\0\0\0\362\22\0\0\0\20\0\0\0\200\2\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\1\0\10\0\4\0\0\0\0\0\0\0\0\260G\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\20\0\0\0\20\0\0\3254\16rO\36\10\4\0\0\0\0\0\0\0\0\11iG\0\254E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\235\256G\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 02679   808   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02680   808   NtQueryInformationProcess  (364, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffde000,AffinityMask=0x1,BasePriority=8,Pid=1020,ParentPid=868,}, 0x0, ) == 0x0
 02681   808   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1239488, ... ) }, 1239488, ... ) == 0x0
 02682   808   NtAllocateVirtualMemory  (-1, 0, 0, 2420, 4096, 4, ... 22282240, 4096, ) == 0x0
 02683   808   NtAllocateVirtualMemory  (364, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 02684   808   NtWriteVirtualMemory  (364, 0x10000,  (364, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 02685   808   NtAllocateVirtualMemory  (364, 0, 0, 2420, 4096, 4, ... 131072, 4096, ) == 0x0
 02686   808   NtWriteVirtualMemory  (364, 0x20000,  (364, 0x20000, "\0\20\0\0t\11\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0&\0\10\2\220\2\0\0\16\0\0\0\364\3\366\3\230\4\0\0B\0D\0\220\10\0\0t\0v\0\324\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\2\0L\11\0\0\36\0 \0P\11\0\0\0\0\2\0p\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2420, ... 0x0, ) , 2420, ... 0x0, ) == 0x0
 02687   808   NtWriteVirtualMemory  (364, 0x7ffde010,  (364, 0x7ffde010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02688   808   NtWriteVirtualMemory  (364, 0x7ffde1e8,  (364, 0x7ffde1e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02689   808   NtFreeVirtualMemory  (-1, (0x1540000), 0, 32768, ... (0x1540000), 4096, ) == 0x0
 02690   808   NtAllocateVirtualMemory  (364, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 02691   808   NtAllocateVirtualMemory  (364, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 02692   808   NtProtectVirtualMemory  (364, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 02693   808   NtCreateThread  (0x1f03ff, 0x0, 364, 1240544, 1240208, 1, ... 368, {1020, 1524}, ) == 0x0
 02694   808   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 2089879886, 21266, 1241136, 1242076}  (24, {168, 196, new_msg, 0, 2089879886, 21266, 1241136, 1242076} "\0\0\0\0\0\0\1\0\4\364\22\0\10\0\0\0o\1\0\0p\1\0\0\374\3\0\0\364\5\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\334\375\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\22\0\0\0\0\0" ... {168, 196, reply, 0, 868, 808, 75668, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\10\0\0\0l\1\0\0p\1\0\0\374\3\0\0\364\5\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\334\375\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\22\0\0\0\0\0" )  ... {168, 196, reply, 0, 868, 808, 75668, 0}  (24, {168, 196, new_msg, 0, 2089879886, 21266, 1241136, 1242076} "\0\0\0\0\0\0\1\0\4\364\22\0\10\0\0\0o\1\0\0p\1\0\0\374\3\0\0\364\5\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\334\375\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\22\0\0\0\0\0" ... {168, 196, reply, 0, 868, 808, 75668, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\10\0\0\0l\1\0\0p\1\0\0\374\3\0\0\364\5\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\334\375\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\22\0\0\0\0\0" )  ) == 0x0
 02695   808   NtResumeThread  (368, ... 1, ) == 0x0
 02696   808   NtClose  (344, ... ) == 0x0
 02697   808   NtClose  (352, ... ) == 0x0
 02698   808   NtDelayExecution  (0, {-2000000, -1}, ... ) == 0x0
 02699   808   NtClose  (364, ... ) == 0x0
 02700   808   NtClose  (368, ... ) == 0x0
 02701   808   NtTerminateProcess  (0, 0, ...
 00941  1676   NtWaitForMultipleObjects  ... ) == 0xc0
 02701   808   NtTerminateProcess  ... ) == 0x0
 02702   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x14,}, 4, ... ) == 0x0
 02703   808   NtClose  (336, ... ) == 0x0
 02704   808   NtClose  (324, ... ) == 0x0
 02705   808   NtClose  (328, ... ) == 0x0
 02706   808   NtClose  (332, ... ) == 0x0
 02707   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x13,}, 4, ... ) == 0x0
 02708   808   NtFreeVirtualMemory  (-1, (0xff0000), 0, 32768, ... (0xff0000), 65536, ) == 0x0
 02709   808   NtClose  (260, ... ) == 0x0
 02710   808   NtClose  (264, ... ) == 0x0
 02711   808   NtClose  (272, ... ) == 0x0
 02712   808   NtClose  (268, ... ) == 0x0
 02713   808   NtClose  (276, ... ) == 0x0
 02714   808   NtClose  (280, ... ) == 0x0
 02715   808   NtClose  (284, ... ) == 0x0
 02716   808   NtClose  (300, ... ) == 0x0
 02717   808   NtClose  (296, ... ) == 0x0
 02718   808   NtClose  (292, ... ) == 0x0
 02719   808   NtClose  (288, ... ) == 0x0
 02720   808   NtUserGetAtomName  (49211, 1241344, ... ) == 0xf
 02721   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02722   808   NtUserGetAtomName  (49213, 1241344, ... ) == 0xd
 02723   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02724   808   NtUserGetAtomName  (49215, 1241344, ... ) == 0x10
 02725   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02726   808   NtUserGetAtomName  (49217, 1241344, ... ) == 0x12
 02727   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02728   808   NtUserGetAtomName  (49219, 1241344, ... ) == 0xd
 02729   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02730   808   NtUserGetAtomName  (49221, 1241344, ... ) == 0xb
 02731   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02732   808   NtUserGetAtomName  (49223, 1241344, ... ) == 0xf
 02733   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02734   808   NtUserGetAtomName  (49225, 1241344, ... ) == 0xd
 02735   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02736   808   NtUserGetAtomName  (49227, 1241344, ... ) == 0x11
 02737   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02738   808   NtUserGetAtomName  (49229, 1241344, ... ) == 0xf
 02739   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02740   808   NtUserGetAtomName  (49231, 1241344, ... ) == 0x11
 02741   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02742   808   NtUserGetAtomName  (49233, 1241344, ... ) == 0xf
 02743   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02744   808   NtUserGetAtomName  (49235, 1241344, ... ) == 0xc
 02745   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02746   808   NtUserGetAtomName  (49237, 1241336, ... ) == 0xd
 02747   808   NtUserUnregisterClass  (1241396, 1560870912, 1241384, ... ) == 0x1
 02748   808   NtUserGetAtomName  (49239, 1241336, ... ) == 0x11
 02749   808   NtUserUnregisterClass  (1241396, 1560870912, 1241384, ... ) == 0x1
 02750   808   NtUserGetAtomName  (49241, 1241344, ... ) == 0xc
 02751   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02752   808   NtUserGetAtomName  (49243, 1241344, ... ) == 0xe
 02753   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02754   808   NtUserGetAtomName  (49245, 1241344, ... ) == 0x8
 02755   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02756   808   NtUserGetAtomName  (49247, 1241344, ... ) == 0xd
 02757   808   NtUserUnregisterClass  (1241404, 1560870912, 1241392, ... ) == 0x1
 02758   808   NtUnmapViewOfSection  (-1, 0x1320000, ... ) == 0x0
 02759   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xd,}, 4, ... ) == 0x0
 02760   808   NtFreeVirtualMemory  (-1, (0xfb0000), 0, 32768, ... (0xfb0000), 65536, ) == 0x0
 02761   808   NtClose  (184, ... ) == 0x0
 02762   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xe,}, 4, ... ) == 0x0
 02763   808   NtUserQueryWindow  (65670, 0, ... ) == 0x6b8
 02764   808   NtUserQueryWindow  (65670, 1, ... ) == 0x6bc
 02765   808   NtUnmapViewOfSection  (-1, 0xf90000, ... ) == 0x0
 02766   808   NtClose  (180, ... ) == 0x0
 02767   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xb,}, 4, ... ) == 0x0
 02768   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xc,}, 4, ... ) == 0x0
 02769   808   NtClose  (156, ... ) == 0x0
 02770   808   NtClose  (152, ... ) == 0x0
 02771   808   NtClose  (160, ... ) == 0x0
 02772   808   NtUserGetAtomName  (49211, 1241376, ... ) == 0xf
 02773   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02774   808   NtUserGetAtomName  (49213, 1241376, ... ) == 0xd
 02775   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02776   808   NtUserGetAtomName  (49215, 1241376, ... ) == 0x10
 02777   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02778   808   NtUserGetAtomName  (49217, 1241376, ... ) == 0x12
 02779   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02780   808   NtUserGetAtomName  (49219, 1241376, ... ) == 0xd
 02781   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02782   808   NtUserGetAtomName  (49221, 1241376, ... ) == 0xb
 02783   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02784   808   NtUserGetAtomName  (49223, 1241376, ... ) == 0xf
 02785   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02786   808   NtUserGetAtomName  (49225, 1241376, ... ) == 0xd
 02787   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02788   808   NtUserGetAtomName  (49227, 1241376, ... ) == 0x11
 02789   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02790   808   NtUserGetAtomName  (49229, 1241376, ... ) == 0xf
 02791   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02792   808   NtUserGetAtomName  (49231, 1241376, ... ) == 0x11
 02793   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02794   808   NtUserGetAtomName  (49233, 1241376, ... ) == 0xf
 02795   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02796   808   NtUserGetAtomName  (49235, 1241376, ... ) == 0xc
 02797   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02798   808   NtUserGetAtomName  (49237, 1241368, ... ) == 0xd
 02799   808   NtUserUnregisterClass  (1241428, 2000486400, 1241416, ... ) == 0x1
 02800   808   NtUserGetAtomName  (49239, 1241368, ... ) == 0x11
 02801   808   NtUserUnregisterClass  (1241428, 2000486400, 1241416, ... ) == 0x1
 02802   808   NtUserGetAtomName  (49241, 1241376, ... ) == 0xc
 02803   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02804   808   NtUserGetAtomName  (49243, 1241376, ... ) == 0xe
 02805   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02806   808   NtUserGetAtomName  (49245, 1241376, ... ) == 0x8
 02807   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02808   808   NtUserGetAtomName  (49247, 1241376, ... ) == 0xd
 02809   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02810   808   NtUserGetAtomName  (49175, 1241376, ... ) == 0x6
 02811   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02812   808   NtUserGetAtomName  (49177, 1241376, ... ) == 0x6
 02813   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02814   808   NtUserGetAtomName  (49176, 1241376, ... ) == 0x4
 02815   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02816   808   NtUserGetAtomName  (49178, 1241376, ... ) == 0x7
 02817   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02818   808   NtUserGetAtomName  (49180, 1241376, ... ) == 0x8
 02819   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02820   808   NtUserGetAtomName  (49182, 1241376, ... ) == 0x9
 02821   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02822   808   NtUserGetAtomName  (49179, 1241368, ... ) == 0x9
 02823   808   NtUserUnregisterClass  (1241428, 2000486400, 1241416, ... ) == 0x1
 02824   808   NtUserGetAtomName  (49256, 1241376, ... ) == 0x7
 02825   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02826   808   NtUserGetAtomName  (49258, 1241376, ... ) == 0xd
 02827   808   NtUserUnregisterClass  (1241436, 2000486400, 1241424, ... ) == 0x1
 02828   808   NtUnmapViewOfSection  (-1, 0xfa0000, ... ) == 0x0
 02829   808   NtDeviceIoControlFile  (92, 96, 0x0, 0x12f244, 0x22415c,  (92, 96, 0x0, 0x12f244, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#d\0\0\0\0\0\0\0\10 \22\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#d\0\0\0\0\0\0\0\10 \22\1\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (92, 96, 0x0, 0x12f244, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#d\0\0\0\0\0\0\0\10 \22\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#d\0\0\0\0\0\0\0\10 \22\1\306\205\337w", ) , ) == 0x0
 02830   808   NtDeviceIoControlFile  (92, 96, 0x0, 0x12f20c, 0x228168,  (92, 96, 0x0, 0x12f20c, 0x228168, "d\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 02831   808   NtDeviceIoControlFile  (92, 96, 0x0, 0x12f244, 0x22415c,  (92, 96, 0x0, 0x12f244, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344|\0\0\0\0\0\0\0\10 \22\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344|\0\0\0\0\0\0\0\10 \22\1\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (92, 96, 0x0, 0x12f244, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344|\0\0\0\0\0\0\0\10 \22\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344|\0\0\0\0\0\0\0\10 \22\1\306\205\337w", ) , ) == 0x0
 02832   808   NtDeviceIoControlFile  (92, 96, 0x0, 0x12f20c, 0x228168,  (92, 96, 0x0, 0x12f20c, 0x228168, "|\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 02833   808   NtWaitForSingleObject  (236, 0, 0x0, ... ) == 0x0
 02834   808   NtClearEvent  (236, ... ) == 0x0
 02835   808   NtSetEvent  (236, ... 0x0, ) == 0x0
 02836   808   NtClose  (236, ... ) == 0x0
 02837   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0
 02838   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 02839   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x9,}, 4, ... ) == 0x0
 02840   808   NtClose  (84, ... ) == 0x0
 02841   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0
 02842   808   NtUnmapViewOfSection  (-1, 0xe10000, ... ) == 0x0
 02843   808   NtClose  (60, ... ) == 0x0
 02844   808   NtGdiDeleteObjectApp  (-1676671828, ... ) == 0x1
 02845   808   NtUserGetProcessWindowStation  (... ) == 0x20
 02846   808   NtUserBuildNameList  (32, 522, 1394880, 1241620, ... ) == 0x0
 02847   808   NtUserGetProcessWindowStation  (... ) == 0x20
 02848   808   NtUserOpenDesktop  ({24, 32, 0x40, 0, 0,  ({24, 32, 0x40, 0, 0, "Default"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x3c
 02849   808   NtUserBuildHwndList  (60, 0, 0, 0, 64, ... (0x1a00f4, 0x5009e, 0x400fa, 0x10074, 0x10070, 0x10080, 0x10084, 0x30048, 0x10072, 0x20052, 0x5009c, 0x1401b6, 0xc01d2, 0xd0102, 0x500a2, 0xd011a, 0x10090, 0x100d0, 0x200b0, 0x100cc, 0x13010c, 0x16012c, 0x7015a, 0xd01c8, 0xe01ac, 0xc01d0, 0xa01cc, 0x3014c, 0x1011c, 0x100e6, 0x100d6, 0x100d2, 0x100ca, 0x100c8, 0x100ba, 0x100ae, 0x100ac, 0x300a6, 0x10078, 0x30062, 0x50036, 0x5005c, 0x100be, 0x400fe, 0x10092, 0x10086, 0x40034, 0x50050, 0x1013c, 0x10120, 0x100c2, 0x100bc, 0x2014e, 0x100d8, 0x100b6, 0x100b8, 0x100b4, 0x100c0, 0x1009a, 0x5005e, 0x1, ), 61, ) == 0x0
 02850   808   NtUserValidateHandleSecure  (1704180, ... ) == 0x1
 02851   808   NtUserQueryWindow  (1704180, 0, ... ) == 0x6b8
 02852   808   NtUserQueryWindow  (1704180, 1, ... ) == 0x6d4
 02853   808   NtUserValidateHandleSecure  (1704180, ... ) == 0x1
 02854   808   NtUserValidateHandleSecure  (327838, ... ) == 0x1
 02855   808   NtUserQueryWindow  (327838, 0, ... ) == 0x6b8
 02856   808   NtUserQueryWindow  (327838, 1, ... ) == 0x6d4
 02857   808   NtUserValidateHandleSecure  (327838, ... ) == 0x1
 02858   808   NtUserValidateHandleSecure  (262394, ... ) == 0x1
 02859   808   NtUserQueryWindow  (262394, 0, ... ) == 0x6b8
 02860   808   NtUserQueryWindow  (262394, 1, ... ) == 0x6d4
 02861   808   NtUserValidateHandleSecure  (262394, ... ) == 0x1
 02862   808   NtUserBuildHwndList  (0, 262394, 1, 0, 64, ... (0x80064, 0x60068, 0x6006c, 0x50094, 0x50096, 0x60066, 0x7006a, 0x90058, 0x6006e, 0x5008a, 0x50088, 0x500a0, 0x1, ), 13, ) == 0x0
 02863   808   NtUserValidateHandleSecure  (524388, ... ) == 0x1
 02864   808   NtUserQueryWindow  (524388, 0, ... ) == 0x6b8
 02865   808   NtUserQueryWindow  (524388, 1, ... ) == 0x6d4
 02866   808   NtUserValidateHandleSecure  (393320, ... ) == 0x1
 02867   808   NtUserQueryWindow  (393320, 0, ... ) == 0x6b8
 02868   808   NtUserQueryWindow  (393320, 1, ... ) == 0x6d4
 02869   808   NtUserValidateHandleSecure  (393324, ... ) == 0x1
 02870   808   NtUserQueryWindow  (393324, 0, ... ) == 0x6b8
 02871   808   NtUserQueryWindow  (393324, 1, ... ) == 0x6d4
 02872   808   NtUserValidateHandleSecure  (327828, ... ) == 0x1
 02873   808   NtUserQueryWindow  (327828, 0, ... ) == 0x6b8
 02874   808   NtUserQueryWindow  (327828, 1, ... ) == 0x6d4
 02875   808   NtUserValidateHandleSecure  (327830, ... ) == 0x1
 02876   808   NtUserQueryWindow  (327830, 0, ... ) == 0x6b8
 02877   808   NtUserQueryWindow  (327830, 1, ... ) == 0x6d4
 02878   808   NtUserValidateHandleSecure  (393318, ... ) == 0x1
 02879   808   NtUserQueryWindow  (393318, 0, ... ) == 0x6b8
 02880   808   NtUserQueryWindow  (393318, 1, ... ) == 0x6d4
 02881   808   NtUserValidateHandleSecure  (458858, ... ) == 0x1
 02882   808   NtUserQueryWindow  (458858, 0, ... ) == 0x6b8
 02883   808   NtUserQueryWindow  (458858, 1, ... ) == 0x6d4
 02884   808   NtUserValidateHandleSecure  (589912, ... ) == 0x1
 02885   808   NtUserQueryWindow  (589912, 0, ... ) == 0x6b8
 02886   808   NtUserQueryWindow  (589912, 1, ... ) == 0x6d4
 02887   808   NtUserValidateHandleSecure  (393326, ... ) == 0x1
 02888   808   NtUserQueryWindow  (393326, 0, ... ) == 0x6b8
 02889   808   NtUserQueryWindow  (393326, 1, ... ) == 0x6d4
 02890   808   NtUserValidateHandleSecure  (327818, ... ) == 0x1
 02891   808   NtUserQueryWindow  (327818, 0, ... ) == 0x6b8
 02892   808   NtUserQueryWindow  (327818, 1, ... ) == 0x6d4
 02893   808   NtUserValidateHandleSecure  (327816, ... ) == 0x1
 02894   808   NtUserQueryWindow  (327816, 0, ... ) == 0x6b8
 02895   808   NtUserQueryWindow  (327816, 1, ... ) == 0x6d4
 02896   808   NtUserValidateHandleSecure  (327840, ... ) == 0x1
 02897   808   NtUserQueryWindow  (327840, 0, ... ) == 0x6b8
 02898   808   NtUserQueryWindow  (327840, 1, ... ) == 0x6d4
 02899   808   NtUserValidateHandleSecure  (65652, ... ) == 0x1
 02900   808   NtUserQueryWindow  (65652, 0, ... ) == 0x6b8
 02901   808   NtUserQueryWindow  (65652, 1, ... ) == 0x6d4
 02902   808   NtUserValidateHandleSecure  (65652, ... ) == 0x1
 02903   808   NtUserValidateHandleSecure  (65648, ... ) == 0x1
 02904   808   NtUserQueryWindow  (65648, 0, ... ) == 0x6b8
 02905   808   NtUserQueryWindow  (65648, 1, ... ) == 0x6d4
 02906   808   NtUserValidateHandleSecure  (65648, ... ) == 0x1
 02907   808   NtUserValidateHandleSecure  (65664, ... ) == 0x1
 02908   808   NtUserQueryWindow  (65664, 0, ... ) == 0x6b8
 02909   808   NtUserQueryWindow  (65664, 1, ... ) == 0x6d4
 02910   808   NtUserValidateHandleSecure  (65664, ... ) == 0x1
 02911   808   NtUserValidateHandleSecure  (65668, ... ) == 0x1
 02912   808   NtUserQueryWindow  (65668, 0, ... ) == 0x6b8
 02913   808   NtUserQueryWindow  (65668, 1, ... ) == 0x6d4
 02914   808   NtUserValidateHandleSecure  (65668, ... ) == 0x1
 02915   808   NtUserValidateHandleSecure  (196680, ... ) == 0x1
 02916   808   NtUserQueryWindow  (196680, 0, ... ) == 0x6b8
 02917   808   NtUserQueryWindow  (196680, 1, ... ) == 0x6d4
 02918   808   NtUserValidateHandleSecure  (196680, ... ) == 0x1
 02919   808   NtUserValidateHandleSecure  (65650, ... ) == 0x1
 02920   808   NtUserQueryWindow  (65650, 0, ... ) == 0x6b8
 02921   808   NtUserQueryWindow  (65650, 1, ... ) == 0x6d4
 02922   808   NtUserValidateHandleSecure  (65650, ... ) == 0x1
 02923   808   NtUserValidateHandleSecure  (131154, ... ) == 0x1
 02924   808   NtUserQueryWindow  (131154, 0, ... ) == 0x6b8
 02925   808   NtUserQueryWindow  (131154, 1, ... ) == 0x6d4
 02926   808   NtUserValidateHandleSecure  (131154, ... ) == 0x1
 02927   808   NtUserBuildHwndList  (0, 131154, 1, 0, 64, ... (0x3003e, 0x3003c, 0x30040, 0x30042, 0x30044, 0x30046, 0x10076, 0x10082, 0x1007a, 0x1007e, 0x1, ), 11, ) == 0x0
 02928   808   NtUserValidateHandleSecure  (196670, ... ) == 0x1
 02929   808   NtUserQueryWindow  (196670, 0, ... ) == 0x6b8
 02930   808   NtUserQueryWindow  (196670, 1, ... ) == 0x6d4
 02931   808   NtUserValidateHandleSecure  (196668, ... ) == 0x1
 02932   808   NtUserQueryWindow  (196668, 0, ... ) == 0x6b8
 02933   808   NtUserQueryWindow  (196668, 1, ... ) == 0x6d4
 02934   808   NtUserValidateHandleSecure  (196672, ... ) == 0x1
 02935   808   NtUserQueryWindow  (196672, 0, ... ) == 0x6b8
 02936   808   NtUserQueryWindow  (196672, 1, ... ) == 0x6d4
 02937   808   NtUserValidateHandleSecure  (196674, ... ) == 0x1
 02938   808   NtUserQueryWindow  (196674, 0, ... ) == 0x6b8
 02939   808   NtUserQueryWindow  (196674, 1, ... ) == 0x6d4
 02940   808   NtUserValidateHandleSecure  (196676, ... ) == 0x1
 02941   808   NtUserQueryWindow  (196676, 0, ... ) == 0x6b8
 02942   808   NtUserQueryWindow  (196676, 1, ... ) == 0x6d4
 02943   808   NtUserValidateHandleSecure  (196678, ... ) == 0x1
 02944   808   NtUserQueryWindow  (196678, 0, ... ) == 0x6b8
 02945   808   NtUserQueryWindow  (196678, 1, ... ) == 0x6d4
 02946   808   NtUserValidateHandleSecure  (65654, ... ) == 0x1
 02947   808   NtUserQueryWindow  (65654, 0, ... ) == 0x6b8
 02948   808   NtUserQueryWindow  (65654, 1, ... ) == 0x6d4
 02949   808   NtUserValidateHandleSecure  (65666, ... ) == 0x1
 02950   808   NtUserQueryWindow  (65666, 0, ... ) == 0x6b8
 02951   808   NtUserQueryWindow  (65666, 1, ... ) == 0x6d4
 02952   808   NtUserValidateHandleSecure  (65658, ... ) == 0x1
 02953   808   NtUserQueryWindow  (65658, 0, ... ) == 0x6b8
 02954   808   NtUserQueryWindow  (65658, 1, ... ) == 0x6d4
 02955   808   NtUserValidateHandleSecure  (65662, ... ) == 0x1
 02956   808   NtUserQueryWindow  (65662, 0, ... ) == 0x6b8
 02957   808   NtUserQueryWindow  (65662, 1, ... ) == 0x6d4
 02958   808   NtUserValidateHandleSecure  (327836, ... ) == 0x1
 02959   808   NtUserQueryWindow  (327836, 0, ... ) == 0x6b8
 02960   808   NtUserQueryWindow  (327836, 1, ... ) == 0x6d4
 02961   808   NtUserValidateHandleSecure  (327836, ... ) == 0x1
 02962   808   NtUserValidateHandleSecure  (1311158, ... ) == 0x1
 02963   808   NtUserQueryWindow  (1311158, 0, ... ) == 0x6b8
 02964   808   NtUserQueryWindow  (1311158, 1, ... ) == 0x6d4
 02965   808   NtUserValidateHandleSecure  (1311158, ... ) == 0x1
 02966   808   NtUserBuildHwndList  (0, 1311158, 1, 0, 64, ... (0xf0192, 0x80198, 0x1, ), 3, ) == 0x0
 02967   808   NtUserValidateHandleSecure  (983442, ... ) == 0x1
 02968   808   NtUserQueryWindow  (983442, 0, ... ) == 0x6b8
 02969   808   NtUserQueryWindow  (983442, 1, ... ) == 0x6d4
 02970   808   NtUserValidateHandleSecure  (524696, ... ) == 0x1
 02971   808   NtUserQueryWindow  (524696, 0, ... ) == 0x6b8
 02972   808   NtUserQueryWindow  (524696, 1, ... ) == 0x6d4
 02973   808   NtUserValidateHandleSecure  (786898, ... ) == 0x1
 02974   808   NtUserQueryWindow  (786898, 0, ... ) == 0x6b8
 02975   808   NtUserQueryWindow  (786898, 1, ... ) == 0x6d4
 02976   808   NtUserValidateHandleSecure  (786898, ... ) == 0x1
 02977   808   NtUserValidateHandleSecure  (852226, ... ) == 0x1
 02978   808   NtUserQueryWindow  (852226, 0, ... ) == 0x6b8
 02979   808   NtUserQueryWindow  (852226, 1, ... ) == 0x6d4
 02980   808   NtUserValidateHandleSecure  (852226, ... ) == 0x1
 02981   808   NtUserBuildHwndList  (0, 852226, 1, 0, 64, ... (0x700fc, 0xc0114, 0x1, ), 3, ) == 0x0
 02982   808   NtUserValidateHandleSecure  (459004, ... ) == 0x1
 02983   808   NtUserQueryWindow  (459004, 0, ... ) == 0x6b8
 02984   808   NtUserQueryWindow  (459004, 1, ... ) == 0x6d4
 02985   808   NtUserValidateHandleSecure  (786708, ... ) == 0x1
 02986   808   NtUserQueryWindow  (786708, 0, ... ) == 0x6b8
 02987   808   NtUserQueryWindow  (786708, 1, ... ) == 0x6d4
 02988   808   NtUserValidateHandleSecure  (327842, ... ) == 0x1
 02989   808   NtUserQueryWindow  (327842, 0, ... ) == 0x6b8
 02990   808   NtUserQueryWindow  (327842, 1, ... ) == 0x6d4
 02991   808   NtUserValidateHandleSecure  (327842, ... ) == 0x1
 02992   808   NtUserValidateHandleSecure  (852250, ... ) == 0x1
 02993   808   NtUserQueryWindow  (852250, 0, ... ) == 0x6b8
 02994   808   NtUserQueryWindow  (852250, 1, ... ) == 0x6d4
 02995   808   NtUserValidateHandleSecure  (852250, ... ) == 0x1
 02996   808   NtUserValidateHandleSecure  (65680, ... ) == 0x1
 02997   808   NtUserQueryWindow  (65680, 0, ... ) == 0x6b8
 02998   808   NtUserQueryWindow  (65680, 1, ... ) == 0x6bc
 02999   808   NtUserValidateHandleSecure  (65680, ... ) == 0x1
 03000   808   NtUserValidateHandleSecure  (65744, ... ) == 0x1
 03001   808   NtUserQueryWindow  (65744, 0, ... ) == 0x19c
 03002   808   NtUserQueryWindow  (65744, 1, ... ) == 0x1a0
 03003   808   NtUserValidateHandleSecure  (65744, ... ) == 0x1
 03004   808   NtUserValidateHandleSecure  (131248, ... ) == 0x1
 03005   808   NtUserQueryWindow  (131248, 0, ... ) == 0xa0
 03006   808   NtUserQueryWindow  (131248, 1, ... ) == 0xe4
 03007   808   NtUserValidateHandleSecure  (131248, ... ) == 0x1
 03008   808   NtUserValidateHandleSecure  (65740, ... ) == 0x1
 03009   808   NtUserQueryWindow  (65740, 0, ... ) == 0x19c
 03010   808   NtUserQueryWindow  (65740, 1, ... ) == 0x1a0
 03011   808   NtUserValidateHandleSecure  (65740, ... ) == 0x1
 03012   808   NtUserValidateHandleSecure  (1245452, ... ) == 0x1
 03013   808   NtUserQueryWindow  (1245452, 0, ... ) == 0x5e8
 03014   808   NtUserQueryWindow  (1245452, 1, ... ) == 0x534
 03015   808   NtUserValidateHandleSecure  (1245452, ... ) == 0x1
 03016   808   NtUserValidateHandleSecure  (1442092, ... ) == 0x1
 03017   808   NtUserQueryWindow  (1442092, 0, ... ) == 0xa4
 03018   808   NtUserQueryWindow  (1442092, 1, ... ) == 0x61c
 03019   808   NtUserValidateHandleSecure  (1442092, ... ) == 0x1
 03020   808   NtUserValidateHandleSecure  (459098, ... ) == 0x1
 03021   808   NtUserQueryWindow  (459098, 0, ... ) == 0x4b0
 03022   808   NtUserQueryWindow  (459098, 1, ... ) == 0x780
 03023   808   NtUserValidateHandleSecure  (459098, ... ) == 0x1
 03024   808   NtUserValidateHandleSecure  (852424, ... ) == 0x1
 03025   808   NtUserQueryWindow  (852424, 0, ... ) == 0x6b8
 03026   808   NtUserQueryWindow  (852424, 1, ... ) == 0x6d4
 03027   808   NtUserValidateHandleSecure  (852424, ... ) == 0x1
 03028   808   NtUserValidateHandleSecure  (917932, ... ) == 0x1
 03029   808   NtUserQueryWindow  (917932, 0, ... ) == 0x6b8
 03030   808   NtUserQueryWindow  (917932, 1, ... ) == 0x6d4
 03031   808   NtUserValidateHandleSecure  (917932, ... ) == 0x1
 03032   808   NtUserValidateHandleSecure  (786896, ... ) == 0x1
 03033   808   NtUserQueryWindow  (786896, 0, ... ) == 0x6b8
 03034   808   NtUserQueryWindow  (786896, 1, ... ) == 0x6d4
 03035   808   NtUserValidateHandleSecure  (786896, ... ) == 0x1
 03036   808   NtUserValidateHandleSecure  (655820, ... ) == 0x1
 03037   808   NtUserQueryWindow  (655820, 0, ... ) == 0x6b8
 03038   808   NtUserQueryWindow  (655820, 1, ... ) == 0x6d4
 03039   808   NtUserValidateHandleSecure  (655820, ... ) == 0x1
 03040   808   NtUserValidateHandleSecure  (196940, ... ) == 0x1
 03041   808   NtUserQueryWindow  (196940, 0, ... ) == 0x4b4
 03042   808   NtUserQueryWindow  (196940, 1, ... ) == 0x474
 03043   808   NtUserValidateHandleSecure  (196940, ... ) == 0x1
 03044   808   NtUserValidateHandleSecure  (65820, ... ) == 0x1
 03045   808   NtUserQueryWindow  (65820, 0, ... ) == 0x22c
 03046   808   NtUserQueryWindow  (65820, 1, ... ) == 0x220
 03047   808   NtUserValidateHandleSecure  (65820, ... ) == 0x1
 03048   808   NtUserValidateHandleSecure  (65766, ... ) == 0x1
 03049   808   NtUserQueryWindow  (65766, 0, ... ) == 0x6b8
 03050   808   NtUserQueryWindow  (65766, 1, ... ) == 0x13c
 03051   808   NtUserValidateHandleSecure  (65766, ... ) == 0x1
 03052   808   NtUserValidateHandleSecure  (65750, ... ) == 0x1
 03053   808   NtUserQueryWindow  (65750, 0, ... ) == 0x6b8
 03054   808   NtUserQueryWindow  (65750, 1, ... ) == 0x13c
 03055   808   NtUserValidateHandleSecure  (65750, ... ) == 0x1
 03056   808   NtUserBuildHwndList  (0, 65750, 1, 0, 64, ... (0x100da, 0x100dc, 0x100de, 0x100e0, 0x1, ), 5, ) == 0x0
 03057   808   NtUserValidateHandleSecure  (65754, ... ) == 0x1
 03058   808   NtUserQueryWindow  (65754, 0, ... ) == 0x6b8
 03059   808   NtUserQueryWindow  (65754, 1, ... ) == 0x13c
 03060   808   NtUserValidateHandleSecure  (65756, ... ) == 0x1
 03061   808   NtUserQueryWindow  (65756, 0, ... ) == 0x6b8
 03062   808   NtUserQueryWindow  (65756, 1, ... ) == 0x13c
 03063   808   NtUserValidateHandleSecure  (65758, ... ) == 0x1
 03064   808   NtUserQueryWindow  (65758, 0, ... ) == 0x6b8
 03065   808   NtUserQueryWindow  (65758, 1, ... ) == 0x13c
 03066   808   NtUserValidateHandleSecure  (65760, ... ) == 0x1
 03067   808   NtUserQueryWindow  (65760, 0, ... ) == 0x6b8
 03068   808   NtUserQueryWindow  (65760, 1, ... ) == 0x13c
 03069   808   NtUserValidateHandleSecure  (65746, ... ) == 0x1
 03070   808   NtUserQueryWindow  (65746, 0, ... ) == 0x6b8
 03071   808   NtUserQueryWindow  (65746, 1, ... ) == 0x6d4
 03072   808   NtUserValidateHandleSecure  (65746, ... ) == 0x1
 03073   808   NtUserValidateHandleSecure  (65738, ... ) == 0x1
 03074   808   NtUserQueryWindow  (65738, 0, ... ) == 0x19c
 03075   808   NtUserQueryWindow  (65738, 1, ... ) == 0x1a0
 03076   808   NtUserValidateHandleSecure  (65738, ... ) == 0x1
 03077   808   NtUserValidateHandleSecure  (65736, ... ) == 0x1
 03078   808   NtUserQueryWindow  (65736, 0, ... ) == 0xa0
 03079   808   NtUserQueryWindow  (65736, 1, ... ) == 0xe4
 03080   808   NtUserValidateHandleSecure  (65736, ... ) == 0x1
 03081   808   NtUserValidateHandleSecure  (65722, ... ) == 0x1
 03082   808   NtUserQueryWindow  (65722, 0, ... ) == 0x104
 03083   808   NtUserQueryWindow  (65722, 1, ... ) == 0x108
 03084   808   NtUserValidateHandleSecure  (65722, ... ) == 0x1
 03085   808   NtUserValidateHandleSecure  (65710, ... ) == 0x1
 03086   808   NtUserQueryWindow  (65710, 0, ... ) == 0x104
 03087   808   NtUserQueryWindow  (65710, 1, ... ) == 0x108
 03088   808   NtUserValidateHandleSecure  (65710, ... ) == 0x1
 03089   808   NtUserValidateHandleSecure  (65708, ... ) == 0x1
 03090   808   NtUserQueryWindow  (65708, 0, ... ) == 0x120
 03091   808   NtUserQueryWindow  (65708, 1, ... ) == 0x124
 03092   808   NtUserValidateHandleSecure  (65708, ... ) == 0x1
 03093   808   NtUserValidateHandleSecure  (196774, ... ) == 0x1
 03094   808   NtUserQueryWindow  (196774, 0, ... ) == 0xc4
 03095   808   NtUserQueryWindow  (196774, 1, ... ) == 0xc8
 03096   808   NtUserValidateHandleSecure  (196774, ... ) == 0x1
 03097   808   NtUserValidateHandleSecure  (65656, ... ) == 0x1
 03098   808   NtUserQueryWindow  (65656, 0, ... ) == 0x6b8
 03099   808   NtUserQueryWindow  (65656, 1, ... ) == 0x6ec
 03100   808   NtUserValidateHandleSecure  (65656, ... ) == 0x1
 03101   808   NtUserValidateHandleSecure  (196706, ... ) == 0x1
 03102   808   NtUserQueryWindow  (196706, 0, ... ) == 0x6b8
 03103   808   NtUserQueryWindow  (196706, 1, ... ) == 0x6bc
 03104   808   NtUserValidateHandleSecure  (196706, ... ) == 0x1
 03105   808   NtUserValidateHandleSecure  (327734, ... ) == 0x1
 03106   808   NtUserQueryWindow  (327734, 0, ... ) == 0x6b8
 03107   808   NtUserQueryWindow  (327734, 1, ... ) == 0x6bc
 03108   808   NtUserValidateHandleSecure  (327734, ... ) == 0x1
 03109   808   NtUserValidateHandleSecure  (327772, ... ) == 0x1
 03110   808   NtUserQueryWindow  (327772, 0, ... ) == 0x6b8
 03111   808   NtUserQueryWindow  (327772, 1, ... ) == 0x6bc
 03112   808   NtUserValidateHandleSecure  (327772, ... ) == 0x1
 03113   808   NtUserValidateHandleSecure  (65726, ... ) == 0x1
 03114   808   NtUserQueryWindow  (65726, 0, ... ) == 0x19c
 03115   808   NtUserQueryWindow  (65726, 1, ... ) == 0x1a0
 03116   808   NtUserValidateHandleSecure  (65726, ... ) == 0x1
 03117   808   NtUserValidateHandleSecure  (262398, ... ) == 0x1
 03118   808   NtUserQueryWindow  (262398, 0, ... ) == 0x6b8
 03119   808   NtUserQueryWindow  (262398, 1, ... ) == 0x6d4
 03120   808   NtUserValidateHandleSecure  (262398, ... ) == 0x1
 03121   808   NtUserValidateHandleSecure  (65682, ... ) == 0x1
 03122   808   NtUserQueryWindow  (65682, 0, ... ) == 0x6b8
 03123   808   NtUserQueryWindow  (65682, 1, ... ) == 0x6bc
 03124   808   NtUserValidateHandleSecure  (65682, ... ) == 0x1
 03125   808   NtUserValidateHandleSecure  (65670, ... ) == 0x1
 03126   808   NtUserQueryWindow  (65670, 0, ... ) == 0x6b8
 03127   808   NtUserQueryWindow  (65670, 1, ... ) == 0x6bc
 03128   808   NtUserValidateHandleSecure  (65670, ... ) == 0x1
 03129   808   NtUserBuildHwndList  (0, 65670, 1, 0, 64, ... (0x1008c, 0x1008e, 0x1, ), 3, ) == 0x0
 03130   808   NtUserValidateHandleSecure  (65676, ... ) == 0x1
 03131   808   NtUserQueryWindow  (65676, 0, ... ) == 0x6b8
 03132   808   NtUserQueryWindow  (65676, 1, ... ) == 0x6bc
 03133   808   NtUserValidateHandleSecure  (65678, ... ) == 0x1
 03134   808   NtUserQueryWindow  (65678, 0, ... ) == 0x6b8
 03135   808   NtUserQueryWindow  (65678, 1, ... ) == 0x6bc
 03136   808   NtUserValidateHandleSecure  (262196, ... ) == 0x1
 03137   808   NtUserQueryWindow  (262196, 0, ... ) == 0x6b8
 03138   808   NtUserQueryWindow  (262196, 1, ... ) == 0x6d4
 03139   808   NtUserValidateHandleSecure  (262196, ... ) == 0x1
 03140   808   NtUserValidateHandleSecure  (327760, ... ) == 0x1
 03141   808   NtUserQueryWindow  (327760, 0, ... ) == 0x6b8
 03142   808   NtUserQueryWindow  (327760, 1, ... ) == 0x6d4
 03143   808   NtUserValidateHandleSecure  (327760, ... ) == 0x1
 03144   808   NtUserValidateHandleSecure  (65852, ... ) == 0x1
 03145   808   NtUserQueryWindow  (65852, 0, ... ) == 0x22c
 03146   808   NtUserQueryWindow  (65852, 1, ... ) == 0x220
 03147   808   NtUserValidateHandleSecure  (65852, ... ) == 0x1
 03148   808   NtUserValidateHandleSecure  (65824, ... ) == 0x1
 03149   808   NtUserQueryWindow  (65824, 0, ... ) == 0x22c
 03150   808   NtUserQueryWindow  (65824, 1, ... ) == 0x220
 03151   808   NtUserValidateHandleSecure  (65824, ... ) == 0x1
 03152   808   NtUserValidateHandleSecure  (65730, ... ) == 0x1
 03153   808   NtUserQueryWindow  (65730, 0, ... ) == 0xa0
 03154   808   NtUserQueryWindow  (65730, 1, ... ) == 0xe4
 03155   808   NtUserValidateHandleSecure  (65730, ... ) == 0x1
 03156   808   NtUserValidateHandleSecure  (65724, ... ) == 0x1
 03157   808   NtUserQueryWindow  (65724, 0, ... ) == 0xa0
 03158   808   NtUserQueryWindow  (65724, 1, ... ) == 0xe4
 03159   808   NtUserValidateHandleSecure  (65724, ... ) == 0x1
 03160   808   NtUserValidateHandleSecure  (131406, ... ) == 0x1
 03161   808   NtUserQueryWindow  (131406, 0, ... ) == 0x4b4
 03162   808   NtUserQueryWindow  (131406, 1, ... ) == 0x474
 03163   808   NtUserValidateHandleSecure  (131406, ... ) == 0x1
 03164   808   NtUserValidateHandleSecure  (65752, ... ) == 0x1
 03165   808   NtUserQueryWindow  (65752, 0, ... ) == 0x6b8
 03166   808   NtUserQueryWindow  (65752, 1, ... ) == 0x13c
 03167   808   NtUserValidateHandleSecure  (65752, ... ) == 0x1
 03168   808   NtUserValidateHandleSecure  (65718, ... ) == 0x1
 03169   808   NtUserQueryWindow  (65718, 0, ... ) == 0x104
 03170   808   NtUserQueryWindow  (65718, 1, ... ) == 0x108
 03171   808   NtUserValidateHandleSecure  (65718, ... ) == 0x1
 03172   808   NtUserValidateHandleSecure  (65720, ... ) == 0x1
 03173   808   NtUserQueryWindow  (65720, 0, ... ) == 0x120
 03174   808   NtUserQueryWindow  (65720, 1, ... ) == 0x124
 03175   808   NtUserValidateHandleSecure  (65720, ... ) == 0x1
 03176   808   NtUserValidateHandleSecure  (65716, ... ) == 0x1
 03177   808   NtUserQueryWindow  (65716, 0, ... ) == 0xc4
 03178   808   NtUserQueryWindow  (65716, 1, ... ) == 0xc8
 03179   808   NtUserValidateHandleSecure  (65716, ... ) == 0x1
 03180   808   NtUserValidateHandleSecure  (65728, ... ) == 0x1
 03181   808   NtUserQueryWindow  (65728, 0, ... ) == 0x19c
 03182   808   NtUserQueryWindow  (65728, 1, ... ) == 0x1a0
 03183   808   NtUserValidateHandleSecure  (65728, ... ) == 0x1
 03184   808   NtUserValidateHandleSecure  (65690, ... ) == 0x1
 03185   808   NtUserQueryWindow  (65690, 0, ... ) == 0x6b8
 03186   808   NtUserQueryWindow  (65690, 1, ... ) == 0x6bc
 03187   808   NtUserValidateHandleSecure  (65690, ... ) == 0x1
 03188   808   NtUserValidateHandleSecure  (327774, ... ) == 0x1
 03189   808   NtUserQueryWindow  (327774, 0, ... ) == 0x6b8
 03190   808   NtUserQueryWindow  (327774, 1, ... ) == 0x6bc
 03191   808   NtUserValidateHandleSecure  (327774, ... ) == 0x1
 03192   808   NtUserCloseDesktop  (60, ... ) == 0x1
 03193   808   NtUserGetProcessWindowStation  (... ) == 0x20
 03194   808   NtUserOpenDesktop  ({24, 32, 0x40, 0, 0,  ({24, 32, 0x40, 0, 0, "Disconnect"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0
 03195   808   NtUserGetProcessWindowStation  (... ) == 0x20
 03196   808   NtUserOpenDesktop  ({24, 32, 0x40, 0, 0,  ({24, 32, 0x40, 0, 0, "Winlogon"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0
 03197   808   NtGdiDeleteObjectApp  (1326057013, ... ) == 0x1
 03198   808   NtGdiDeleteObjectApp  (1795818684, ... ) == 0x1
 03199   808   NtClose  (56, ... ) == 0x0
 03200   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0
 03201   808   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 03202   808   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 03203   808   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 03204   808   NtQueryVirtualMemory  (-1, 0x42573c, Basic, 28, ... {BaseAddress=0x425000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03205   808   NtClose  (44, ... ) == 0x0
 03206   808   NtClose  (92, ... ) == 0x0
 03207   808   NtFreeVirtualMemory  (-1, (0x1050000), 4096, 32768, ... (0x1050000), 4096, ) == 0x0
 03208   808   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 92, ) }, ... 92, ) == 0x0
 03209   808   NtQueryValueKey  (92,  (92, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03210   808   NtClose  (92, ... ) == 0x0
 03211   808   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 1418128, 0, 0}  (24, {20, 48, new_msg, 0, 0, 1418128, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 868, 808, 75721, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 868, 808, 75721, 0}  (24, {20, 48, new_msg, 0, 0, 1418128, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 868, 808, 75721, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03212   808   NtTerminateProcess  (-1, 0, ...