Summary:


NtAccessCheck(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtQueryDefaultLocale(>) 
 6 
NtOpenProcess(>) 
 26 

NtAddAtom(>) 
 1 
NtGdiHfontCreate(>) 
 2 
NtQuerySymbolicLinkObject(>) 
 6 
NtQueryInformationFile(>) 
 27 

NtCallbackReturn(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtUserGetProcessWindowStation(>) 
 6 
NtCreateSection(>) 
 29 

NtConnectPort(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtWriteFile(>) 
 6 
NtReadVirtualMemory(>) 
 30 

NtCreateProcessEx(>) 
 1 
NtRaiseException(>) 
 2 
NtUserCallNoParam(>) 
 7 
NtReleaseSemaphore(>) 
 31 

NtDeleteValueKey(>) 
 1 
NtResumeThread(>) 
 2 
NtQueryDefaultUILanguage(>) 
 8 
NtSetInformationProcess(>) 
 31 

NtGdiCreateBitmap(>) 
 1 
NtTerminateProcess(>) 
 2 
NtQueryVolumeInformationFile(>) 
 9 
NtWaitForSingleObject(>) 
 35 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtUserCloseDesktop(>) 
 2 
NtUserBuildHwndList(>) 
 9 
NtUnmapViewOfSection(>) 
 46 

NtGdiInit(>) 
 1 
NtUserCreateWindowEx(>) 
 2 
NtContinue(>) 
 10 
NtUserUnregisterClass(>) 
 46 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserDestroyWindow(>) 
 2 
NtSetInformationFile(>) 
 10 
NtUserFindExistingCursorIcon(>) 
 48 

NtGdiSelectBitmap(>) 
 1 
NtUserMessageCall(>) 
 2 
NtUserGetWindowDC(>) 
 10 
NtOpenSection(>) 
 50 

NtNotifyChangeKey(>) 
 1 
NtAdjustPrivilegesToken(>) 
 3 
NtFlushInstructionCache(>) 
 11 
NtQueryInformationProcess(>) 
 51 

NtOpenKeyedEvent(>) 
 1 
NtCreateMutant(>) 
 3 
NtQuerySection(>) 
 11 
NtDeviceIoControlFile(>) 
 55 

NtQueryInformationJobObject(>) 
 1 
NtEnumerateValueKey(>) 
 3 
NtUserCallOneParam(>) 
 11 
NtOpenProcessTokenEx(>) 
 60 

NtQueryObject(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtUserSystemParametersInfo(>) 
 11 
NtOpenThreadTokenEx(>) 
 60 

NtQueryPerformanceCounter(>) 
 1 
NtGdiDeleteObjectApp(>) 
 3 
NtRequestWaitReplyPort(>) 
 12 
NtWriteVirtualMemory(>) 
 61 

NtQuerySystemTime(>) 
 1 
NtOpenEvent(>) 
 3 
NtFsControlFile(>) 
 13 
NtUserRegisterClassExWOW(>) 
 64 

NtRegisterThreadTerminatePort(>) 
 1 
NtOpenMutant(>) 
 3 
NtLockFile(>) 
 13 
NtQueryAttributesFile(>) 
 68 

NtSecureConnectPort(>) 
 1 
NtSetEvent(>) 
 3 
NtUnlockFile(>) 
 13 
NtQueryInformationToken(>) 
 72 

NtSetSecurityObject(>) 
 1 
NtUserGetObjectInformation(>) 
 3 
NtOpenProcessToken(>) 
 15 
NtQueryKey(>) 
 73 

NtTestAlert(>) 
 1 
NtUserOpenDesktop(>) 
 3 
NtSetValueKey(>) 
 15 
NtUserGetClassInfo(>) 
 82 

NtUserBuildNameList(>) 
 1 
NtUserRemoveProp(>) 
 3 
NtCreateEvent(>) 
 16 
NtQuerySystemInformation(>) 
 89 

NtUserGetAtomName(>) 
 1 
NtWaitForMultipleObjects(>) 
 3 
NtQueryDebugFilterState(>) 
 16 
NtOpenFile(>) 
 90 

NtUserGetDC(>) 
 1 
NtQueryVirtualMemory(>) 
 4 
NtQueryDirectoryFile(>) 
 17 
NtAllocateVirtualMemory(>) 
 92 

NtUserGetForegroundWindow(>) 
 1 
NtReleaseMutant(>) 
 4 
NtReadFile(>) 
 18 
NtMapViewOfSection(>) 
 93 

NtUserGetGUIThreadInfo(>) 
 1 
NtSetInformationObject(>) 
 4 
NtCreateFile(>) 
 19 
NtProtectVirtualMemory(>) 
 98 

NtUserGetThreadDesktop(>) 
 1 
NtUserFindWindowEx(>) 
 4 
NtFreeVirtualMemory(>) 
 19 
NtQueryValueKey(>) 
 125 

NtUserSetProp(>) 
 1 
NtDuplicateObject(>) 
 5 
NtSetInformationThread(>) 
 19 
NtOpenKey(>) 
 288 

NtCreateIoCompletion(>) 
 2 
NtGdiGetStockObject(>) 
 5 
NtUserRegisterWindowMessage(>) 
 19 
NtUserQueryWindow(>) 
 290 

NtCreateThread(>) 
 2 
NtCreateSemaphore(>) 
 6 
NtCreateKey(>) 
 22 
NtClose(>) 
 438 

NtEnumerateKey(>) 
 2 
NtOpenSymbolicLinkObject(>) 
 6 
NtOpenThreadToken(>) 
 22 

Trace:
 00001   432   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   432   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1376256, 1048576, ) == 0x0
 00005   432   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0
 00006   432   NtAllocateVirtualMemory  (-1, 1380352, 0, 8192, 4096, 4, ... 1380352, 8192, ) == 0x0
 00007   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   432   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2424832, 65536, ) == 0x0
 00009   432   NtAllocateVirtualMemory  (-1, 2424832, 0, 24576, 4096, 4, ... 2424832, 24576, ) == 0x0
 00010   432   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   432   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   432   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   432   NtClose  (12, ... ) == 0x0
 00014   432   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   432   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   432   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   432   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   432   NtClose  (16, ... ) == 0x0
 00021   432   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   432   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   432   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1385272, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2490368, 18481152}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1385272, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2490368, 18481152}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   432   NtClose  (16, ... ) == 0x0
 00026   432   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   432   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   432   NtQueryVirtualMemory  (-1, 0x260000, Basic, 28, ... {BaseAddress=0x260000,AllocationBase=0x260000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   432   NtAllocateVirtualMemory  (-1, 2490368, 0, 4096, 4096, 4, ... 2490368, 4096, ) == 0x0
 00031   432   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" ... {28, 56, reply, 0, 424, 432, 1525, 0} "\330\375\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" )  ... {28, 56, reply, 0, 424, 432, 1525, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" ... {28, 56, reply, 0, 424, 432, 1525, 0} "\330\375\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" )  ) == 0x0
 00032   432   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   432   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   432   NtClose  (16, ... ) == 0x0
 00036   432   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   432   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   432   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   432   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x270000), 0x0, 90112, ) == 0x0
 00040   432   NtClose  (28, ... ) == 0x0
 00041   432   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   432   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   432   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x290000), 0x0, 212992, ) == 0x0
 00044   432   NtClose  (28, ... ) == 0x0
 00045   432   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   432   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2d0000), 0x0, 266240, ) == 0x0
 00047   432   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   432   NtClose  (28, ... ) == 0x0
 00049   432   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   432   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x320000), 0x0, 24576, ) == 0x0
 00051   432   NtClose  (28, ... ) == 0x0
 00052   432   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   432   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   432   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   432   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" ... {28, 56, reply, 0, 424, 432, 1531, 0} "\240B\27\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" )  ... {28, 56, reply, 0, 424, 432, 1531, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" ... {28, 56, reply, 0, 424, 432, 1531, 0} "\240B\27\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" )  ) == 0x0
 00056   432   NtProtectVirtualMemory  (-1, (0x45c000), 212992, 4, ... (0x45c000), 212992, 128, ) == 0x0
 00057   432   NtProtectVirtualMemory  (-1, (0x45c000), 212992, 128, ... (0x45c000), 212992, 4, ) == 0x0
 00058   432   NtFlushInstructionCache  (-1, 4571136, 212992, ... ) == 0x0
 00059   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   432   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00061   432   NtClose  (28, ... ) == 0x0
 00062   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   432   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   432   NtClose  (28, ... ) == 0x0
 00065   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   432   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00067   432   NtClose  (28, ... ) == 0x0
 00068   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   432   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00070   432   NtClose  (28, ... ) == 0x0
 00071   432   NtProtectVirtualMemory  (-1, (0x45c000), 212992, 4, ... (0x45c000), 212992, 64, ) == 0x0
 00072   432   NtProtectVirtualMemory  (-1, (0x45c000), 212992, 64, ... (0x45c000), 212992, 4, ) == 0x0
 00073   432   NtFlushInstructionCache  (-1, 4571136, 212992, ... ) == 0x0
 00074   432   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00075   432   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00076   432   NtClose  (28, ... ) == 0x0
 00077   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00078   432   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00079   432   NtClose  (28, ... ) == 0x0
 00080   432   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 00081   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00082   432   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00083   432   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00084   432   NtClose  (28, ... ) == 0x0
 00085   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00086   432   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00087   432   NtClose  (28, ... ) == 0x0
 00088   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00089   432   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00090   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00091   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00092   432   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\32\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\32\1$\1\0\0" ... {28, 56, reply, 0, 424, 432, 1558, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\32\1$\1\0\0" )  ... {28, 56, reply, 0, 424, 432, 1558, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\32\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\32\1$\1\0\0" ... {28, 56, reply, 0, 424, 432, 1558, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\32\1$\1\0\0" )  ) == 0x0
 00093   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00094   432   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4a0000), 0x0, 1060864, ) == 0x0
 00095   432   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00096   432   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00097   432   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482012, ) == 0x0
 00098   432   NtQueryInformationToken  (-2147482012, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00099   432   NtQueryInformationToken  (-2147482012, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00100   432   NtClose  (-2147482012, ... ) == 0x0
 00101   432   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5963776, 4096, ) == 0x0
 00102   432   NtFreeVirtualMemory  (-1, (0x5b0000), 4096, 32768, ... (0x5b0000), 4096, ) == 0x0
 00103   432   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00104   432   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0
 00105   432   NtQueryValueKey  (-2147482012,  (-2147482012, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00106   432   NtClose  (-2147482012, ... ) == 0x0
 00107   432   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0
 00108   432   NtQueryValueKey  (-2147482012,  (-2147482012, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00109   432   NtClose  (-2147482012, ... ) == 0x0
 00110   432   NtQueryDefaultLocale  (0, -104158708, ... ) == 0x0
 00111   432   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00112   432   NtUserCallNoParam  (24, ... ) == 0x0
 00113   432   NtGdiCreateCompatibleDC  (0, ...
 00114   432   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5963776, 4096, ) == 0x0
 00113   432   NtGdiCreateCompatibleDC  ... ) == 0xe010448
 00115   432   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00116   432   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00117   432   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0xb05044f
 00118   432   NtGdiCreateSolidBrush  (0, 0, ...
 00119   432   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 9175040, 4096, ) == 0x0
 00118   432   NtGdiCreateSolidBrush  ... ) == 0x8100452
 00120   432   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00121   432   NtGdiCreateCompatibleDC  (0, ... ) == 0x6010453
 00122   432   NtGdiSelectBitmap  (100729939, 184878159, ... ) == 0x185000f
 00123   432   NtUserGetThreadDesktop  (432, 0, ... ) == 0x2c
 00124   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00125   432   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00126   432   NtClose  (52, ... ) == 0x0
 00127   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00128   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810dc017
 00129   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00130   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810dc01c
 00131   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00132   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810dc01e
 00133   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00134   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810d8002
 00135   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00136   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810dc018
 00137   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00138   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810dc01a
 00139   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00140   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810dc01d
 00141   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00142   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... ) == 0x810dc026
 00143   432   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00144   432   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810dc019
 00145   432   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc020
 00146   432   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc022
 00147   432   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc023
 00148   432   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc024
 00149   432   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ...
 00150   432   NtAllocateVirtualMemory  (-1, 6139904, 0, 4096, 4096, 32, ... 6139904, 4096, ) == 0x0
 00149   432   NtUserRegisterClassExWOW  ... ) == 0x810dc025
 00151   432   NtCallbackReturn  (0, 0, 0, ...
 00152   432   NtGdiInit  (... ) == 0x1
 00153   432   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00154   432   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00155   432   NtAllocateVirtualMemory  (-1, 0, 0, 18306, 4096, 4, ... 9240576, 20480, ) == 0x0
 00156   432   NtFreeVirtualMemory  (-1, (0x8d0000), 0, 32768, ... (0x8d0000), 20480, ) == 0x0
 00157   432   NtQueryVirtualMemory  (-1, 0x401000, Basic, 52, ... {BaseAddress=0x401000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x22000,State=0x1000,Protect=0x80,Type=0x1000000,}, 28, ) == 0x0
 00158   432   NtQueryVirtualMemory  (-1, 0x451e53, Basic, 28, ... {BaseAddress=0x451000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0xb000,State=0x1000,Protect=0x4,Type=0x1000000,}, 28, ) == 0x0
 00159   432   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 00160   432   NtProtectVirtualMemory  (-1, (0x4001f8), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00161   432   NtProtectVirtualMemory  (-1, (0x4001f8), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00162   432   NtProtectVirtualMemory  (-1, (0x400220), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00163   432   NtProtectVirtualMemory  (-1, (0x400220), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00164   432   NtProtectVirtualMemory  (-1, (0x400248), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00165   432   NtProtectVirtualMemory  (-1, (0x400248), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00166   432   NtProtectVirtualMemory  (-1, (0x400270), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00167   432   NtProtectVirtualMemory  (-1, (0x400270), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00168   432   NtProtectVirtualMemory  (-1, (0x400298), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00169   432   NtProtectVirtualMemory  (-1, (0x400298), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00170   432   NtProtectVirtualMemory  (-1, (0x4002c0), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00171   432   NtProtectVirtualMemory  (-1, (0x4002c0), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00172   432   NtProtectVirtualMemory  (-1, (0x4002e8), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00173   432   NtProtectVirtualMemory  (-1, (0x4002e8), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00174   432   NtProtectVirtualMemory  (-1, (0x400310), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00175   432   NtProtectVirtualMemory  (-1, (0x400310), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00176   432   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 00177   432   NtUserFindWindowEx  (0, 0,  (0, 0, "WispWindowClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 00178   432   NtUserBuildHwndList  (0, 0, 0, 0, 64, ... (0x30048, 0x100de, 0x100a6, 0x100a4, 0x6002c, 0x20064, 0x20062, 0x10084, 0x10078, 0x10068, 0x30046, 0x10066, 0x30038, 0x1009c, 0x10090, 0x10080, 0x10026, 0x100da, 0x100d0, 0x100be, 0x100bc, 0x100ba, 0x100b8, 0x100b6, 0x100b4, 0x100b0, 0x100ae, 0x2005e, 0x100aa, 0x100cc, 0x100c2, 0x100c0, 0x100ac, 0x10070, 0x5004a, 0x4004e, 0x8002a, 0x10082, 0x1007a, 0x1, ), 40, ) == 0x0
 00179   432   NtUserQueryWindow  (196680, 0, ... ) == 0x778
 00180   432   NtUserQueryWindow  (196680, 1, ... ) == 0x79c
 00181   432   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {1912, 0}, ... 52, ) == 0x0
 00182   432   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 64, ) , 64, ) == 0x0
 00183   432   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...
 00184   432   NtContinue  (-104162148, 0, ...
 00183   432   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00185   432   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...
 00186   432   NtContinue  (-104162148, 0, ...
 00185   432   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00187   432   NtClose  (52, ... ) == 0x0
 00188   432   NtUserQueryWindow  (65758, 0, ... ) == 0x778
 00189   432   NtUserQueryWindow  (65758, 1, ... ) == 0x79c
 00190   432   NtUserQueryWindow  (65702, 0, ... ) == 0x7e0
 00191   432   NtUserQueryWindow  (65702, 1, ... ) == 0x7e4
 00192   432   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {2016, 0}, ... 52, ) == 0x0
 00193   432   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \1\0\0", 64, ) , 64, ) == 0x0
 00194   432   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...  (52, 0x4b1c86, 4, ... "\0\0\0\0", 4, ) , 4, ) == 0x0
 00195   432   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...  (52, 0x4c91a0, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 00196   432   NtClose  (52, ... ) == 0x0
 00197   432   NtUserQueryWindow  (65700, 0, ... ) == 0x7e0
 00198   432   NtUserQueryWindow  (65700, 1, ... ) == 0x7e4
 00199   432   NtUserQueryWindow  (393260, 0, ... ) == 0x7e0
 00200   432   NtUserQueryWindow  (393260, 1, ... ) == 0x7e4
 00201   432   NtUserQueryWindow  (131172, 0, ... ) == 0x7e0
 00202   432   NtUserQueryWindow  (131172, 1, ... ) == 0x7e4
 00203   432   NtUserQueryWindow  (131170, 0, ... ) == 0x778
 00204   432   NtUserQueryWindow  (131170, 1, ... ) == 0x79c
 00205   432   NtUserQueryWindow  (65668, 0, ... ) == 0x778
 00206   432   NtUserQueryWindow  (65668, 1, ... ) == 0x79c
 00207   432   NtUserQueryWindow  (65656, 0, ... ) == 0x778
 00208   432   NtUserQueryWindow  (65656, 1, ... ) == 0x79c
 00209   432   NtUserQueryWindow  (65640, 0, ... ) == 0x778
 00210   432   NtUserQueryWindow  (65640, 1, ... ) == 0x79c
 00211   432   NtUserQueryWindow  (196678, 0, ... ) == 0x778
 00212   432   NtUserQueryWindow  (196678, 1, ... ) == 0x79c
 00213   432   NtUserQueryWindow  (65638, 0, ... ) == 0x778
 00214   432   NtUserQueryWindow  (65638, 1, ... ) == 0x79c
 00215   432   NtUserQueryWindow  (196664, 0, ... ) == 0x778
 00216   432   NtUserQueryWindow  (196664, 1, ... ) == 0x79c
 00217   432   NtUserQueryWindow  (65692, 0, ... ) == 0x778
 00218   432   NtUserQueryWindow  (65692, 1, ... ) == 0x79c
 00219   432   NtUserQueryWindow  (65680, 0, ... ) == 0x778
 00220   432   NtUserQueryWindow  (65680, 1, ... ) == 0x79c
 00221   432   NtUserQueryWindow  (65664, 0, ... ) == 0x778
 00222   432   NtUserQueryWindow  (65664, 1, ... ) == 0x77c
 00223   432   NtUserQueryWindow  (65574, 0, ... ) == 0x26c
 00224   432   NtUserQueryWindow  (65574, 1, ... ) == 0x2c8
 00225   432   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {620, 0}, ... 52, ) == 0x0
 00226   432   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 64, ) , 64, ) == 0x0
 00227   432   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...  (52, 0x4b1c86, 4, ... "\0\0\0\0", 4, ) , 4, ) == 0x0
 00228   432   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...  (52, 0x4c91a0, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 00229   432   NtClose  (52, ... ) == 0x0
 00230   432   NtUserQueryWindow  (65754, 0, ... ) == 0x108
 00231   432   NtUserQueryWindow  (65754, 1, ... ) == 0x10c
 00232   432   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {264, 0}, ... 52, ) == 0x0
 00233   432   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 64, ) , 64, ) == 0x0
 00234   432   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...
 00235   432   NtContinue  (-104162148, 0, ...
 00234   432   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00236   432   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...
 00237   432   NtContinue  (-104162148, 0, ...
 00236   432   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00238   432   NtClose  (52, ... ) == 0x0
 00239   432   NtUserQueryWindow  (65744, 0, ... ) == 0x108
 00240   432   NtUserQueryWindow  (65744, 1, ... ) == 0x10c
 00241   432   NtUserQueryWindow  (65726, 0, ... ) == 0x7e8
 00242   432   NtUserQueryWindow  (65726, 1, ... ) == 0x7ec
 00243   432   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 52, ) == 0x0
 00244   432   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0", 64, ) , 64, ) == 0x0
 00245   432   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...  (52, 0x4b1c86, 4, ... "\377\0\377\377", 4, ) , 4, ) == 0x0
 00246   432   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...  (52, 0x4c91a0, 256, ... "\210fvx\210x\206wfvGe$\306d\21\26\210ls\210\210\250g\207\210hhx\207xhvwdfF|d\21\27\210\206hx\250\252\206\210\207v\207\210x\207\207gfv4F\306G\21\21\210\206\207\210\212\250\250h\210\207x\210\210wvwgFD$d!\21\21x\250g\210\212\252\250\206\210\207w\210\207\207wvvgBGd\21\21\21\210\212\203\210\250\252\212\210x\210w\210\210xwgcd%F\1\21\21\21\27\212\250\210\212\252\252\210f\210\207x\210\207w7fR@`\21\21\21\21\21\210\2508\212\252\250\250\210gw\21088vvu$$!\21\21\21\21\21\30\210\210\210\212\252\210\206vgw\210\203wsb`\7\21\21\21\21\21\21\21\210\203\210\210\210\210\207vvwwwsf4\7\21\21\21\21\21\21\21\21\30\210\210\210\210\210wGwvwww5\2\21\21\21\21\21\21", 256, ) , 256, ) == 0x0
 00247   432   NtClose  (52, ... ) == 0x0
 00248   432   NtUserQueryWindow  (65724, 0, ... ) == 0x7e8
 00249   432   NtUserQueryWindow  (65724, 1, ... ) == 0x7ec
 00250   432   NtUserQueryWindow  (65722, 0, ... ) == 0x7e8
 00251   432   NtUserQueryWindow  (65722, 1, ... ) == 0x7ec
 00252   432   NtUserQueryWindow  (65720, 0, ... ) == 0x7e8
 00253   432   NtUserQueryWindow  (65720, 1, ... ) == 0x7ec
 00254   432   NtUserQueryWindow  (65718, 0, ... ) == 0x7e8
 00255   432   NtUserQueryWindow  (65718, 1, ... ) == 0x7ec
 00256   432   NtUserQueryWindow  (65716, 0, ... ) == 0x7e8
 00257   432   NtUserQueryWindow  (65716, 1, ... ) == 0x7ec
 00258   432   NtUserQueryWindow  (65712, 0, ... ) == 0x7e8
 00259   432   NtUserQueryWindow  (65712, 1, ... ) == 0x7ec
 00260   432   NtUserQueryWindow  (65710, 0, ... ) == 0x7e8
 00261   432   NtUserQueryWindow  (65710, 1, ... ) == 0x7ec
 00262   432   NtUserQueryWindow  (131166, 0, ... ) == 0x7d8
 00263   432   NtUserQueryWindow  (131166, 1, ... ) == 0x7dc
 00264   432   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {2008, 0}, ... 52, ) == 0x0
 00265   432   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0", 64, ) , 64, ) == 0x0
 00266   432   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...
 00267   432   NtContinue  (-104162148, 0, ...
 00266   432   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00268   432   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...
 00269   432   NtContinue  (-104162148, 0, ...
 00268   432   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00270   432   NtClose  (52, ... ) == 0x0
 00271   432   NtUserQueryWindow  (65706, 0, ... ) == 0x7f4
 00272   432   NtUserQueryWindow  (65706, 1, ... ) == 0x7f8
 00273   432   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {2036, 0}, ... 52, ) == 0x0
 00274   432   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "\301\0\0\0\0\1\0\0\377\356\377\356\11\0\0\0\11\0\0\0\0\376\0\0\0\0\20\0\0 \0\0\0\2\0\0\0 \0\0q\0\0\0\377\357\375\177\0\0\10\6\0\0\0\0\0\0\0\0\0\0\0\0", 64, ) , 64, ) == 0x0
 00275   432   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...  (52, 0x4b1c86, 4, ... "\0\0\0\0", 4, ) , 4, ) == 0x0
 00276   432   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...  (52, 0x4c91a0, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 00277   432   NtClose  (52, ... ) == 0x0
 00278   432   NtUserQueryWindow  (65740, 0, ... ) == 0x778
 00279   432   NtUserQueryWindow  (65740, 1, ... ) == 0x118
 00280   432   NtUserQueryWindow  (65730, 0, ... ) == 0x778
 00281   432   NtUserQueryWindow  (65730, 1, ... ) == 0x118
 00282   432   NtUserQueryWindow  (65728, 0, ... ) == 0x778
 00283   432   NtUserQueryWindow  (65728, 1, ... ) == 0x79c
 00284   432   NtUserQueryWindow  (65708, 0, ... ) == 0x7e0
 00285   432   NtUserQueryWindow  (65708, 1, ... ) == 0x7e4
 00286   432   NtUserQueryWindow  (65648, 0, ... ) == 0x778
 00287   432   NtUserQueryWindow  (65648, 1, ... ) == 0x7c8
 00288   432   NtUserQueryWindow  (327754, 0, ... ) == 0x778
 00289   432   NtUserQueryWindow  (327754, 1, ... ) == 0x77c
 00290   432   NtUserQueryWindow  (262222, 0, ... ) == 0x778
 00291   432   NtUserQueryWindow  (262222, 1, ... ) == 0x77c
 00292   432   NtUserQueryWindow  (524330, 0, ... ) == 0x778
 00293   432   NtUserQueryWindow  (524330, 1, ... ) == 0x77c
 00294   432   NtUserQueryWindow  (65666, 0, ... ) == 0x778
 00295   432   NtUserQueryWindow  (65666, 1, ... ) == 0x77c
 00296   432   NtUserQueryWindow  (65658, 0, ... ) == 0x778
 00297   432   NtUserQueryWindow  (65658, 1, ... ) == 0x77c
 00298   432   NtRaiseException  (1242696, 1241956, 1, ...
 00299   432   NtContinue  (1240752, 0, ...
 00300   432   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00301   432   NtOpenMutant  (0x120001, {24, 52, 0x2, 0, 0,  (0x120001, {24, 52, 0x2, 0, 0, "DBWinMutex"}, ... 56, ) }, ... 56, ) == 0x0
 00302   432   NtWaitForSingleObject  (56, 0, 0x0, ... ) == 0x0
 00303   432   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "DBWIN_BUFFER"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00304   432   NtReleaseMutant  (56, ... 0x0, ) == 0x0
 00305   432   NtDuplicateObject  (-1, 2486, -1, 0x0, 0, 2, ... ) == STATUS_INVALID_HANDLE
 00306   432   NtClose  (0, ... ) == STATUS_INVALID_HANDLE
 00307   432   NtClose  (0, ... ) == STATUS_INVALID_HANDLE
 00308   432   NtUserBuildHwndList  (0, 0, 0, 0, 64, ... (0x30048, 0x100de, 0x100a6, 0x100a4, 0x6002c, 0x20064, 0x20062, 0x10084, 0x10078, 0x10068, 0x30046, 0x10066, 0x30038, 0x1009c, 0x10090, 0x10080, 0x10026, 0x100da, 0x100d0, 0x100be, 0x100bc, 0x100ba, 0x100b8, 0x100b6, 0x100b4, 0x100b0, 0x100ae, 0x2005e, 0x100aa, 0x100cc, 0x100c2, 0x100c0, 0x100ac, 0x10070, 0x5004a, 0x4004e, 0x8002a, 0x10082, 0x1007a, 0x1, ), 40, ) == 0x0
 00309   432   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 00310   432   NtUserFindWindowEx  (0, 0,  (0, 0, "WispWindowClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 00311   432   NtUserBuildHwndList  (0, 0, 0, 0, 64, ... (0x30048, 0x100de, 0x100a6, 0x100a4, 0x6002c, 0x20064, 0x20062, 0x10084, 0x10078, 0x10068, 0x30046, 0x10066, 0x30038, 0x1009c, 0x10090, 0x10080, 0x10026, 0x100da, 0x100d0, 0x100be, 0x100bc, 0x100ba, 0x100b8, 0x100b6, 0x100b4, 0x100b0, 0x100ae, 0x2005e, 0x100aa, 0x100cc, 0x100c2, 0x100c0, 0x100ac, 0x10070, 0x5004a, 0x4004e, 0x8002a, 0x10082, 0x1007a, 0x1, ), 40, ) == 0x0
 00312   432   NtUserQueryWindow  (196680, 0, ... ) == 0x778
 00313   432   NtUserQueryWindow  (196680, 1, ... ) == 0x79c
 00314   432   NtUserQueryWindow  (65758, 0, ... ) == 0x778
 00315   432   NtUserQueryWindow  (65758, 1, ... ) == 0x79c
 00316   432   NtUserQueryWindow  (65702, 0, ... ) == 0x7e0
 00317   432   NtUserQueryWindow  (65702, 1, ... ) == 0x7e4
 00318   432   NtUserQueryWindow  (65700, 0, ... ) == 0x7e0
 00319   432   NtUserQueryWindow  (65700, 1, ... ) == 0x7e4
 00320   432   NtUserQueryWindow  (393260, 0, ... ) == 0x7e0
 00321   432   NtUserQueryWindow  (393260, 1, ... ) == 0x7e4
 00322   432   NtUserQueryWindow  (131172, 0, ... ) == 0x7e0
 00323   432   NtUserQueryWindow  (131172, 1, ... ) == 0x7e4
 00324   432   NtUserQueryWindow  (131170, 0, ... ) == 0x778
 00325   432   NtUserQueryWindow  (131170, 1, ... ) == 0x79c
 00326   432   NtUserQueryWindow  (65668, 0, ... ) == 0x778
 00327   432   NtUserQueryWindow  (65668, 1, ... ) == 0x79c
 00328   432   NtUserQueryWindow  (65656, 0, ... ) == 0x778
 00329   432   NtUserQueryWindow  (65656, 1, ... ) == 0x79c
 00330   432   NtUserQueryWindow  (65640, 0, ... ) == 0x778
 00331   432   NtUserQueryWindow  (65640, 1, ... ) == 0x79c
 00332   432   NtUserQueryWindow  (196678, 0, ... ) == 0x778
 00333   432   NtUserQueryWindow  (196678, 1, ... ) == 0x79c
 00334   432   NtUserQueryWindow  (65638, 0, ... ) == 0x778
 00335   432   NtUserQueryWindow  (65638, 1, ... ) == 0x79c
 00336   432   NtUserQueryWindow  (196664, 0, ... ) == 0x778
 00337   432   NtUserQueryWindow  (196664, 1, ... ) == 0x79c
 00338   432   NtUserQueryWindow  (65692, 0, ... ) == 0x778
 00339   432   NtUserQueryWindow  (65692, 1, ... ) == 0x79c
 00340   432   NtUserQueryWindow  (65680, 0, ... ) == 0x778
 00341   432   NtUserQueryWindow  (65680, 1, ... ) == 0x79c
 00342   432   NtUserQueryWindow  (65664, 0, ... ) == 0x778
 00343   432   NtUserQueryWindow  (65664, 1, ... ) == 0x77c
 00344   432   NtUserQueryWindow  (65574, 0, ... ) == 0x26c
 00345   432   NtUserQueryWindow  (65574, 1, ... ) == 0x2c8
 00346   432   NtUserQueryWindow  (65754, 0, ... ) == 0x108
 00347   432   NtUserQueryWindow  (65754, 1, ... ) == 0x10c
 00348   432   NtUserQueryWindow  (65744, 0, ... ) == 0x108
 00349   432   NtUserQueryWindow  (65744, 1, ... ) == 0x10c
 00350   432   NtUserQueryWindow  (65726, 0, ... ) == 0x7e8
 00351   432   NtUserQueryWindow  (65726, 1, ... ) == 0x7ec
 00352   432   NtUserQueryWindow  (65724, 0, ... ) == 0x7e8
 00353   432   NtUserQueryWindow  (65724, 1, ... ) == 0x7ec
 00354   432   NtUserQueryWindow  (65722, 0, ... ) == 0x7e8
 00355   432   NtUserQueryWindow  (65722, 1, ... ) == 0x7ec
 00356   432   NtUserQueryWindow  (65720, 0, ... ) == 0x7e8
 00357   432   NtUserQueryWindow  (65720, 1, ... ) == 0x7ec
 00358   432   NtUserQueryWindow  (65718, 0, ... ) == 0x7e8
 00359   432   NtUserQueryWindow  (65718, 1, ... ) == 0x7ec
 00360   432   NtUserQueryWindow  (65716, 0, ... ) == 0x7e8
 00361   432   NtUserQueryWindow  (65716, 1, ... ) == 0x7ec
 00362   432   NtUserQueryWindow  (65712, 0, ... ) == 0x7e8
 00363   432   NtUserQueryWindow  (65712, 1, ... ) == 0x7ec
 00364   432   NtUserQueryWindow  (65710, 0, ... ) == 0x7e8
 00365   432   NtUserQueryWindow  (65710, 1, ... ) == 0x7ec
 00366   432   NtUserQueryWindow  (131166, 0, ... ) == 0x7d8
 00367   432   NtUserQueryWindow  (131166, 1, ... ) == 0x7dc
 00368   432   NtUserQueryWindow  (65706, 0, ... ) == 0x7f4
 00369   432   NtUserQueryWindow  (65706, 1, ... ) == 0x7f8
 00370   432   NtUserQueryWindow  (65740, 0, ... ) == 0x778
 00371   432   NtUserQueryWindow  (65740, 1, ... ) == 0x118
 00372   432   NtUserQueryWindow  (65730, 0, ... ) == 0x778
 00373   432   NtUserQueryWindow  (65730, 1, ... ) == 0x118
 00374   432   NtUserQueryWindow  (65728, 0, ... ) == 0x778
 00375   432   NtUserQueryWindow  (65728, 1, ... ) == 0x79c
 00376   432   NtUserQueryWindow  (65708, 0, ... ) == 0x7e0
 00377   432   NtUserQueryWindow  (65708, 1, ... ) == 0x7e4
 00378   432   NtUserQueryWindow  (65648, 0, ... ) == 0x778
 00379   432   NtUserQueryWindow  (65648, 1, ... ) == 0x7c8
 00380   432   NtUserQueryWindow  (327754, 0, ... ) == 0x778
 00381   432   NtUserQueryWindow  (327754, 1, ... ) == 0x77c
 00382   432   NtUserQueryWindow  (262222, 0, ... ) == 0x778
 00383   432   NtUserQueryWindow  (262222, 1, ... ) == 0x77c
 00384   432   NtUserQueryWindow  (524330, 0, ... ) == 0x778
 00385   432   NtUserQueryWindow  (524330, 1, ... ) == 0x77c
 00386   432   NtUserQueryWindow  (65666, 0, ... ) == 0x778
 00387   432   NtUserQueryWindow  (65666, 1, ... ) == 0x77c
 00388   432   NtUserQueryWindow  (65658, 0, ... ) == 0x778
 00389   432   NtUserQueryWindow  (65658, 1, ... ) == 0x77c
 00390   432   NtRaiseException  (1242640, 1241900, 1, ...
 00391   432   NtContinue  (1240696, 0, ...
 00392   432   NtWaitForSingleObject  (56, 0, 0x0, ... ) == 0x0
 00393   432   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "DBWIN_BUFFER"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00394   432   NtReleaseMutant  (56, ... 0x0, ) == 0x0
 00395   432   NtDuplicateObject  (-1, 3102, -1, 0x0, 0, 2, ... ) == STATUS_INVALID_HANDLE
 00396   432   NtClose  (0, ... ) == STATUS_INVALID_HANDLE
 00397   432   NtClose  (0, ... ) == STATUS_INVALID_HANDLE
 00398   432   NtUserBuildHwndList  (0, 0, 0, 0, 64, ... (0x30048, 0x100de, 0x100a6, 0x100a4, 0x6002c, 0x20064, 0x20062, 0x10084, 0x10078, 0x10068, 0x30046, 0x10066, 0x30038, 0x1009c, 0x10090, 0x10080, 0x10026, 0x100da, 0x100d0, 0x100be, 0x100bc, 0x100ba, 0x100b8, 0x100b6, 0x100b4, 0x100b0, 0x100ae, 0x2005e, 0x100aa, 0x100cc, 0x100c2, 0x100c0, 0x100ac, 0x10070, 0x5004a, 0x4004e, 0x8002a, 0x10082, 0x1007a, 0x1, ), 40, ) == 0x0
 00399   432   NtSetSecurityObject  (-1, 4, {1, 0, 0x4, 0, 0, 0, 1242476}, ... ) == 0x0
 00400   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 60, ) }, ... 60, ) == 0x0
 00401   432   NtQueryValueKey  (60,  (60, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00402   432   NtClose  (60, ... ) == 0x0
 00403   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.dll"}, ... 60, ) }, ... 60, ) == 0x0
 00404   432   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 69632, ) == 0x0
 00405   432   NtClose  (60, ... ) == 0x0
 00406   432   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 60, ) == 0x0
 00407   432   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 00408   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 68, ) }, ... 68, ) == 0x0
 00409   432   NtNotifyChangeKey  (68, 64, 0, 0, 2011390432, 4, 0, 0, 0, 1, ... ) == 0x103
 00410   432   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00411   432   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 72, ) == 0x0
 00412   432   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 76, ) == 0x0
 00413   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ODBC32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00414   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\ODBC32.dll"}, 1241484, ... ) }, 1241484, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00415   432   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "ODBC32.dll"}, 1241484, ... ) }, 1241484, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00416   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ODBC32.dll"}, 1241484, ... ) }, 1241484, ... ) == 0x0
 00417   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ODBC32.dll"}, 5, 96, ... 80, {status=0x0, info=1}, ) }, 5, 96, ... 80, {status=0x0, info=1}, ) == 0x0
 00418   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 80, ... 84, ) == 0x0
 00419   432   NtQuerySection  (84, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00420   432   NtOpenProcessToken  (-1, 0x8, ... 88, ) == 0x0
 00421   432   NtQueryInformationToken  (88, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00422   432   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00423   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 92, ) }, ... 92, ) == 0x0
 00424   432   NtQueryValueKey  (92,  (92, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (92, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00425   432   NtClose  (92, ... ) == 0x0
 00426   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00427   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 92, ) == 0x0
 00428   432   NtQueryInformationToken  (92, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00429   432   NtClose  (92, ... ) == 0x0
 00430   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00431   432   NtClose  (88, ... ) == 0x0
 00432   432   NtClose  (80, ... ) == 0x0
 00433   432   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x1f7b0000), 0x0, 200704, ) == 0x0
 00434   432   NtClose  (84, ... ) == 0x0
 00435   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00436   432   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00437   432   NtClose  (84, ... ) == 0x0
 00438   432   NtProtectVirtualMemory  (-1, (0x1f7b1000), 724, 4, ... (0x1f7b1000), 4096, 32, ) == 0x0
 00439   432   NtProtectVirtualMemory  (-1, (0x1f7b1000), 4096, 32, ... (0x1f7b1000), 4096, 4, ) == 0x0
 00440   432   NtFlushInstructionCache  (-1, 528158720, 724, ... ) == 0x0
 00441   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comdlg32.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00442   432   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x763b0000), 0x0, 282624, ) == 0x0
 00443   432   NtClose  (84, ... ) == 0x0
 00444   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00445   432   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0
 00446   432   NtClose  (84, ... ) == 0x0
 00447   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00448   432   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 00449   432   NtClose  (84, ... ) == 0x0
 00450   432   NtProtectVirtualMemory  (-1, (0x763b1000), 1536, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 00451   432   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 00452   432   NtFlushInstructionCache  (-1, 1983582208, 1536, ... ) == 0x0
 00453   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHELL32.dll"}, ... 84, ) }, ... 84, ) == 0x0
 00454   432   NtMapViewOfSection  (84, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 8339456, ) == 0x0
 00455   432   NtClose  (84, ... ) == 0x0
 00456   432   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {424, 0}, ... 84, ) == 0x0
 00457   432   NtQueryInformationProcess  (84, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00458   432   NtClose  (84, ... ) == 0x0
 00459   432   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00460   432   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00461   432   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00462   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00463   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00464   432   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00465   432   NtClose  (84, ... ) == 0x0
 00466   432   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 84, ) }, ... 84, ) == 0x0
 00467   432   NtSetInformationObject  (84, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00468   432   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "Control Panel\Desktop"}, ... 80, ) }, ... 80, ) == 0x0
 00469   432   NtQueryValueKey  (80,  (80, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00470   432   NtClose  (80, ... ) == 0x0
 00471   432   NtUserSystemParametersInfo  (41, 500, 1241216, 0, ... ) == 0x1
 00472   432   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00473   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00474   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00475   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc03b
 00476   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00477   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc03d
 00478   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00479   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00480   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc03f
 00481   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00482   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00483   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc041
 00484   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00485   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00486   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc043
 00487   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00488   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc045
 00489   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00490   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00491   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc047
 00492   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00493   432   NtUserFindExistingCursorIcon  (1241004, 1241020, 1241588, ... ) == 0x10011
 00494   432   NtUserRegisterClassExWOW  (1241456, 1241536, 1241520, 1241552, 0, 384, 0, ... ) == 0x810dc049
 00495   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00496   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00497   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc04b
 00498   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00499   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00500   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc04d
 00501   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00502   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00503   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc04f
 00504   432   NtUserGetClassInfo  (1999896576, 1241628, 1241580, 1241656, 0, ... ) == 0x0
 00505   432   NtUserRegisterClassExWOW  (1241464, 1241544, 1241528, 1241560, 0, 384, 0, ... ) == 0x810dc051
 00506   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00507   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00508   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc053
 00509   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00510   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00511   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc055
 00512   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc057
 00513   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00514   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00515   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc059
 00516   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00517   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10013
 00518   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc05b
 00519   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00520   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00521   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc05d
 00522   432   NtUserGetClassInfo  (1999896576, 1241624, 1241576, 1241652, 0, ... ) == 0x0
 00523   432   NtUserFindExistingCursorIcon  (1241008, 1241024, 1241592, ... ) == 0x10011
 00524   432   NtUserRegisterClassExWOW  (1241460, 1241540, 1241524, 1241556, 0, 384, 0, ... ) == 0x810dc05f
 00525   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00526   432   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 9240576, 65536, ) == 0x0
 00527   432   NtAllocateVirtualMemory  (-1, 9240576, 0, 4096, 4096, 4, ... 9240576, 4096, ) == 0x0
 00528   432   NtAllocateVirtualMemory  (-1, 9244672, 0, 8192, 4096, 4, ... 9244672, 8192, ) == 0x0
 00529   432   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 80, ) }, ... 80, ) == 0x0
 00530   432   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x8e0000), 0x0, 12288, ) == 0x0
 00531   432   NtClose  (80, ... ) == 0x0
 00532   432   NtAllocateVirtualMemory  (-1, 9252864, 0, 4096, 4096, 4, ... 9252864, 4096, ) == 0x0
 00533   432   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00534   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 80, ) }, ... 80, ) == 0x0
 00535   432   NtQueryValueKey  (80,  (80, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00536   432   NtClose  (80, ... ) == 0x0
 00537   432   NtQueryDefaultUILanguage  (1239840, ...
 00538   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00539   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482012, ) == 0x0
 00540   432   NtQueryInformationToken  (-2147482012, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00541   432   NtClose  (-2147482012, ... ) == 0x0
 00542   432   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0
 00543   432   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00544   432   NtOpenKey  (0x80000000, {24, -2147482012, 0x640, 0, 0,  (0x80000000, {24, -2147482012, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0
 00545   432   NtQueryValueKey  (-2147482024,  (-2147482024, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00546   432   NtClose  (-2147482024, ... ) == 0x0
 00547   432   NtClose  (-2147482012, ... ) == 0x0
 00537   432   NtQueryDefaultUILanguage  ... ) == 0x0
 00548   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00549   432   NtQueryInstallUILanguage  (2012047340, ... ) == 0x0
 00550   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll"}, 1, 96, ... 80, {status=0x0, info=1}, ) }, 1, 96, ... 80, {status=0x0, info=1}, ) == 0x0
 00551   432   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 80, ... 88, ) == 0x0
 00552   432   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8f0000), 0x0, 8323072, ) == 0x0
 00553   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00554   432   NtQueryDefaultUILanguage  (2013024600, ...
 00555   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00556   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482012, ) == 0x0
 00557   432   NtQueryInformationToken  (-2147482012, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00558   432   NtClose  (-2147482012, ... ) == 0x0
 00559   432   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0
 00560   432   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00561   432   NtOpenKey  (0x80000000, {24, -2147482012, 0x640, 0, 0,  (0x80000000, {24, -2147482012, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0
 00562   432   NtQueryValueKey  (-2147482024,  (-2147482024, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00563   432   NtClose  (-2147482024, ... ) == 0x0
 00564   432   NtClose  (-2147482012, ... ) == 0x0
 00554   432   NtQueryDefaultUILanguage  ... ) == 0x0
 00565   432   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00566   432   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 00567   432   NtQueryDefaultLocale  (1, 1237876, ... ) == 0x0
 00568   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00569   432   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1238732, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1238732, 1, 96, 0} "\210\6\32\1\33\0\1\0\0\0\0\0\1\352\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1P\0\0\0\377\377\377\377\0\0\0\0\20\311\306\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0\314\355\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 432, 1568, 0} " S\26\0\33\0\1\0\0\0\0\0\1\352\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1P\0\0\0\377\377\377\377\0\0\0\0\20\311\306\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0\314\355\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 424, 432, 1568, 0}  (24, {128, 156, new_msg, 0, 1238732, 1, 96, 0} "\210\6\32\1\33\0\1\0\0\0\0\0\1\352\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1P\0\0\0\377\377\377\377\0\0\0\0\20\311\306\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0\314\355\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 432, 1568, 0} " S\26\0\33\0\1\0\0\0\0\0\1\352\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1P\0\0\0\377\377\377\377\0\0\0\0\20\311\306\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0\314\355\22\0\0\0\0\0" )  ) == 0x0
 00570   432   NtClose  (80, ... ) == 0x0
 00571   432   NtClose  (88, ... ) == 0x0
 00572   432   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 00573   432   NtUnmapViewOfSection  (-1, 0x12edcc, ... ) == STATUS_NOT_MAPPED_VIEW
 00574   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00575   432   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00576   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00577   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00578   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236960, ... ) }, 1236960, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00579   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00580   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00581   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00582   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1237552, ... ) }, 1237552, ... ) == 0x0
 00583   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 88, {status=0x0, info=1}, ) }, 3, 33, ... 88, {status=0x0, info=1}, ) == 0x0
 00584   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00585   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 80, {status=0x0, info=1}, ) }, 5, 96, ... 80, {status=0x0, info=1}, ) == 0x0
 00586   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 80, ... 92, ) == 0x0
 00587   432   NtClose  (80, ... ) == 0x0
 00588   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8f0000), 0x0, 921600, ) == 0x0
 00589   432   NtClose  (92, ... ) == 0x0
 00590   432   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 00591   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00592   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 92, ... 80, ) == 0x0
 00593   432   NtQuerySection  (80, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00594   432   NtClose  (92, ... ) == 0x0
 00595   432   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0
 00596   432   NtClose  (80, ... ) == 0x0
 00597   432   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00598   432   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00599   432   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00600   432   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00601   432   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00602   432   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00603   432   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00604   432   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00605   432   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00606   432   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00607   432   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00608   432   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00609   432   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00610   432   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00611   432   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00612   432   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00613   432   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00614   432   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00615   432   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00616   432   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00617   432   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00618   432   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1238736, ... ) , 42, 1238736, ... ) == 0x0
 00619   432   NtQueryDefaultUILanguage  (1237452, ...
 00620   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00621   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482012, ) == 0x0
 00622   432   NtQueryInformationToken  (-2147482012, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00623   432   NtClose  (-2147482012, ... ) == 0x0
 00624   432   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0
 00625   432   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00626   432   NtOpenKey  (0x80000000, {24, -2147482012, 0x640, 0, 0,  (0x80000000, {24, -2147482012, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0
 00627   432   NtQueryValueKey  (-2147482024,  (-2147482024, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00628   432   NtClose  (-2147482024, ... ) == 0x0
 00629   432   NtClose  (-2147482012, ... ) == 0x0
 00619   432   NtQueryDefaultUILanguage  ... ) == 0x0
 00630   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00631   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1236304, ... ) }, 1236304, ... ) == 0x0
 00632   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 80, {status=0x0, info=1}, ) }, 5, 96, ... 80, {status=0x0, info=1}, ) == 0x0
 00633   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 80, ... 92, ) == 0x0
 00634   432   NtClose  (80, ... ) == 0x0
 00635   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8f0000), 0x0, 4096, ) == 0x0
 00636   432   NtClose  (92, ... ) == 0x0
 00637   432   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 00638   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1235944, ... ) }, 1235944, ... ) == 0x0
 00639   432   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236644,  (0x80100080, {24, 0, 0x40, 0, 1236644, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 92, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 92, {status=0x0, info=1}, ) == 0x0
 00640   432   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 92, ... 80, ) == 0x0
 00641   432   NtClose  (92, ... ) == 0x0
 00642   432   NtMapViewOfSection  (80, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x8f0000), {0, 0}, 4096, ) == 0x0
 00643   432   NtClose  (80, ... ) == 0x0
 00644   432   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 00645   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 80, {status=0x0, info=1}, ) }, 1, 96, ... 80, {status=0x0, info=1}, ) == 0x0
 00646   432   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 80, ... 92, ) == 0x0
 00647   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8f0000), 0x0, 4096, ) == 0x0
 00648   432   NtQueryInformationFile  (80, 1236264, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 00649   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00650   432   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1236344, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1236344, 1, 96, 0} "\210\6\32\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\1P\0\0\0\\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0x\344\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 432, 1569, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\1P\0\0\0\\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0x\344\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 424, 432, 1569, 0}  (24, {128, 156, new_msg, 0, 1236344, 1, 96, 0} "\210\6\32\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\1P\0\0\0\\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0x\344\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 432, 1569, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\1P\0\0\0\\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0x\344\22\0\0\0\0\0" )  ) == 0x0
 00651   432   NtClose  (80, ... ) == 0x0
 00652   432   NtClose  (92, ... ) == 0x0
 00653   432   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 00654   432   NtUnmapViewOfSection  (-1, 0x12e478, ... ) == STATUS_NOT_MAPPED_VIEW
 00655   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00656   432   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00657   432   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 00658   432   NtUserGetDC  (0, ... ) == 0x1010050
 00659   432   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00660   432   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 00661   432   NtUserSystemParametersInfo  (66, 12, 1238756, 0, ... ) == 0x1
 00662   432   NtOpenProcessToken  (-1, 0x8, ... 92, ) == 0x0
 00663   432   NtAccessCheck  (1393640, 92, 0x1, 1238160, 1238104, 56, 1238188, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00664   432   NtClose  (92, ... ) == 0x0
 00665   432   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "Control Panel\Desktop"}, ... 92, ) }, ... 92, ) == 0x0
 00666   432   NtQueryValueKey  (92,  (92, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00667   432   NtClose  (92, ... ) == 0x0
 00668   432   NtUserSystemParametersInfo  (41, 500, 1238256, 0, ... ) == 0x1
 00669   432   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 00670   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 92, ) }, ... 92, ) == 0x0
 00671   432   NtQueryValueKey  (92,  (92, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00672   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 80, ) }, ... 80, ) == 0x0
 00673   432   NtQueryValueKey  (80,  (80, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00674   432   NtClose  (80, ... ) == 0x0
 00675   432   NtClose  (92, ... ) == 0x0
 00676   432   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 00677   432   NtUserSystemParametersInfo  (4130, 0, 1238780, 0, ... ) == 0x1
 00678   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 92, ) }, ... 92, ) == 0x0
 00679   432   NtEnumerateValueKey  (92, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00680   432   NtClose  (92, ... ) == 0x0
 00681   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00682   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc03b
 00683   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc03d
 00684   432   NtUserFindExistingCursorIcon  (1238060, 1238076, 1238644, ... ) == 0x10011
 00685   432   NtUserRegisterClassExWOW  (1238512, 1238592, 1238576, 1238608, 0, 384, 0, ... ) == 0x810dc03f
 00686   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00687   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc041
 00688   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00689   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc043
 00690   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc045
 00691   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00692   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc047
 00693   432   NtUserFindExistingCursorIcon  (1238060, 1238076, 1238644, ... ) == 0x10011
 00694   432   NtUserRegisterClassExWOW  (1238512, 1238592, 1238576, 1238608, 0, 384, 0, ... ) == 0x810dc049
 00695   432   NtUserGetClassInfo  (1905590272, 1238676, 1238628, 1238704, 0, ... ) == 0xc049
 00696   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00697   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ...
 00698   432   NtAllocateVirtualMemory  (-1, 6144000, 0, 4096, 4096, 32, ... 6144000, 4096, ) == 0x0
 00697   432   NtUserRegisterClassExWOW  ... ) == 0x810dc04b
 00699   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00700   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc04d
 00701   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00702   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc04f
 00703   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc051
 00704   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00705   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc053
 00706   432   NtUserFindExistingCursorIcon  (1238060, 1238076, 1238644, ... ) == 0x10011
 00707   432   NtUserRegisterClassExWOW  (1238512, 1238592, 1238576, 1238608, 0, 384, 0, ... ) == 0x810dc055
 00708   432   NtUserRegisterClassExWOW  (1238512, 1238592, 1238576, 1238608, 0, 384, 0, ... ) == 0x810dc057
 00709   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00710   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc059
 00711   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10013
 00712   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc05b
 00713   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00714   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc05d
 00715   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00716   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc05f
 00717   432   NtUserFindExistingCursorIcon  (1238060, 1238076, 1238644, ... ) == 0x10011
 00718   432   NtUserRegisterClassExWOW  (1238512, 1238592, 1238576, 1238608, 0, 384, 0, ... ) == 0x810dc017
 00719   432   NtUserFindExistingCursorIcon  (1238060, 1238076, 1238644, ... ) == 0x10011
 00720   432   NtUserRegisterClassExWOW  (1238512, 1238592, 1238576, 1238608, 0, 384, 0, ... ) == 0x810dc019
 00721   432   NtUserFindExistingCursorIcon  (1238060, 1238076, 1238644, ... ) == 0x10013
 00722   432   NtUserRegisterClassExWOW  (1238512, 1238592, 1238576, 1238608, 0, 384, 0, ... ) == 0x810dc018
 00723   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00724   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc01a
 00725   432   NtUserFindExistingCursorIcon  (1238060, 1238076, 1238644, ... ) == 0x10011
 00726   432   NtUserRegisterClassExWOW  (1238512, 1238592, 1238576, 1238608, 0, 384, 0, ... ) == 0x810dc01c
 00727   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00728   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc01e
 00729   432   NtUserFindExistingCursorIcon  (1238060, 1238076, 1238644, ... ) == 0x10011
 00730   432   NtUserRegisterClassExWOW  (1238572, 1238652, 1238636, 1238668, 0, 384, 0, ... ) == 0x810dc01b
 00731   432   NtUserFindExistingCursorIcon  (1238056, 1238072, 1238640, ... ) == 0x10011
 00732   432   NtUserRegisterClassExWOW  (1238568, 1238648, 1238632, 1238664, 0, 384, 0, ... ) == 0x810dc068
 00733   432   NtUserFindExistingCursorIcon  (1238064, 1238080, 1238648, ... ) == 0x10011
 00734   432   NtUserRegisterClassExWOW  (1238516, 1238596, 1238580, 1238612, 0, 384, 0, ... ) == 0x810dc06a
 00735   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc03b
 00736   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc03d
 00737   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc03f
 00738   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc041
 00739   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc043
 00740   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc045
 00741   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc047
 00742   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc049
 00743   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc04b
 00744   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc04d
 00745   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc04f
 00746   432   NtUserGetClassInfo  (1999896576, 1241580, 1241532, 1241608, 0, ... ) == 0xc051
 00747   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc053
 00748   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc055
 00749   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc059
 00750   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc05b
 00751   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc05d
 00752   432   NtUserGetClassInfo  (1999896576, 1241576, 1241528, 1241604, 0, ... ) == 0xc05f
 00753   432   NtUserRegisterWindowMessage  ( ("WOWLFChange", ... ) , ... ) == 0xc06b
 00754   432   NtUserRegisterWindowMessage  ( ("WOWDirChange", ... ) , ... ) == 0xc06c
 00755   432   NtUserRegisterWindowMessage  ( ("WOWCHOOSEFONT_GETLOGFONT", ... ) , ... ) == 0xc06d
 00756   432   NtUserRegisterWindowMessage  ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06e
 00757   432   NtUserRegisterWindowMessage  ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc06f
 00758   432   NtUserRegisterWindowMessage  ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc070
 00759   432   NtUserRegisterWindowMessage  ( ("commdlg_ColorOK", ... ) , ... ) == 0xc071
 00760   432   NtUserRegisterWindowMessage  ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc072
 00761   432   NtUserRegisterWindowMessage  ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06e
 00762   432   NtUserRegisterWindowMessage  ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc06f
 00763   432   NtUserRegisterWindowMessage  ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc070
 00764   432   NtUserRegisterWindowMessage  ( ("commdlg_ColorOK", ... ) , ... ) == 0xc071
 00765   432   NtUserRegisterWindowMessage  ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc072
 00766   432   NtUserRegisterWindowMessage  ( ("Shell IDList Array", ... ) , ... ) == 0xc073
 00767   432   NtUserRegisterWindowMessage  ( ("commdlg_help", ... ) , ... ) == 0xc074
 00768   432   NtUserRegisterWindowMessage  ( ("commdlg_help", ... ) , ... ) == 0xc074
 00769   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\MDAC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00770   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00771   432   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00772   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00773   432   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 9502720, 262144, ) == 0x0
 00774   432   NtAllocateVirtualMemory  (-1, 9502720, 0, 4096, 4096, 4, ... 9502720, 4096, ) == 0x0
 00775   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00776   432   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 9764864, 262144, ) == 0x0
 00777   432   NtAllocateVirtualMemory  (-1, 9764864, 0, 4096, 4096, 4, ... 9764864, 4096, ) == 0x0
 00778   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00779   432   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 10027008, 262144, ) == 0x0
 00780   432   NtAllocateVirtualMemory  (-1, 10027008, 0, 4096, 4096, 4, ... 10027008, 4096, ) == 0x0
 00781   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00782   432   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 10289152, 262144, ) == 0x0
 00783   432   NtAllocateVirtualMemory  (-1, 10289152, 0, 4096, 4096, 4, ... 10289152, 4096, ) == 0x0
 00784   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00785   432   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00786   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00787   432   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00788   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbcint.dll"}, 1237456, ... ) }, 1237456, ... ) == 0x0
 00789   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbcint.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00790   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 92, ... 80, ) == 0x0
 00791   432   NtClose  (92, ... ) == 0x0
 00792   432   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa10000), 0x0, 90112, ) == 0x0
 00793   432   NtClose  (80, ... ) == 0x0
 00794   432   NtUnmapViewOfSection  (-1, 0xa10000, ... ) == 0x0
 00795   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbcint.dll"}, 1237772, ... ) }, 1237772, ... ) == 0x0
 00796   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbcint.dll"}, 5, 96, ... 80, {status=0x0, info=1}, ) }, 5, 96, ... 80, {status=0x0, info=1}, ) == 0x0
 00797   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 80, ... 92, ) == 0x0
 00798   432   NtQuerySection  (92, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00799   432   NtClose  (80, ... ) == 0x0
 00800   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x1f850000), 0x0, 90112, ) == 0x0
 00801   432   NtClose  (92, ... ) == 0x0
 00802   432   NtQueryDefaultLocale  (1, 1239460, ... ) == 0x0
 00803   432   NtAllocateVirtualMemory  (-1, 9506816, 0, 4096, 4096, 4, ... 9506816, 4096, ) == 0x0
 00804   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE"}, ... 92, ) }, ... 92, ) == 0x0
 00805   432   NtClose  (92, ... ) == 0x0
 00806   432   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00807   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00808   432   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00809   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00810   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 92, ) }, ... 92, ) == 0x0
 00811   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0
 00812   432   NtClose  (92, ... ) == 0x0
 00813   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 92, ) }, ... 92, ) == 0x0
 00814   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0
 00815   432   NtClose  (92, ... ) == 0x0
 00816   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 92, ) }, ... 92, ) == 0x0
 00817   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0
 00818   432   NtClose  (92, ... ) == 0x0
 00819   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 92, ) }, ... 92, ) == 0x0
 00820   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00821   432   NtClose  (92, ... ) == 0x0
 00822   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 92, ) }, ... 92, ) == 0x0
 00823   432   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 00824   432   NtClose  (92, ... ) == 0x0
 00825   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00826   432   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ... 1400832, 4096, ) == 0x0
 00827   432   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ... 1404928, 4096, ) == 0x0
 00828   432   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ... 1409024, 4096, ) == 0x0
 00829   432   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1241616, 0,  (0x1f0003, {24, 52, 0x80, 1241616, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 00830   432   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 92, ) }, ... 92, ) == 0x0
 00831   432   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ... 1413120, 4096, ) == 0x0
 00832   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00833   432   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00834   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 80, ) }, ... 80, ) == 0x0
 00835   432   NtQueryValueKey  (80,  (80, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00836   432   NtClose  (80, ... ) == 0x0
 00837   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00838   432   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00839   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00840   432   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00841   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 80, ) }, ... 80, ) == 0x0
 00842   432   NtQueryValueKey  (80,  (80, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00843   432   NtQueryValueKey  (80,  (80, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00844   432   NtQueryValueKey  (80,  (80, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00845   432   NtClose  (80, ... ) == 0x0
 00846   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 80, ) }, ... 80, ) == 0x0
 00847   432   NtQueryValueKey  (80,  (80, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00848   432   NtQueryValueKey  (80,  (80, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00849   432   NtClose  (80, ... ) == 0x0
 00850   432   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00851   432   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 00852   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00853   432   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00854   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00855   432   NtAllocateVirtualMemory  (-1, 1417216, 0, 8192, 4096, 4, ... 1417216, 8192, ) == 0x0
 00856   432   NtCreateKey  (0xf003f, {24, 84, 0x40, 0, 0,  (0xf003f, {24, 84, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 80, 2, ) }, 0, 0x0, 0, ... 80, 2, ) == 0x0
 00857   432   NtQueryDefaultUILanguage  (1239852, ...
 00858   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00859   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482012, ) == 0x0
 00860   432   NtQueryInformationToken  (-2147482012, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00861   432   NtClose  (-2147482012, ... ) == 0x0
 00862   432   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0
 00863   432   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00864   432   NtOpenKey  (0x80000000, {24, -2147482012, 0x640, 0, 0,  (0x80000000, {24, -2147482012, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0
 00865   432   NtQueryValueKey  (-2147482024,  (-2147482024, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00866   432   NtClose  (-2147482024, ... ) == 0x0
 00867   432   NtClose  (-2147482012, ... ) == 0x0
 00857   432   NtQueryDefaultUILanguage  ... ) == 0x0
 00868   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00869   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll"}, 1, 96, ... 96, {status=0x0, info=1}, ) }, 1, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00870   432   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 96, ... 100, ) == 0x0
 00871   432   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa10000), 0x0, 593920, ) == 0x0
 00872   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00873   432   NtQueryDefaultLocale  (1, 1237888, ... ) == 0x0
 00874   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00875   432   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1238744, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1238744, 1, 96, 0} "\210\6\32\1\33\0\1\0\0\0\0\0\1\352\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1`\0\0\0\377\377\377\377\0\0\0\0P\275\250\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0\330\355\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 432, 1570, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\352\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1`\0\0\0\377\377\377\377\0\0\0\0P\275\250\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0\330\355\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 424, 432, 1570, 0}  (24, {128, 156, new_msg, 0, 1238744, 1, 96, 0} "\210\6\32\1\33\0\1\0\0\0\0\0\1\352\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1`\0\0\0\377\377\377\377\0\0\0\0P\275\250\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0\330\355\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 432, 1570, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\352\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1`\0\0\0\377\377\377\377\0\0\0\0P\275\250\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0\330\355\22\0\0\0\0\0" )  ) == 0x0
 00876   432   NtClose  (96, ... ) == 0x0
 00877   432   NtClose  (100, ... ) == 0x0
 00878   432   NtUnmapViewOfSection  (-1, 0xa10000, ... ) == 0x0
 00879   432   NtUnmapViewOfSection  (-1, 0x12edd8, ... ) == STATUS_NOT_MAPPED_VIEW
 00880   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00881   432   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00882   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00883   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00884   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236428, ... ) }, 1236428, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00885   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00886   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00887   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00888   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1237020, ... ) }, 1237020, ... ) == 0x0
 00889   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 100, {status=0x0, info=1}, ) }, 3, 33, ... 100, {status=0x0, info=1}, ) == 0x0
 00890   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00891   432   NtCreateKey  (0x2001f, {24, 84, 0x40, 0, 0,  (0x2001f, {24, 84, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 96, 2, ) }, 0, 0x0, 0, ... 96, 2, ) == 0x0
 00892   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00893   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1241484, ... ) }, 1241484, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00894   432   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2_32.dll"}, 1241484, ... ) }, 1241484, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00895   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 1241484, ... ) }, 1241484, ... ) == 0x0
 00896   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00897   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 104, ... 108, ) == 0x0
 00898   432   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00899   432   NtClose  (104, ... ) == 0x0
 00900   432   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0
 00901   432   NtClose  (108, ... ) == 0x0
 00902   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00903   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1240680, ... ) }, 1240680, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00904   432   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1240680, ... ) }, 1240680, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00905   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1240680, ... ) }, 1240680, ... ) == 0x0
 00906   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 00907   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 104, ) == 0x0
 00908   432   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00909   432   NtClose  (108, ... ) == 0x0
 00910   432   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00911   432   NtClose  (104, ... ) == 0x0
 00912   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00913   432   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00914   432   NtTestAlert  (... ) == 0x0
 00915   432   NtContinue  (1244464, 1, ...
 00916   432   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x491000,}, 4, ... ) == 0x0
 00917   432   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1245092, 0,  (0x1f0003, {24, 52, 0x80, 1245092, 0, "VT_3"}, 1, 0, ... 104, ) }, 1, 0, ... 104, ) == 0x0
 00918   432   NtCreateSection  (0xf0007, {24, 52, 0x80, 1245092, 0,  (0xf0007, {24, 52, 0x80, 1245092, 0, "W32_Virtu"}, {22585, 0}, 4, 134217728, 0, ... 108, ) }, {22585, 0}, 4, 134217728, 0, ... 108, ) == 0x0
 00919   432   NtMapViewOfSection  (108, -1, (0x0), 0, 22585, 0x0, 22585, 2, 0, 4, ... (0xa10000), 0x0, 24576, ) == 0x0
 00920   432   NtOpenProcessToken  (-1, 0x20, ... 112, ) == 0x0
 00921   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00922   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00923   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 116, ) }, ... 116, ) == 0x0
 00924   432   NtQueryValueKey  (116,  (116, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00925   432   NtClose  (116, ... ) == 0x0
 00926   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00927   432   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 116, ) == 0x0
 00928   432   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 120, ) == 0x0
 00929   432   NtQuerySystemTime  (... {-588764514, 29873108}, ) == 0x0
 00930   432   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 124, ) == 0x0
 00931   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00932   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00933   432   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00934   432   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00935   432   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 128, ) == 0x0
 00936   432   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 132, ) == 0x0
 00937   432   NtAllocateVirtualMemory  (-1, 1425408, 0, 4096, 4096, 4, ... 1425408, 4096, ) == 0x0
 00938   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 136, ) }, ... 136, ) == 0x0
 00939   432   NtOpenKey  (0x20019, {24, 136, 0x40, 0, 0,  (0x20019, {24, 136, 0x40, 0, 0, "ActiveComputerName"}, ... 140, ) }, ... 140, ) == 0x0
 00940   432   NtQueryValueKey  (140,  (140, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (140, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (140, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00941   432   NtClose  (140, ... ) == 0x0
 00942   432   NtClose  (136, ... ) == 0x0
 00943   432   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 136, ) == 0x0
 00944   432   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 140, ) == 0x0
 00945   432   NtDuplicateObject  (-1, 136, -1, 0x0, 0, 2, ... 144, ) == 0x0
 00946   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00947   432   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0
 00948   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00949   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00950   432   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243268,  (0xc0100080, {24, 0, 0x40, 0, 1243268, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 152, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 152, {status=0x0, info=1}, ) == 0x0
 00951   432   NtSetInformationFile  (152, 1243324, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00952   432   NtSetInformationFile  (152, 1243316, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00953   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00954   432   NtWriteFile  (152, 129, 0, 0,  (152, 129, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00955   432   NtAllocateVirtualMemory  (-1, 1429504, 0, 4096, 4096, 4, ... 1429504, 4096, ) == 0x0
 00956   432   NtReadFile  (152, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (152, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\376 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00957   432   NtFsControlFile  (152, 129, 0x0, 0x0, 0x11c017,  (152, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\376 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (152, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\376 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00958   432   NtFsControlFile  (152, 129, 0x0, 0x0, 0x11c017,  (152, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0I\250\30\25\310?\334\21\261\310\0\14)\371\246\305 \0"\0(\262\25\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0I\250\30\25\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \0(\262\25\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (152, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0I\250\30\25\310?\334\21\261\310\0\14)\371\246\305 \0"\0(\262\25\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0I\250\30\25\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0I\250\30\25\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) == 0x103
 00959   432   NtFsControlFile  (152, 129, 0x0, 0x0, 0x11c017,  (152, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0I\250\30\25\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (152, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0I\250\30\25\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 00960   432   NtClose  (148, ... ) == 0x0
 00961   432   NtClose  (152, ... ) == 0x0
 00962   432   NtAdjustPrivilegesToken  (112, 0, 1245096, 0, 0, 0, ... ) == 0x0
 00963   432   NtClose  (112, ... ) == 0x0
 00964   432   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 10616832, 65536, ) == 0x0
 00965   432   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00966   432   NtCreateSection  (0xf0007, 0x0, {12284, 0}, 4, 134217728, 0, ... 112, ) == 0x0
 00967   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa30000), {0, 0}, 12288, ) == 0x0
 00968   432   NtUnmapViewOfSection  (-1, 0xa30000, ... ) == 0x0
 00969   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa30000), {0, 0}, 12288, ) == 0x0
 00970   432   NtFreeVirtualMemory  (-1, (0xa20000), 0, 32768, ... (0xa20000), 65536, ) == 0x0
 00971   432   NtUnmapViewOfSection  (-1, 0xa30000, ... ) == 0x0
 00972   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 00973   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 00974   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 00975   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 00976   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 00977   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 00978   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 00979   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 00980   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 00981   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 00982   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {620, 0}, ... 152, ) == 0x0
 00983   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 148, ) }, ... 148, ) == 0x0
 00984   432   NtMapViewOfSection  (148, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ff90000), 0x0, 24576, ) == 0x0
 00985   432   NtClose  (148, ... ) == 0x0
 00986   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00987   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00988   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00989   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00990   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00991   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00992   432   NtAllocateVirtualMemory  (152, 0, 0, 1048576, 8192, 4, ... 22544384, 1048576, ) == 0x0
 00993   432   NtAllocateVirtualMemory  (152, 23584768, 0, 8192, 4096, 4, ... 23584768, 8192, ) == 0x0
 00994   432   NtProtectVirtualMemory  (152, (0x167e000), 4096, 260, ... (0x167e000), 4096, 4, ) == 0x0
 00995   432   NtCreateThread  (0x1f03ff, 0x0, 152, 1244008, 1244724, 1, ... 148, {620, 860}, ) == 0x0
 00996   432   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244852, 2012750850, 2012697848, -1}  (24, {28, 56, new_msg, 0, 1244852, 2012750850, 2012697848, -1} "\0\0\0\0\1\0\1\0\0\0\25\0\0\0\0\0\224\0\0\0l\2\0\0\\3\0\0" ... {28, 56, reply, 0, 424, 432, 1571, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\224\0\0\0l\2\0\0\\3\0\0" )  ... {28, 56, reply, 0, 424, 432, 1571, 0}  (24, {28, 56, new_msg, 0, 1244852, 2012750850, 2012697848, -1} "\0\0\0\0\1\0\1\0\0\0\25\0\0\0\0\0\224\0\0\0l\2\0\0\\3\0\0" ... {28, 56, reply, 0, 424, 432, 1571, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\224\0\0\0l\2\0\0\\3\0\0" )  ) == 0x0
 00997   432   NtResumeThread  (148, ... 1, ) == 0x0
 00998   432   NtClose  (152, ... ) == 0x0
 00999   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01000   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01001   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {664, 0}, ... 152, ) == 0x0
 01002   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01003   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ff90000), 0x0, 24576, ) == 0x0
 01004   432   NtClose  (156, ... ) == 0x0
 01005   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01006   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01007   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01008   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01009   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01010   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01011   432   NtClose  (152, ... ) == 0x0
 01012   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01013   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01014   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {676, 0}, ... 152, ) == 0x0
 01015   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01016   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ff90000), 0x0, 24576, ) == 0x0
 01017   432   NtClose  (156, ... ) == 0x0
 01018   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01019   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01020   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01021   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01022   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01023   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01024   432   NtClose  (152, ... ) == 0x0
 01025   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01026   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01027   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {848, 0}, ... 152, ) == 0x0
 01028   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01029   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01030   432   NtClose  (156, ... ) == 0x0
 01031   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01032   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01033   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01034   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01035   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01036   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01037   432   NtClose  (152, ... ) == 0x0
 01038   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01039   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01040   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {968, 0}, ... 152, ) == 0x0
 01041   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01042   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ff70000), 0x0, 24576, ) == 0x0
 01043   432   NtClose  (156, ... ) == 0x0
 01044   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01045   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\377\7", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01046   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01047   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\377\7", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01048   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01049   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\377\7", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01050   432   NtClose  (152, ... ) == 0x0
 01051   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01052   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01053   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1072, 0}, ... 152, ) == 0x0
 01054   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01055   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01056   432   NtClose  (156, ... ) == 0x0
 01057   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01058   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01059   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01060   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01061   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01062   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01063   432   NtClose  (152, ... ) == 0x0
 01064   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01065   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01066   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1148, 0}, ... 152, ) == 0x0
 01067   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01068   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01069   432   NtClose  (156, ... ) == 0x0
 01070   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01071   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01072   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01073   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01074   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01075   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01076   432   NtClose  (152, ... ) == 0x0
 01077   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01078   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01079   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 152, ) == 0x0
 01080   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01081   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01082   432   NtClose  (156, ... ) == 0x0
 01083   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01084   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01085   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01086   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01087   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01088   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01089   432   NtClose  (152, ... ) == 0x0
 01090   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01091   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01092   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1644, 0}, ... 152, ) == 0x0
 01093   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01094   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01095   432   NtClose  (156, ... ) == 0x0
 01096   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01097   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01098   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01099   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01100   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01101   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01102   432   NtClose  (152, ... ) == 0x0
 01103   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01104   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01105   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1848, 0}, ... 152, ) == 0x0
 01106   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01107   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01108   432   NtClose  (156, ... ) == 0x0
 01109   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01110   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01111   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01112   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01113   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01114   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01115   432   NtClose  (152, ... ) == 0x0
 01116   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01117   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01118   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1912, 0}, ... 152, ) == 0x0
 01119   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01120   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01121   432   NtClose  (156, ... ) == 0x0
 01122   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01123   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01124   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01125   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01126   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01127   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01128   432   NtClose  (152, ... ) == 0x0
 01129   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01130   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01131   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2008, 0}, ... 152, ) == 0x0
 01132   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01133   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01134   432   NtClose  (156, ... ) == 0x0
 01135   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01136   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01137   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01138   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01139   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01140   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01141   432   NtClose  (152, ... ) == 0x0
 01142   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01143   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01144   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2016, 0}, ... 152, ) == 0x0
 01145   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01146   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01147   432   NtClose  (156, ... ) == 0x0
 01148   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01149   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01150   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01151   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01152   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01153   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01154   432   NtClose  (152, ... ) == 0x0
 01155   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01156   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01157   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 152, ) == 0x0
 01158   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01159   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01160   432   NtClose  (156, ... ) == 0x0
 01161   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01162   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01163   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01164   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01165   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01166   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01167   432   NtClose  (152, ... ) == 0x0
 01168   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01169   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01170   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2036, 0}, ... 152, ) == 0x0
 01171   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01172   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01173   432   NtClose  (156, ... ) == 0x0
 01174   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01175   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01176   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01177   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01178   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01179   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01180   432   NtClose  (152, ... ) == 0x0
 01181   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01182   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01183   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {196, 0}, ... 152, ) == 0x0
 01184   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01185   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01186   432   NtClose  (156, ... ) == 0x0
 01187   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01188   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01189   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01190   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01191   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01192   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01193   432   NtClose  (152, ... ) == 0x0
 01194   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01195   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01196   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {264, 0}, ... 152, ) == 0x0
 01197   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01198   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01199   432   NtClose  (156, ... ) == 0x0
 01200   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01201   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01202   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01203   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01204   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01205   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01206   432   NtClose  (152, ... ) == 0x0
 01207   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01208   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01209   432   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {424, 0}, ... 152, ) == 0x0
 01210   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 156, ) }, ... 156, ) == 0x0
 01211   432   NtMapViewOfSection  (156, 152, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 01212   432   NtClose  (156, ... ) == 0x0
 01213   432   NtProtectVirtualMemory  (152, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 01214   432   NtWriteVirtualMemory  (152, 0x77f7e603,  (152, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01215   432   NtProtectVirtualMemory  (152, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01216   432   NtWriteVirtualMemory  (152, 0x77f7e6a3,  (152, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01217   432   NtProtectVirtualMemory  (152, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 01218   432   NtWriteVirtualMemory  (152, 0x77f7e6b3,  (152, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 01219   432   NtClose  (152, ... ) == 0x0
 01220   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa20000), {0, 0}, 12288, ) == 0x0
 01221   432   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 01222   432   NtClose  (112, ... ) == 0x0
 01223   432   NtClose  (104, ... ) == 0x0
 01224   432   NtQueryPerformanceCounter  (... {108637773, 0}, {3579545, 0}, ) == 0x0
 01225   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01226   432   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 10616832, 65536, ) == 0x0
 01227   432   NtAllocateVirtualMemory  (-1, 10616832, 0, 4096, 4096, 4, ... 10616832, 4096, ) == 0x0
 01228   432   NtAllocateVirtualMemory  (-1, 10620928, 0, 8192, 4096, 4, ... 10620928, 8192, ) == 0x0
 01229   432   NtAllocateVirtualMemory  (-1, 10629120, 0, 4096, 4096, 4, ... 10629120, 4096, ) == 0x0
 01230   432   NtAllocateVirtualMemory  (-1, 10633216, 0, 4096, 4096, 4, ... 10633216, 4096, ) == 0x0
 01231   432   NtAllocateVirtualMemory  (-1, 0, 0, 6, 12288, 64, ... 10682368, 4096, ) == 0x0
 01232   432   NtProtectVirtualMemory  (-1, (0xa30000), 6, 64, ...
 01233   432   NtContinue  (-104161492, 0, ...
 01232   432   NtProtectVirtualMemory  ... ) == STATUS_ACCESS_VIOLATION
 01234   432   NtFreeVirtualMemory  (-1, (0xa30000), 0, 32768, ... (0xa30000), 4096, ) == 0x0
 01235   432   NtCreateKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 104, 2, ) }, 0, 0x0, 0, ... 104, 2, ) == 0x0
 01236   432   NtDeleteValueKey  (104,  (104, "Win32 Help Service", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01237   432   NtClose  (104, ... ) == 0x0
 01238   432   NtCreateFile  (0x40100080, {24, 0, 0x42, 0, 1241344,  (0x40100080, {24, 0, 0x42, 0, 1241344, "\??\C:\WINDOWS\System32\tmp-490-wlr.bat"}, 0x0, 128, 3, 5, 96, 0, 0, ... }, 0x0, 128, 3, 5, 96, 0, 0, ...
 01239   432   NtClose  (-2147482012, ... ) == 0x0
 01238   432   NtCreateFile  ... 104, {status=0x0, info=2}, ) == 0x0
 01240   432   NtQueryVolumeInformationFile  (104, 1241448, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01241   432   NtAllocateVirtualMemory  (-1, 10637312, 0, 8192, 4096, 4, ... 10637312, 8192, ) == 0x0
 01242   432   NtWriteFile  (104, 0, 0, 0,  (104, 0, 0, 0, "@echo off\15\15\12:1\15\15\12del "u:\work\packed.exe"\15\15\12if exist "u:\work\packed.exe" goto 1\15\15\12del "%0"\15\15\12", 94, 0x0, 0, ... {status=0x0, info=94}, ) u:\work\packed.exe (104, 0, 0, 0, "@echo off\15\15\12:1\15\15\12del "u:\work\packed.exe"\15\15\12if exist "u:\work\packed.exe" goto 1\15\15\12del "%0"\15\15\12", 94, 0x0, 0, ... {status=0x0, info=94}, ) u:\work\packed.exe (104, 0, 0, 0, "@echo off\15\15\12:1\15\15\12del "u:\work\packed.exe"\15\15\12if exist "u:\work\packed.exe" goto 1\15\15\12del "%0"\15\15\12", 94, 0x0, 0, ... {status=0x0, info=94}, ) %0 (104, 0, 0, 0, "@echo off\15\15\12:1\15\15\12del "u:\work\packed.exe"\15\15\12if exist "u:\work\packed.exe" goto 1\15\15\12del "%0"\15\15\12", 94, 0x0, 0, ... {status=0x0, info=94}, ) , 94, 0x0, 0, ... {status=0x0, info=94}, ) == 0x0
 01243   432   NtClose  (104, ... ) == 0x0
 01244   432   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01245   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 1235044, ... ) }, 1235044, ... ) == 0x0
 01246   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 01247   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 104, ... 112, ) == 0x0
 01248   432   NtClose  (104, ... ) == 0x0
 01249   432   NtMapViewOfSection  (112, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa30000), 0x0, 262144, ) == 0x0
 01250   432   NtClose  (112, ... ) == 0x0
 01251   432   NtUnmapViewOfSection  (-1, 0xa30000, ... ) == 0x0
 01252   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01253   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01254   432   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01255   432   NtAllocateVirtualMemory  (-1, 1433600, 0, 4096, 4096, 4, ... 1433600, 4096, ) == 0x0
 01256   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 112, {status=0x0, info=0}, ) }, 7, 16, ... 112, {status=0x0, info=0}, ) == 0x0
 01257   432   NtDeviceIoControlFile  (112, 0, 0x0, 0x0, 0x390008,  (112, 0, 0x0, 0x0, 0x390008, "\201U\31\1\345\343B\377,%?7'UU\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01258   432   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01259   432   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01260   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01261   432   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01262   432   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01263   432   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01264   432   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01265   432   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482012, 2, ) }, 0, 0x0, 0, ... -2147482012, 2, ) == 0x0
 01266   432   NtSetValueKey  (-2147482012,  (-2147482012, "Seed", 0, 3, "\2748\215\24\352\13\260\312\243\376l\303\226)B\22\314\215"E\203,l"\276w\362qZ\6\13\312X\210\3031KY\302\261\373U\245\312++yK\306_\316\1\3700X`\223\243\237T+\255]\242\250\263\226\343G\233q]\304@9\11GP\311\300", 80, ... ) , 0, 3,  (-2147482012, "Seed", 0, 3, "\2748\215\24\352\13\260\312\243\376l\303\226)B\22\314\215"E\203,l"\276w\362qZ\6\13\312X\210\3031KY\302\261\373U\245\312++yK\306_\316\1\3700X`\223\243\237T+\255]\242\250\263\226\343G\233q]\304@9\11GP\311\300", 80, ... ) E\203,l (-2147482012, "Seed", 0, 3, "\2748\215\24\352\13\260\312\243\376l\303\226)B\22\314\215"E\203,l"\276w\362qZ\6\13\312X\210\3031KY\302\261\373U\245\312++yK\306_\316\1\3700X`\223\243\237T+\255]\242\250\263\226\343G\233q]\304@9\11GP\311\300", 80, ... ) , 80, ... ) == 0x0
 01267   432   NtClose  (-2147482012, ... ) == 0x0
 01257   432   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "C`\302*\15\2778\312\24\177\315\313m>\211.\201=\353\0C\15\220\210j\252.\371\245m\204=\237\4\33\356\303\231\205\243\17dJ\257J?tZ\4\237\1\32&oE\377\363a\\3308E\275*f\311\270a\243\15\237\272\264\323M\354Y\221\326\226\247\222\33\251\226\270\254[H\217K8S\205\240?Q\200\3072\232\250I\257AY\0+\236\276\320\312\255\35\3353\263\345\233\236\15z\335<\206\225\204\307\361\265:\245Q\251{\206\220[\3130Ed_\36\216\34=\34\227\201&\265($\270-\260\2\16\2N\354ok\16\250\373\274Z_\31\371_\337\276\274Eo\23754\5upB\36\305X\276\240\310X\12\356N}\221rt\253\234\27(\330!\373\302\232t\270\4\265\234\24\352\206\307d\244a\23, ) , ) == 0x0
 01268   432   NtAllocateVirtualMemory  (-1, 1437696, 0, 16384, 4096, 4, ... 1437696, 16384, ) == 0x0
 01269   432   NtUserRegisterClassExWOW  (1237128, 1237208, 1237192, 1237224, 0, 384, 0, ... ) == 0x810dc038
 01270   432   NtUserGetAtomName  (49208, 1235892, ... ) == 0x15
 01271   432   NtUserCreateWindowEx  (0, 49208, 49208,  (0, 49208, 49208, "OleMainThreadWndName", -2013265920, -2147483648, -2147483648, -2147483648, -2147483648, -3, 0, 1998258176, 0, 1073742848, 0, ... , -2013265920, -2147483648, -2147483648, -2147483648, -2147483648, -3, 0, 1998258176, 0, 1073742848, 0, ...
 01272   432   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 01273   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1233416, ... ) }, 1233416, ... ) == 0x0
 01274   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 01275   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 104, ... 152, ) == 0x0
 01276   432   NtClose  (104, ... ) == 0x0
 01277   432   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa30000), 0x0, 204800, ) == 0x0
 01278   432   NtClose  (152, ... ) == 0x0
 01279   432   NtUnmapViewOfSection  (-1, 0xa30000, ... ) == 0x0
 01280   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1233732, ... ) }, 1233732, ... ) == 0x0
 01281   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 01282   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 152, ... 104, ) == 0x0
 01283   432   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01284   432   NtClose  (152, ... ) == 0x0
 01285   432   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 212992, ) == 0x0
 01286   432   NtClose  (104, ... ) == 0x0
 01287   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01288   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01289   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01290   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 104, ) == 0x0
 01291   432   NtQueryInformationToken  (104, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01292   432   NtClose  (104, ... ) == 0x0
 01293   432   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 104, ) }, ... 104, ) == 0x0
 01294   432   NtOpenKey  (0x1, {24, 104, 0x40, 0, 0,  (0x1, {24, 104, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 152, ) }, ... 152, ) == 0x0
 01295   432   NtQueryValueKey  (152,  (152, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01296   432   NtClose  (152, ... ) == 0x0
 01297   432   NtClose  (104, ... ) == 0x0
 01298   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01299   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 104, ) == 0x0
 01300   432   NtQueryInformationToken  (104, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01301   432   NtClose  (104, ... ) == 0x0
 01302   432   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 104, ) }, ... 104, ) == 0x0
 01303   432   NtOpenKey  (0x1, {24, 104, 0x40, 0, 0,  (0x1, {24, 104, 0x40, 0, 0, "Control Panel\Desktop"}, ... 152, ) }, ... 152, ) == 0x0
 01304   432   NtQueryValueKey  (152,  (152, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01305   432   NtClose  (152, ... ) == 0x0
 01306   432   NtClose  (104, ... ) == 0x0
 01307   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\UxTheme.dll"}, 1233232, ... ) }, 1233232, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01308   432   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "UxTheme.dll"}, 1233232, ... ) }, 1233232, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01309   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\UxTheme.dll"}, 1233232, ... ) }, 1233232, ... ) == 0x0
 01310   432   NtUserGetProcessWindowStation  (... ) == 0x28
 01311   432   NtUserGetObjectInformation  (40, 2, 0, 0, 1235528, ... ) == 0x0
 01312   432   NtUserGetObjectInformation  (40, 2, 1450400, 16, 1235528, ... ) == 0x1
 01313   432   NtUserGetGUIThreadInfo  (432, 1235484, ... ) == 0x1
 01314   432   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1235304, 64, ... 104, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1235304, 64, ... 104, 0x0, 0x0, 0x0, 64, ) == 0x0
 01315   432   NtRequestWaitReplyPort  (104, {32, 56, new_msg, 0, 0, 0, 0, 0}  (104, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 432, 1586, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 424, 432, 1586, 0}  (104, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 432, 1586, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01316   432   NtRequestWaitReplyPort  (104, {32, 56, new_msg, 0, 0, 0, 0, 0}  (104, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 432, 1587, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 424, 432, 1587, 0}  (104, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 432, 1587, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01317   432   NtUserCallNoParam  (29, ...
 01318   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1232776, ... ) }, 1232776, ... ) == 0x0
 01317   432   NtUserCallNoParam  ... ) == 0x0
 01319   432   NtUserSystemParametersInfo  (41, 0, 1524225160, 0, ... ) == 0x1
 01320   432   NtGdiHfontCreate  (1234856, 356, 0, 0, 1414696, ... ) == 0x80a0454
 01321   432   NtGdiHfontCreate  (1234856, 356, 0, 0, 1414688, ... ) == 0x60a0455
 01322   432   NtRequestWaitReplyPort  (104, {32, 56, new_msg, 0, 0, 0, 0, 0}  (104, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 432, 1588, 0} "\0\0\0\0\0\0\0\0\230\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 424, 432, 1588, 0}  (104, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 432, 1588, 0} "\0\0\0\0\0\0\0\0\230\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01323   432   NtMapViewOfSection  (152, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa30000), {0, 0}, 331776, ) == 0x0
 01324   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01325   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01326   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01327   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01328   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01329   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01330   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01331   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01332   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01333   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01334   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01335   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01336   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01337   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01338   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01339   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01340   432   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01341   432   NtGdiCreatePatternBrushInternal  (59048369, 0, 0, ... ) == 0x1100457
 01342   432   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01343   432   NtUserCallNoParam  (29, ...
 01344   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1232220, ... ) }, 1232220, ... ) == 0x0
 01343   432   NtUserCallNoParam  ... ) == 0x0
 01345   432   NtUserCallNoParam  (29, ...
 01346   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1232216, ... ) }, 1232216, ... ) == 0x0
 01345   432   NtUserCallNoParam  ... ) == 0x0
 01347   432   NtUserMessageCall  (0x200b2, WM_NCCREATE, 0x0, 0x12db60, 0, 670, 0, ... ) == 0x1
 01348   432   NtUserMessageCall  (0x200b2, WM_NCCALCSIZE, 0x0, 0x12db88, 0, 670, 0, ... ) == 0x0
 01349   432   NtUserSetProp  (131250, 43288, -1, ... ) == 0x1
 01271   432   NtUserCreateWindowEx  ... ) == 0x200b2
 01350   432   NtDeviceIoControlFile  (112, 0, 0x0, 0x0, 0x390008,  (112, 0, 0x0, 0x0, 0x390008, "\201U\31\1\345\343B\\301\321\224>.v\206\223\0\336\213\314\251Sz\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01351   432   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01352   432   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01353   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01354   432   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01355   432   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01356   432   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01357   432   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01358   432   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482012, 2, ) }, 0, 0x0, 0, ... -2147482012, 2, ) == 0x0
 01359   432   NtSetValueKey  (-2147482012,  (-2147482012, "Seed", 0, 3, "/\224\251\301'1l\24\354Te\363\337\20\275\252\220U'\13\32\346\31\273\313v^\334\375\257\210I3\2\1\361\340\267\357\252\362p\300#\211\226x\217e\320\7\2\253^\26\7\353\231\332|^?< \331%\331\325\261=\346?\240\26G\213\34\247g\245", 80, ... ) , 0, 3,  (-2147482012, "Seed", 0, 3, "/\224\251\301'1l\24\354Te\363\337\20\275\252\220U'\13\32\346\31\273\313v^\334\375\257\210I3\2\1\361\340\267\357\252\362p\300#\211\226x\217e\320\7\2\253^\26\7\353\231\332|^?< \331%\331\325\261=\346?\240\26G\213\34\247g\245", 80, ... ) , 80, ... ) == 0x0
 01360   432   NtClose  (-2147482012, ... ) == 0x0
 01350   432   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\327Wg\305\307\364]\2509#y\324\327\361<[\263_\24r8\276\334\231$i3z\370T\360\201%\372}-\341G\273\335\357\11\233\261\313\370?7\16\300z\16\200D\207\367\247\300\31+\325\267\10l\14j\252O_\22\256\272\304#22;\34K\217\352\314\351\253]r+\242$Vs\360g\250\247\200\300\235\333ia\0 \336\202\202RK\350\203z\372\217\264\214U\335\347\200\2133\274D\204|\246Q1\257:\1\331L\345Gt\217\353X\312\315\13\310\200\221\213\226u\342\315\33\343\36+\265\216bt\25z\34\274\340Y\215\327\220\345\2211e\314\301Z\33\202\234J\241\13\250L\222yI\17M \252)\266\314D\10M\34H\377\255\342\277!j\302v\216\356b\6\210Z\224"\261\300\250\244\217-f\345\366\20\311[\3066\372H\266\17T\245\323\362\327\345#\363\211`g\343\245)RN1\263\317lQSy\36\313", ) \261\300\250\244\217-f\345\366\20\311[\3066\372H\266\17T\245\323\362\327\345#\363\211`g\343\245)RN1\263\317lQSy\36\313", ) == 0x0
 01361   432   NtDeviceIoControlFile  (112, 0, 0x0, 0x0, 0x390008,  (112, 0, 0x0, 0x0, 0x390008, "\201U\31\1\345\343B\\301\321\224>.v%~\364u\202\305\212\200n\0\336\213\314\251Sz\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01362   432   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01363   432   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01364   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01365   432   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01366   432   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01367   432   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01368   432   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01369   432   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482012, 2, ) }, 0, 0x0, 0, ... -2147482012, 2, ) == 0x0
 01370   432   NtSetValueKey  (-2147482012,  (-2147482012, "Seed", 0, 3, "\274\242b\211\314\234G}\\356\324\253\335\277\34#\334\304\230A\3021\364\375\Aa\364\313\343\213\2161\250\11i^\354/\311\177\356l\34}\202\341!\270}\243, 80, ... ) , 0, 3,  (-2147482012, "Seed", 0, 3, "\274\242b\211\314\234G}\\356\324\253\335\277\34#\334\304\230A\3021\364\375\Aa\364\313\343\213\2161\250\11i^\354/\311\177\356l\34}\202\341!\270}\243, 80, ... ) , 80, ... ) == 0x0
 01371   432   NtClose  (-2147482012, ... ) == 0x0
 01361   432   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\256\7\17\357\213)\210\3020\17n\234K\207\214c\317\230E\341{C\233\344O\254Q\232~\353>9 o\205\256\376A[,8\361\210\216@4e\206\211\355<$`6K\304\276\365\336+ \3\36\11\277'\245L\31OM\244\3\21|\305\313c.\3\310)\316\256\272\320\31\303\34K\373&\352?\305p\316\30\24c-\201\212Y\357\177P\250\250\337\25\315\365\367\346\347\257I\324\272\273\314\2416.\270\371\354\227\2\177\216Cp\237\323\301\350\357-\307\27X\324\207\222!\34&g\31\330\332\252lH6\260\357\325\3244\263i\200\30\216\220\227\361R\313\335i\227\207\342"\223\3\336!U\341(\30z\350\237\245\5\2728\6q\205XU\25|\215v&\\300\177\317g\242R2\377\357\244\3457Nq\300\250U\232f\335\317}0\255\256\372\265\223,\364\314\233\27\326s\277b\7z\325\351\232\337\245\246!\31\7\36G\30", ) \223\3\336!U\341(\30z\350\237\245\5\2728\6q\205XU\25|\215v&\\300\177\317g\242R2\377\357\244\3457Nq\300\250U\232f\335\317}0\255\256\372\265\223,\364\314\233\27\326s\277b\7z\325\351\232\337\245\246!\31\7\36G\30", ) == 0x0
 01372   432   NtDeviceIoControlFile  (112, 0, 0x0, 0x0, 0x390008,  (112, 0, 0x0, 0x0, 0x390008, "\201U\31\1\345\343B\\301\321\224>.v%~\364u\202\305\212#\203\364u\202\305\212\200n\0\336\213\314\251Sz\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01373   432   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01374   432   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01375   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01376   432   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01377   432   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01378   432   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01379   432   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01380   432   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482012, 2, ) }, 0, 0x0, 0, ... -2147482012, 2, ) == 0x0
 01381   432   NtSetValueKey  (-2147482012,  (-2147482012, "Seed", 0, 3, "\372YA\261\203:\245\345\315Bpd\371O5\327\231\366\177\36\23\31\222\32\2\16\367\342\327\327i\255h\14L\227\343\326\4s\341$A$|\260=-\178\306L\3501\224\211\33\222\264\240#\266Q\317P\2\374l\26\355*p\252\227D\342\274\250*Y", 80, ... ) , 0, 3,  (-2147482012, "Seed", 0, 3, "\372YA\261\203:\245\345\315Bpd\371O5\327\231\366\177\36\23\31\222\32\2\16\367\342\327\327i\255h\14L\227\343\326\4s\341$A$|\260=-\178\306L\3501\224\211\33\222\264\240#\266Q\317P\2\374l\26\355*p\252\227D\342\274\250*Y", 80, ... ) , 80, ... ) == 0x0
 01382   432   NtClose  (-2147482012, ... ) == 0x0
 01372   432   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\346\244\353\220\235\320tsE\304\3124\334\326\313\U8)\224#\24\12Y\217\373U*\343\366\357\256H\330G1\325\313\222\12\243\210\310\275\243\335\372\220\330\336\302\305\27\263\305<\345\3\211\6\222\311`\355\205\12\206\26\326SUW\374<\23\2547P/\33=\234\2w\351f\30\211Q\215\261\254\250\367\355\273f\225\274m\362|'\262r\270\22\341\214\2h\226\17{{\363\373\350i\326\256\10"\352\226:\3618\304v7\322\371\313\207\242\251\241zu\325q\341r\303\330\261\216\301\262\217\206\377S\267"r\372\220^:E\216\257\374\\271\214uU\270\256\274\260j\276\224@\20\30bx\361\5\4\352\315\362\12\331\317\1\375H]\354{\14\374\326\33\364\275", ) \352\226:\3618\304v7\322\371\313\207\242\251\241zu\325q\341r\303\330\261\216\301\262\217\206\377S\267373\202\237\214\340\12\2113H-Ux+\254\274\36\322\271wm\263\321\227\17HaX.l\311,\35\371\352\315\251G\275\337\215\363\317\332\222\353O\231|k  ... {status=0x0, info=256}, "\346\244\353\220\235\320tsE\304\3124\334\326\313\U8)\224#\24\12Y\217\373U*\343\366\357\256H\330G1\325\313\222\12\243\210\310\275\243\335\372\220\330\336\302\305\27\263\305<\345\3\211\6\222\311`\355\205\12\206\26\326SUW\374<\23\2547P/\33=\234\2w\351f\30\211Q\215\261\254\250\367\355\273f\225\274m\362|'\262r\270\22\341\214\2h\226\17{{\363\373\350i\326\256\10"\352\226:\3618\304v7\322\371\313\207\242\251\241zu\325q\341r\303\330\261\216\301\262\217\206\377S\267"r\372\220^:E\216\257\374\\271\214uU\270\256\274\260j\276\224@\20\30bx\361\5\4\352\315\362\12\331\317\1\375H]\354{\14\374\326\33\364\275", ) , ) == 0x0
 01383   432   NtDeviceIoControlFile  (112, 0, 0x0, 0x0, 0x390008,  (112, 0, 0x0, 0x0, 0x390008, "\201U\31\1\345\343B\\301\321\224>.v%~\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212\200n\0\336\213\314\251Sz\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01384   432   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01385   432   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01386   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01387   432   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01388   432   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01389   432   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01390   432   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01391   432   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482012, 2, ) }, 0, 0x0, 0, ... -2147482012, 2, ) == 0x0
 01392   432   NtSetValueKey  (-2147482012,  (-2147482012, "Seed", 0, 3, "\6I\227\374L\324\236\273\232\12\345NU\2071T\21\276\222SW\321\214\347iou\35\10J\363\\244\363\312\355\376#\362\11o\353-\7\274\251\306\203\16\26!\0\\316\1\274\35\2\351\223"\362\302\37\265y$\207n0K\330^\246\211\304}\360;", 80, ... ) , 0, 3,  (-2147482012, "Seed", 0, 3, "\6I\227\374L\324\236\273\232\12\345NU\2071T\21\276\222SW\321\214\347iou\35\10J\363\\244\363\312\355\376#\362\11o\353-\7\274\251\306\203\16\26!\0\\316\1\274\35\2\351\223"\362\302\37\265y$\207n0K\330^\246\211\304}\360;", 80, ... ) \362\302\37\265y$\207n0K\330^\246\211\304}\360;", 80, ... ) == 0x0
 01393   432   NtClose  (-2147482012, ... ) == 0x0
 01383   432   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "TZS\11\345\6\271\24\355j\236c\22TZ\243:\325[^\323Cn]\376\316)tE[\35\2378s\245\336\14\26\222\224\22Lh\310\200\35\217\322\317\315q\32\302\31\207\270\241Nh\327\302\260\374M\273\2274\7\33\301\303\17y\364\307\34a\252\217\301\352~\202xv\24q\210\12\3267\360\216\15\357#\36\315\331\303\222\373\325\15\351\317&^_LV\314u\315\227>\235\260Y}@p\232\241`\233\200Bm\313\253\333\360\220\265\371q\203&\242\310\\313z>o4\377\232\273M\303\367\277)u\236nJZ[\332\213\24^k\341\222qX\261\254\247\372*\214\340\350\244\24\365\317\10\354V\271\277\317\370\364\301\321c\210t&\350\237\346\236\375\242t\1\331\215A\303\17\351+\322\20\2518\201\203\11\317\375\372\350\310\315\26\1\234\311\214k, ) , ) == 0x0
 01394   432   NtDeviceIoControlFile  (112, 0, 0x0, 0x0, 0x390008,  (112, 0, 0x0, 0x0, 0x390008, "\201U\31\1\345\343B\\301\321\224>.v%~\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212\200n\0\336\213\314\251Sz\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01395   432   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01396   432   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01397   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01398   432   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01399   432   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01400   432   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01401   432   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01402   432   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482012, 2, ) }, 0, 0x0, 0, ... -2147482012, 2, ) == 0x0
 01403   432   NtSetValueKey  (-2147482012,  (-2147482012, "Seed", 0, 3, "\362g!_V{\326U7\200\27f*m\2618\202\371+L\256)\2H\265\13\377\177\3\330\237\214$\364\23\313\201\212\12\266O\371\217\312\23\2102\350n\260\363yw\365k\324\3011\225^\275\270\221\223\361j\177\331\21\326G/l\226\351\312Z\334L\364", 80, ... ) , 0, 3,  (-2147482012, "Seed", 0, 3, "\362g!_V{\326U7\200\27f*m\2618\202\371+L\256)\2H\265\13\377\177\3\330\237\214$\364\23\313\201\212\12\266O\371\217\312\23\2102\350n\260\363yw\365k\324\3011\225^\275\270\221\223\361j\177\331\21\326G/l\226\351\312Z\334L\364", 80, ... ) , 80, ... ) == 0x0
 01404   432   NtClose  (-2147482012, ... ) == 0x0
 01394   432   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\204\225\230&!7\236\243\272\301\217a\5\324\31\320mZ\212Zv\22@%6\371~$&\237\330\270\224$\21Y\343\372T\5\311a2t\317\237 \340\322\276\2573\374^\264\342\342\11+\275\247\321\332\221\304\377\205\35^\356\257f\302-\337\202\344\334\342\274YY\217\201\262\Nh9\202\304\261ih\3126#|\274\356\241a* e`\213\370qQi\300`!\327\267g\354U\356\1j\206\360\256^\216\24\370\21X\335\226\233\216\310\14\273n\245\261\247\6\304\30\31\16\233C~8Vf\206Q@\2\0po'\22\323\357_\245s\31\274\364D\325`b\252D\270v\300nRH;\340\331\263\203)\23\351\271'=\221\373\364=\4\357h\334\235\207\15kcL\232\246\377\216\204*\333E\224\367\273\220\1x\337\237v\262\35+\1-\370nu\301&#\242oaX\306\316\357\310\357R\305\260m\2\215M\241\262}", ) , ) == 0x0
 01405   432   NtDeviceIoControlFile  (112, 0, 0x0, 0x0, 0x390008,  (112, 0, 0x0, 0x0, 0x390008, "\201U\31\1\345\343B\\301\321\224>.v%~\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212\200n\0\336\213\314\251Sz\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01406   432   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01407   432   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01408   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01409   432   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01410   432   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01411   432   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01412   432   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01413   432   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482012, 2, ) }, 0, 0x0, 0, ... -2147482012, 2, ) == 0x0
 01414   432   NtSetValueKey  (-2147482012,  (-2147482012, "Seed", 0, 3, "\2065\33\253>7\225\205d*\252Zeq\350\237\340/\325\222R~\315\227]\231,\347\340Sv\210\320<\32\240\275u7l0f\316\0\217\203\356\333\322\353$\251\23H, 80, ... ) , 0, 3,  (-2147482012, "Seed", 0, 3, "\2065\33\253>7\225\205d*\252Zeq\350\237\340/\325\222R~\315\227]\231,\347\340Sv\210\320<\32\240\275u7l0f\316\0\217\203\356\333\322\353$\251\23H, 80, ... ) , 80, ... ) == 0x0
 01415   432   NtClose  (-2147482012, ... ) == 0x0
 01405   432   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "y\3274\226;\26\214=\330\214\26\203E\232\227z\370\362m\37\12\354i\240\314\16#[/\311}\354\245`\220\364!\365\33H\301\36\233\23\302z\331%C\23nH\301\321\361\263\347|\201\312\252\310,\320\6,\34\3277\237\207\345|\234e\311\13\226\371yB6\21@\24\352I\265/&i\334\311\0H\271[\338.=u\221\210\230\2603\254\367?\325K[\3\273G\352\276\201D\25\15\316^2\207\377\4\32\340S\206.%\224 \37\26\216w+\372\266\210\3216N\345\304\227\11h4\264\352|dH\337\230\207\13\5\315\254,\336dwZY6\216\362\256\245\351\202\204a\267\243b\261\264\361\226\251\324\351\20\17\307e\360F\27\247\323\321\277\353\246>\240\213\326W4\371\4\237\321\373\3\226\342(1T\351\242\233\271\276\7\327\320=\36\300=\37x\371\214\235\3155&8\313:\36\375\37zH\359\306\216\233=", ) , ) == 0x0
 01416   432   NtDeviceIoControlFile  (112, 0, 0x0, 0x0, 0x390008,  (112, 0, 0x0, 0x0, 0x390008, "\201U\31\1\345\343B\\301\321\224>.v%~\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212#\203\364u\202\305\212\200n\0\336\213\314\251Sz\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01417   432   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01418   432   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01419   432   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01420   432   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01421   432   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01422   432   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01423   432   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01424   432   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482012, 2, ) }, 0, 0x0, 0, ... -2147482012, 2, ) == 0x0
 01425   432   NtSetValueKey  (-2147482012,  (-2147482012, "Seed", 0, 3, "\224Y@\362\334VVLL\350&\265!\212\317*\306t\205\345\333\33_\32vW\224'\307\202r\263k\322(\275o\231\241\3\217\2104h\27"}\375vW\237u\16\3\205\252\260\231]\0\203z[w{e\21686\26\266;\345\206\204\324\346(\325", 80, ... ) , 0, 3,  (-2147482012, "Seed", 0, 3, "\224Y@\362\334VVLL\350&\265!\212\317*\306t\205\345\333\33_\32vW\224'\307\202r\263k\322(\275o\231\241\3\217\2104h\27"}\375vW\237u\16\3\205\252\260\231]\0\203z[w{e\21686\26\266;\345\206\204\324\346(\325", 80, ... ) }\375vW\237u\16\3\205\252\260\231]\0\203z[w{e\21686\26\266;\345\206\204\324\346(\325", 80, ... ) == 0x0
 01426   432   NtClose  (-2147482012, ... ) == 0x0
 01416   432   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "!H\355\223g`[.\266\305\255\216\335\14J <\261\213%\0\322\240\240\260\254\376\27C\272\221%\303Qq\331e\332\311\223\331\264\221\350\216qRS\353\305\340(\2156p@YX\252\3130\305\215\223\350/\305\303\365\37yH\306\273\274\245=\236\253I\261F\334\375\177\370>\3\202\376L\5<\33\315|*\262\264\337\201\12\276fB\241\345\326*\264g\322\262\5t4\332z\265u\376\22\211\276\34\316K\\26xa\352\370DZ\320Z^\0.\37\243\2\352K\341\1P\344g\0\244\24\21XE/\302\335bX\351\26\2135\301\275W\317LG\245K\27\177y\256HWJQ\206\275\25\370\277\304C\5\36\377Z\246\306\226\310\250k&-\337\237~\254\300\231O\221$\13x\277\27E;\277\365\223p\275\241t%K\204:E^\21594P\377\20\26\271\214\37sAdg\30t\3605\230q0<\13\23\237N\330", ) , ) == 0x0
 01427   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 156, ) }, ... 156, ) == 0x0
 01428   432   NtQueryValueKey  (156,  (156, "MaximizeApps", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01429   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 160, ) }, ... 160, ) == 0x0
 01430   432   NtQueryValueKey  (160,  (160, "MaximizeApps", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01431   432   NtClose  (160, ... ) == 0x0
 01432   432   NtClose  (156, ... ) == 0x0
 01433   432   NtAllocateVirtualMemory  (-1, 1454080, 0, 24576, 4096, 4, ... 1454080, 24576, ) == 0x0
 01434   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "netapi32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01435   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\netapi32.dll"}, 1235288, ... ) }, 1235288, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01436   432   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "netapi32.dll"}, 1235288, ... ) }, 1235288, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01437   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\netapi32.dll"}, 1235288, ... ) }, 1235288, ... ) == 0x0
 01438   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\netapi32.dll"}, 5, 96, ... 156, {status=0x0, info=1}, ) }, 5, 96, ... 156, {status=0x0, info=1}, ) == 0x0
 01439   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 156, ... 160, ) == 0x0
 01440   432   NtQuerySection  (160, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01441   432   NtClose  (156, ... ) == 0x0
 01442   432   NtMapViewOfSection  (160, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71c20000), 0x0, 323584, ) == 0x0
 01443   432   NtClose  (160, ... ) == 0x0
 01444   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01445   432   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 160, ) == 0x0
 01446   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01447   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01448   432   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1235656,  (0xc0100080, {24, 0, 0x40, 0, 1235656, "\??\PIPE\wkssvc"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 156, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 156, {status=0x0, info=1}, ) == 0x0
 01449   432   NtSetInformationFile  (156, 1235712, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01450   432   NtSetInformationFile  (156, 1235704, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01451   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01452   432   NtWriteFile  (156, 129, 0, 0,  (156, 129, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\230\320\377k\22\241\206\2303F\303\370~4Z\1\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01453   432   NtReadFile  (156, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (156, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\375#\0\0\15\0\PIPE\wkssvc\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01454   432   NtFsControlFile  (156, 129, 0x0, 0x0, 0x11c017,  (156, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0 \0\0\0\1\0\0\0\10\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0", 32, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\375#\0\0\15\0\PIPE\wkssvc\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 32, 1024, ... {status=0x103, info=68},  (156, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0 \0\0\0\1\0\0\0\10\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0", 32, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\375#\0\0\15\0\PIPE\wkssvc\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01455   432   NtClose  (160, ... ) == 0x0
 01456   432   NtClose  (156, ... ) == 0x0
 01457   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\startupscripts"}, 1235700, ... ) }, 1235700, ... ) == 0x0
 01458   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01459   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01460   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\tmp-490-wlr.bat"}, 1235520, ... ) }, 1235520, ... ) == 0x0
 01461   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01462   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01463   432   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1476416, 0,  (0x1f0003, {24, 52, 0x80, 1476416, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 156, ) }, 0, 2147483647, ... 156, ) == STATUS_OBJECT_NAME_EXISTS
 01464   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01465   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01466   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01467   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 160, ) }, ... 160, ) == 0x0
 01468   432   NtQueryValueKey  (160,  (160, "NoNetHood", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01469   432   NtClose  (160, ... ) == 0x0
 01470   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01471   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01472   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01473   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 160, ) }, ... 160, ) == 0x0
 01474   432   NtQueryValueKey  (160,  (160, "NoPropertiesMyComputer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01475   432   NtClose  (160, ... ) == 0x0
 01476   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01477   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01478   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01479   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 160, ) }, ... 160, ) == 0x0
 01480   432   NtQueryValueKey  (160,  (160, "NoInternetIcon", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01481   432   NtClose  (160, ... ) == 0x0
 01482   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01483   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01484   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01485   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 160, ) }, ... 160, ) == 0x0
 01486   432   NtQueryValueKey  (160,  (160, "NoCommonGroups", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01487   432   NtClose  (160, ... ) == 0x0
 01488   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01489   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01490   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01491   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01492   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 160, ) }, ... 160, ) == 0x0
 01493   432   NtQueryValueKey  (160,  (160, "NoControlPanel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01494   432   NtClose  (160, ... ) == 0x0
 01495   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01496   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01497   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01498   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 160, ) }, ... 160, ) == 0x0
 01499   432   NtQueryValueKey  (160,  (160, "NoSetFolders", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01500   432   NtClose  (160, ... ) == 0x0
 01501   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01502   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 160, ) == 0x0
 01503   432   NtQueryInformationToken  (160, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01504   432   NtClose  (160, ... ) == 0x0
 01505   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes"}, ... 160, ) }, ... 160, ) == 0x0
 01506   432   NtSetInformationObject  (162, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 01507   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01508   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01509   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32"}, ... 164, ) }, ... 164, ) == 0x0
 01510   432   NtQueryKey  (166, Name, 392, ... {Name= (166, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01511   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01512   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 168, ) == 0x0
 01513   432   NtQueryInformationToken  (168, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01514   432   NtClose  (168, ... ) == 0x0
 01515   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01516   432   NtQueryValueKey  (166, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data= (166, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0S\0H\0E\0L\0L\03\02\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01517   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll"}, 1233428, ... ) }, 1233428, ... ) == 0x0
 01518   432   NtClose  (166, ... ) == 0x0
 01519   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01520   432   NtAllocateVirtualMemory  (-1, 1478656, 0, 4096, 4096, 4, ... 1478656, 4096, ) == 0x0
 01521   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "Drive\shellex\FolderExtensions"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01522   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions"}, ... 164, ) }, ... 164, ) == 0x0
 01523   432   NtQueryKey  (166, Name, 392, ... {Name= (166, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensionsl"}, 134, ) }, 134, ) == 0x0
 01524   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01525   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 168, ) == 0x0
 01526   432   NtQueryInformationToken  (168, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01527   432   NtClose  (168, ... ) == 0x0
 01528   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Drive\shellex\FolderExtensions"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01529   432   NtEnumerateKey  (166, 0, Node, 288, ... {LastWrite={0x5abc7c30,0x1c73999}, TitleIdx=0, Name= (166, 0, Node, 288, ... {LastWrite={0x5abc7c30,0x1c73999}, TitleIdx=0, Name="{fbeb8a05-beee-4442-804e-409d6c4515e9}", Class=""}, 100, ) , Class=""}, 100, ) == 0x0
 01530   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01531   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01532   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}"}, ... 168, ) }, ... 168, ) == 0x0
 01533   432   NtQueryKey  (170, Name, 392, ... {Name= (170, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}"}, 212, ) }, 212, ) == 0x0
 01534   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01535   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 172, ) == 0x0
 01536   432   NtQueryInformationToken  (172, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01537   432   NtClose  (172, ... ) == 0x0
 01538   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01539   432   NtQueryValueKey  (170,  (170, "DriveMask", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (170, "DriveMask", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01540   432   NtClose  (170, ... ) == 0x0
 01541   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01542   432   NtEnumerateKey  (166, 1, Node, 288, ... ) == STATUS_NO_MORE_ENTRIES
 01543   432   NtClose  (166, ... ) == 0x0
 01544   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01545   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 164, ) }, ... 164, ) == 0x0
 01546   432   NtOpenKey  (0x2000000, {24, 164, 0x40, 0, 0,  (0x2000000, {24, 164, 0x40, 0, 0, "FileExts"}, ... 168, ) }, ... 168, ) == 0x0
 01547   432   NtOpenKey  (0x2000000, {24, 168, 0x40, 0, 0,  (0x2000000, {24, 168, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01548   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01549   432   NtOpenKey  (0x2000000, {24, 168, 0x40, 0, 0,  (0x2000000, {24, 168, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01550   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 01551   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01552   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\.bat"}, ... 172, ) }, ... 172, ) == 0x0
 01553   432   NtQueryKey  (174, Name, 392, ... {Name= (174, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.bato"}, 82, ) }, 82, ) == 0x0
 01554   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01555   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 176, ) == 0x0
 01556   432   NtQueryInformationToken  (176, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01557   432   NtClose  (176, ... ) == 0x0
 01558   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01559   432   NtQueryValueKey  (174, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (174, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="b\0a\0t\0f\0i\0l\0e\0\0\0"}, 28, ) }, 28, ) == 0x0
 01560   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01561   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01562   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\batfile"}, ... 176, ) }, ... 176, ) == 0x0
 01563   432   NtQueryKey  (178, Name, 384, ... {Name= (178, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01564   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01565   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 180, ) == 0x0
 01566   432   NtQueryInformationToken  (180, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01567   432   NtClose  (180, ... ) == 0x0
 01568   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01569   432   NtOpenKey  (0x1, {24, 178, 0x40, 0, 0,  (0x1, {24, 178, 0x40, 0, 0, "CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01570   432   NtQueryKey  (178, Name, 384, ... {Name= (178, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01571   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01572   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 180, ) == 0x0
 01573   432   NtQueryInformationToken  (180, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01574   432   NtClose  (180, ... ) == 0x0
 01575   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01576   432   NtOpenKey  (0x2000000, {24, 178, 0x40, 0, 0, ""}, ... 180, ) == 0x0
 01577   432   NtClose  (178, ... ) == 0x0
 01578   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01579   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01580   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01581   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 176, ) }, ... 176, ) == 0x0
 01582   432   NtQueryValueKey  (176,  (176, "DontShowSuperHidden", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01583   432   NtClose  (176, ... ) == 0x0
 01584   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01585   432   NtOpenKey  (0x2000000, {24, 164, 0x40, 0, 0, ""}, ... 176, ) == 0x0
 01586   432   NtQueryValueKey  (176,  (176, "ShellState", Partial, 144, ... TitleIdx=0, Type=3, Data="$\0\0\00(\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\15\0\0\0\0\0\0\0\2\0\0\0"}, 48, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (176, "ShellState", Partial, 144, ... TitleIdx=0, Type=3, Data="$\0\0\00(\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\15\0\0\0\0\0\0\0\2\0\0\0"}, 48, ) }, 48, ) == 0x0
 01587   432   NtQueryValueKey  (176,  (176, "ShellState", Partial, 144, ... TitleIdx=0, Type=3, Data="$\0\0\00(\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\15\0\0\0\0\0\0\0\2\0\0\0"}, 48, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (176, "ShellState", Partial, 144, ... TitleIdx=0, Type=3, Data="$\0\0\00(\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\15\0\0\0\0\0\0\0\2\0\0\0"}, 48, ) }, 48, ) == 0x0
 01588   432   NtClose  (176, ... ) == 0x0
 01589   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01590   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01591   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01592   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 176, ) }, ... 176, ) == 0x0
 01593   432   NtQueryValueKey  (176,  (176, "ForceActiveDesktopOn", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01594   432   NtClose  (176, ... ) == 0x0
 01595   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01596   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01597   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01598   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 176, ) }, ... 176, ) == 0x0
 01599   432   NtQueryValueKey  (176,  (176, "NoActiveDesktop", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01600   432   NtClose  (176, ... ) == 0x0
 01601   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01602   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01603   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01604   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 176, ) }, ... 176, ) == 0x0
 01605   432   NtQueryValueKey  (176,  (176, "NoWebView", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01606   432   NtClose  (176, ... ) == 0x0
 01607   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01608   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01609   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01610   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 176, ) }, ... 176, ) == 0x0
 01611   432   NtQueryValueKey  (176,  (176, "ClassicShell", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01612   432   NtClose  (176, ... ) == 0x0
 01613   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01614   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01615   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01616   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01617   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01618   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 176, ) }, ... 176, ) == 0x0
 01619   432   NtQueryValueKey  (176,  (176, "SeparateProcess", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01620   432   NtClose  (176, ... ) == 0x0
 01621   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01622   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01623   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01624   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 176, ) }, ... 176, ) == 0x0
 01625   432   NtQueryValueKey  (176,  (176, "NoNetCrawling", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01626   432   NtClose  (176, ... ) == 0x0
 01627   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01628   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01629   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01630   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 176, ) }, ... 176, ) == 0x0
 01631   432   NtQueryValueKey  (176,  (176, "NoSimpleStartMenu", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01632   432   NtClose  (176, ... ) == 0x0
 01633   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01634   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01635   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01636   432   NtOpenKey  (0x2000000, {24, 164, 0x40, 0, 0,  (0x2000000, {24, 164, 0x40, 0, 0, "Advanced"}, ... 176, ) }, ... 176, ) == 0x0
 01637   432   NtQueryValueKey  (176,  (176, "Hidden", Partial, 144, ... TitleIdx=0, Type=4, Data="\2\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "Hidden", Partial, 144, ... TitleIdx=0, Type=4, Data="\2\0\0\0"}, 16, ) }, 16, ) == 0x0
 01638   432   NtQueryValueKey  (176,  (176, "ShowCompColor", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "ShowCompColor", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01639   432   NtQueryValueKey  (176,  (176, "HideFileExt", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "HideFileExt", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01640   432   NtQueryValueKey  (176,  (176, "DontPrettyPath", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "DontPrettyPath", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01641   432   NtQueryValueKey  (176,  (176, "ShowInfoTip", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "ShowInfoTip", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01642   432   NtQueryValueKey  (176,  (176, "HideIcons", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "HideIcons", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01643   432   NtQueryValueKey  (176,  (176, "MapNetDrvBtn", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "MapNetDrvBtn", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01644   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 01645   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 01646   432   NtQueryValueKey  (176,  (176, "WebView", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "WebView", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01647   432   NtQueryValueKey  (176,  (176, "Filter", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "Filter", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01648   432   NtQueryValueKey  (176,  (176, "ShowSuperHidden", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01649   432   NtQueryValueKey  (176,  (176, "SeparateProcess", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (176, "SeparateProcess", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01650   432   NtQueryValueKey  (176,  (176, "NoNetCrawling", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01651   432   NtClose  (176, ... ) == 0x0
 01652   432   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1476416, 0,  (0x1f0003, {24, 52, 0x80, 1476416, 0, "shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}"}, 0, 2147483647, ... 176, ) }, 0, 2147483647, ... 176, ) == STATUS_OBJECT_NAME_EXISTS
 01653   432   NtReleaseSemaphore  (176, 1, ... 0, ) == 0x0
 01654   432   NtWaitForSingleObject  (176, 0, {0, 0}, ... ) == 0x0
 01655   432   NtQueryKey  (182, Name, 384, ... {Name= (182, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01656   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01657   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 184, ) == 0x0
 01658   432   NtQueryInformationToken  (184, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01659   432   NtClose  (184, ... ) == 0x0
 01660   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\ShellEx\IconHandler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01661   432   NtOpenKey  (0x1, {24, 182, 0x40, 0, 0,  (0x1, {24, 182, 0x40, 0, 0, "ShellEx\IconHandler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01662   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01663   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "SystemFileAssociations\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01664   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\SystemFileAssociations\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01665   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESs"}, 138, ) }, 138, ) == 0x0
 01666   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01667   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\.bat"}, ... 184, ) }, ... 184, ) == 0x0
 01668   432   NtQueryKey  (186, Name, 392, ... {Name= (186, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.bato"}, 82, ) }, 82, ) == 0x0
 01669   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01670   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01671   432   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01672   432   NtClose  (188, ... ) == 0x0
 01673   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01674   432   NtQueryValueKey  (186,  (186, "PerceivedType", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01675   432   NtClose  (186, ... ) == 0x0
 01676   432   NtQueryKey  (182, Name, 392, ... {Name= (182, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01677   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01678   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 184, ) == 0x0
 01679   432   NtQueryInformationToken  (184, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01680   432   NtClose  (184, ... ) == 0x0
 01681   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01682   432   NtQueryValueKey  (182,  (182, "DocObject", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01683   432   NtQueryKey  (182, Name, 392, ... {Name= (182, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01684   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01685   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 184, ) == 0x0
 01686   432   NtQueryInformationToken  (184, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01687   432   NtClose  (184, ... ) == 0x0
 01688   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01689   432   NtQueryValueKey  (182,  (182, "BrowseInPlace", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01690   432   NtQueryKey  (182, Name, 384, ... {Name= (182, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01691   432   NtAllocateVirtualMemory  (-1, 1482752, 0, 4096, 4096, 4, ... 1482752, 4096, ) == 0x0
 01692   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01693   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 184, ) == 0x0
 01694   432   NtQueryInformationToken  (184, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01695   432   NtClose  (184, ... ) == 0x0
 01696   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\Clsid"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01697   432   NtOpenKey  (0x1, {24, 182, 0x40, 0, 0,  (0x1, {24, 182, 0x40, 0, 0, "Clsid"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01698   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01699   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "*"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01700   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\*"}, ... 184, ) }, ... 184, ) == 0x0
 01701   432   NtQueryKey  (186, Name, 384, ... {Name= (186, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\*"}, 76, ) }, 76, ) == 0x0
 01702   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01703   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01704   432   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01705   432   NtClose  (188, ... ) == 0x0
 01706   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\*\Clsid"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01707   432   NtOpenKey  (0x1, {24, 186, 0x40, 0, 0,  (0x1, {24, 186, 0x40, 0, 0, "Clsid"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01708   432   NtQueryKey  (182, Name, 392, ... {Name= (182, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01709   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01710   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01711   432   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01712   432   NtClose  (188, ... ) == 0x0
 01713   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01714   432   NtQueryValueKey  (182,  (182, "IsShortcut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01715   432   NtQueryKey  (182, Name, 392, ... {Name= (182, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01716   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01717   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01718   432   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01719   432   NtClose  (188, ... ) == 0x0
 01720   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01721   432   NtQueryValueKey  (182,  (182, "AlwaysShowExt", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01722   432   NtQueryKey  (182, Name, 392, ... {Name= (182, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 01723   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01724   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01725   432   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01726   432   NtClose  (188, ... ) == 0x0
 01727   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01728   432   NtQueryValueKey  (182,  (182, "NeverShowExt", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01729   432   NtClose  (174, ... ) == 0x0
 01730   432   NtClose  (182, ... ) == 0x0
 01731   432   NtClose  (186, ... ) == 0x0
 01732   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01733   432   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1476416, 0,  (0x1f0003, {24, 52, 0x80, 1476416, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 184, ) }, 0, 2147483647, ... 184, ) == STATUS_OBJECT_NAME_EXISTS
 01734   432   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 01735   432   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 01736   432   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 01737   432   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 01738   432   NtCreateKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 180, 2, ) }, 0, 0x0, 0, ... 180, 2, ) == 0x0
 01739   432   NtQueryValueKey  (180,  (180, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (180, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 01740   432   NtClose  (180, ... ) == 0x0
 01741   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents"}, 1235664, ... ) }, 1235664, ... ) == 0x0
 01742   432   NtCreateKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 180, 2, ) }, 0, 0x0, 0, ... 180, 2, ) == 0x0
 01743   432   NtSetValueKey  (180,  (180, "Personal", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0", 96, ... ) , 0, 1,  (180, "Personal", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0", 96, ... ) , 96, ... ) == 0x0
 01744   432   NtClose  (180, ... ) == 0x0
 01745   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 1234076, ... ) }, 1234076, ... ) == 0x0
 01746   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 5, 96, ... 180, {status=0x0, info=1}, ) }, 5, 96, ... 180, {status=0x0, info=1}, ) == 0x0
 01747   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 180, ... 172, ) == 0x0
 01748   432   NtClose  (180, ... ) == 0x0
 01749   432   NtMapViewOfSection  (172, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa90000), 0x0, 262144, ) == 0x0
 01750   432   NtClose  (172, ... ) == 0x0
 01751   432   NtUnmapViewOfSection  (-1, 0xa90000, ... ) == 0x0
 01752   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01753   432   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "_fCanRegisterWithShellService"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01754   432   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01755   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1233640, ... ) }, 1233640, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01756   432   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "SETUPAPI.dll"}, 1233640, ... ) }, 1233640, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01757   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\SETUPAPI.dll"}, 1233640, ... ) }, 1233640, ... ) == 0x0
 01758   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\SETUPAPI.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01759   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 180, ) == 0x0
 01760   432   NtQuerySection  (180, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01761   432   NtClose  (172, ... ) == 0x0
 01762   432   NtMapViewOfSection  (180, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76670000), 0x0, 933888, ) == 0x0
 01763   432   NtClose  (180, ... ) == 0x0
 01764   432   NtAllocateVirtualMemory  (-1, 9256960, 0, 4096, 4096, 4, ... 9256960, 4096, ) == 0x0
 01765   432   NtQueryDefaultLocale  (1, 1233472, ... ) == 0x0
 01766   432   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 01767   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 180, ) }, ... 180, ) == 0x0
 01768   432   NtQueryValueKey  (180,  (180, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (180, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01769   432   NtClose  (180, ... ) == 0x0
 01770   432   NtUserGetProcessWindowStation  (... ) == 0x28
 01771   432   NtUserGetObjectInformation  (40, 1, 1233144, 12, 1233156, ... ) == 0x1
 01772   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\WPA\PnP"}, ... 180, ) }, ... 180, ) == 0x0
 01773   432   NtQueryValueKey  (180,  (180, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\345\252r\363"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (180, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\345\252r\363"}, 16, ) }, 16, ) == 0x0
 01774   432   NtClose  (180, ... ) == 0x0
 01775   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 180, ) }, ... 180, ) == 0x0
 01776   432   NtQueryValueKey  (180,  (180, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 01777   432   NtQueryValueKey  (180,  (180, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 01778   432   NtClose  (180, ... ) == 0x0
 01779   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 180, ) }, ... 180, ) == 0x0
 01780   432   NtQueryValueKey  (180,  (180, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 01781   432   NtQueryValueKey  (180,  (180, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 01782   432   NtClose  (180, ... ) == 0x0
 01783   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 180, ) }, ... 180, ) == 0x0
 01784   432   NtQueryValueKey  (180,  (180, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 01785   432   NtQueryValueKey  (180,  (180, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 01786   432   NtClose  (180, ... ) == 0x0
 01787   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 180, ) }, ... 180, ) == 0x0
 01788   432   NtQueryValueKey  (180,  (180, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 01789   432   NtQueryValueKey  (180,  (180, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 01790   432   NtClose  (180, ... ) == 0x0
 01791   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 180, ) }, ... 180, ) == 0x0
 01792   432   NtQueryValueKey  (180,  (180, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (180, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 01793   432   NtQueryValueKey  (180,  (180, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (180, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 01794   432   NtClose  (180, ... ) == 0x0
 01795   432   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 180, ) }, ... 180, ) == 0x0
 01796   432   NtQueryValueKey  (180,  (180, "DevicePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (180, "DevicePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0\0\0"}, 46, ) }, 46, ) == 0x0
 01797   432   NtClose  (180, ... ) == 0x0
 01798   432   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 180, ) == 0x0
 01799   432   NtCreateMutant  (0x1f0001, 0x0, 0, ... 172, ) == 0x0
 01800   432   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 188, ) == 0x0
 01801   432   NtCreateMutant  (0x1f0001, 0x0, 0, ... 192, ) == 0x0
 01802   432   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 196, ) == 0x0
 01803   432   NtCreateMutant  (0x1f0001, 0x0, 0, ... 200, ) == 0x0
 01804   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 204, ) }, ... 204, ) == 0x0
 01805   432   NtQueryValueKey  (204,  (204, "LogLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01806   432   NtQueryValueKey  (204,  (204, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01807   432   NtOpenKey  (0x1, {24, 204, 0x40, 0, 0,  (0x1, {24, 204, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01808   432   NtClose  (204, ... ) == 0x0
 01809   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1233064, ... ) }, 1233064, ... ) == 0x0
 01810   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 204, ) }, ... 204, ) == 0x0
 01811   432   NtQueryValueKey  (204,  (204, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (204, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (204, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 01812   432   NtClose  (204, ... ) == 0x0
 01813   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 204, ) }, ... 204, ) == 0x0
 01814   432   NtQueryValueKey  (204,  (204, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (204, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 52, ) , Data= (204, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 52, ) }, 52, ) == 0x0
 01815   432   NtClose  (204, ... ) == 0x0
 01816   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01817   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 204, ) }, ... 204, ) == 0x0
 01818   432   NtQueryValueKey  (204,  (204, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (204, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (204, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 01819   432   NtClose  (204, ... ) == 0x0
 01820   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01821   432   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 204, ) == 0x0
 01822   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01823   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01824   432   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1233844,  (0xc0100080, {24, 0, 0x40, 0, 1233844, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 208, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 208, {status=0x0, info=1}, ) == 0x0
 01825   432   NtSetInformationFile  (208, 1233900, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01826   432   NtSetInformationFile  (208, 1233892, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01827   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01828   432   NtWriteFile  (208, 129, 0, 0,  (208, 129, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01829   432   NtReadFile  (208, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (208, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\377 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01830   432   NtFsControlFile  (208, 129, 0x0, 0x0, 0x11c017,  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\332\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\377 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\332\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\377 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01831   432   NtFsControlFile  (208, 129, 0x0, 0x0, 0x11c017,  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0j\0\0\0\2\0\0\0R\0\0\0\0\0\37\0\0\0\0\0K\250\30\25\310?\334\21\261\310\0\14)\371\246\305*\0,\0\14\344gv\26\0\0\0\0\0\0\0\25\0\0\0S\0e\0L\0o\0a\0d\0D\0r\0i\0v\0e\0r\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 106, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0K\250\30\25\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 106, 1024, ... {status=0x103, info=48},  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0j\0\0\0\2\0\0\0R\0\0\0\0\0\37\0\0\0\0\0K\250\30\25\310?\334\21\261\310\0\14)\371\246\305*\0,\0\14\344gv\26\0\0\0\0\0\0\0\25\0\0\0S\0e\0L\0o\0a\0d\0D\0r\0i\0v\0e\0r\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 106, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0K\250\30\25\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 01832   432   NtFsControlFile  (208, 129, 0x0, 0x0, 0x11c017,  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0K\250\30\25\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\12\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0K\250\30\25\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\12\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01833   432   NtClose  (204, ... ) == 0x0
 01834   432   NtClose  (208, ... ) == 0x0
 01835   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01836   432   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 208, ) == 0x0
 01837   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01838   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01839   432   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1233844,  (0xc0100080, {24, 0, 0x40, 0, 1233844, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 204, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 204, {status=0x0, info=1}, ) == 0x0
 01840   432   NtSetInformationFile  (204, 1233900, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01841   432   NtSetInformationFile  (204, 1233892, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01842   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01843   432   NtWriteFile  (204, 129, 0, 0,  (204, 129, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01844   432   NtReadFile  (204, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (204, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\0!\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01845   432   NtFsControlFile  (204, 129, 0x0, 0x0, 0x11c017,  (204, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\332\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\0!\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (204, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\332\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\0!\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01846   432   NtFsControlFile  (204, 129, 0x0, 0x0, 0x11c017,  (204, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0b\0\0\0\2\0\0\0J\0\0\0\0\0\37\0\0\0\0\0L\250\30\25\310?\334\21\261\310\0\14)\371\246\305"\0$\0l\343gv\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0U\0n\0d\0o\0c\0k\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 98, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0L\250\30\25\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \0$\0l\343gv\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0U\0n\0d\0o\0c\0k\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (204, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0b\0\0\0\2\0\0\0J\0\0\0\0\0\37\0\0\0\0\0L\250\30\25\310?\334\21\261\310\0\14)\371\246\305"\0$\0l\343gv\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0U\0n\0d\0o\0c\0k\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 98, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0L\250\30\25\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0L\250\30\25\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) == 0x103
 01847   432   NtFsControlFile  (204, 129, 0x0, 0x0, 0x11c017,  (204, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0L\250\30\25\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (204, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0L\250\30\25\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01848   432   NtClose  (208, ... ) == 0x0
 01849   432   NtClose  (204, ... ) == 0x0
 01850   432   NtOpenThreadToken  (-2, 0x20, 1, ... ) == STATUS_NO_TOKEN
 01851   432   NtOpenProcessToken  (-1, 0x20, ... 204, ) == 0x0
 01852   432   NtAdjustPrivilegesToken  (204, 0, 1483792, 0, 0, 0, ... ) == 0x0
 01853   432   NtClose  (204, ... ) == 0x0
 01854   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01855   432   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 204, ) == 0x0
 01856   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01857   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01858   432   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234084,  (0xc0100080, {24, 0, 0x40, 0, 1234084, "\??\PIPE\ntsvcs"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 208, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 208, {status=0x0, info=1}, ) == 0x0
 01859   432   NtSetInformationFile  (208, 1234140, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01860   432   NtSetInformationFile  (208, 1234132, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01861   432   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01862   432   NtWriteFile  (208, 129, 0, 0,  (208, 129, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0@N\237\215=\240\316\21\217i\10\0>0\5\33\1\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01863   432   NtReadFile  (208, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (208, 129, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\243"\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) == 0x0
 01864   432   NtFsControlFile  (208, 129, 0x0, 0x0, 0x11c017,  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\27\0\15c\365S\277\266\320\21\224\362\0\240\311\36\373\213\0\0\0\0\0\0\0\0", 48, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\243"\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 48, 1024, ... {status=0x103, info=68},  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\27\0\15c\365S\277\266\320\21\224\362\0\240\311\36\373\213\0\0\0\0\0\0\0\0", 48, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\243"\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) == 0x103
 01865   432   NtOpenThreadToken  (-2, 0x20, 1, ... ) == STATUS_NO_TOKEN
 01866   432   NtOpenProcessToken  (-1, 0x20, ... 212, ) == 0x0
 01867   432   NtAdjustPrivilegesToken  (212, 0, 1483872, 0, 0, 0, ... ) == 0x0
 01868   432   NtClose  (212, ... ) == 0x0
 01869   432   NtFsControlFile  (208, 129, 0x0, 0x0, 0x11c017,  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\04\0\0\0\2\0\0\0\34\0\0\0\0\0\26\0\15c\365S\277\266\320\21\224\362\0\240\311\36\373\213\0\0\0\0S\1\0\0\0\0\0\0", 52, 1024, ... {status=0x103, info=32}, "\5\0\2\3\20\0\0\0 \0\0\0\1\0\0\0\10\0\0\0\0\0\0\0S\1\0\0\0\0\0\0", ) , 52, 1024, ... {status=0x103, info=32},  (208, 129, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\04\0\0\0\2\0\0\0\34\0\0\0\0\0\26\0\15c\365S\277\266\320\21\224\362\0\240\311\36\373\213\0\0\0\0S\1\0\0\0\0\0\0", 52, 1024, ... {status=0x103, info=32}, "\5\0\2\3\20\0\0\0 \0\0\0\1\0\0\0\10\0\0\0\0\0\0\0S\1\0\0\0\0\0\0", ) , ) == 0x103
 01870   432   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\FDC#GENERIC_FLOPPY_DRIVE#6&1435b2e2&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, 3, 96, ... 212, {status=0x0, info=1}, ) }, 3, 96, ... 212, {status=0x0, info=1}, ) == 0x0
 01871   432   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\FDC#GENERIC_FLOPPY_DRIVE#6&1435b2e2&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, ... 216, ) }, ... 216, ) == 0x0
 01872   432   NtQuerySymbolicLinkObject  (216, ...  (216, ... "\Device\FloppyPDO0", 38, ) , 38, ) == 0x0
 01873   432   NtClose  (216, ... ) == 0x0
 01874   432   NtQueryVolumeInformationFile  (212, 1234544, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01875   432   NtClose  (212, ... ) == 0x0
 01876   432   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\FDC#GENERIC_FLOPPY_DRIVE#6&1435b2e2&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, 3, 16, ... 212, {status=0x0, info=1}, ) }, 3, 16, ... 212, {status=0x0, info=1}, ) == 0x0
 01877   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x4d0008, 0x0, 0, 520, ... {status=0x0, info=32},  (212, 0, 0x0, 0x0, 0x4d0008, 0x0, 0, 520, ... {status=0x0, info=32}, "\36\0\\0D\0e\0v\0i\0c\0e\0\\0F\0l\0o\0p\0p\0y\00\0", ) , ) == 0x0
 01878   432   NtClose  (212, ... ) == 0x0
 01879   432   NtQueryInformationFile  (-1, 1234544, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 01880   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1234496,  (0x100080, {24, 0, 0x40, 0, 1234496, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 01881   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0008,  (212, 0, 0x0, 0x0, 0x6d0008, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\0\0\36\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0F\0l\0o\0p\0p\0y\00\0", 54, 32, ... , 54, 32, ...
 01882   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\Device\Floppy0"}, 0, 64, ... -2147482012, {status=0x0, info=1}, ) }, 0, 64, ... -2147482012, {status=0x0, info=1}, ) == 0x0
 01883   432   NtClose  (-2147482012, ... ) == 0x0
 01881   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 01884   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0008,  (212, 0, 0x0, 0x0, 0x6d0008, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\0\0\36\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0F\0l\0o\0p\0p\0y\00\0", 54, 374, ... , 54, 374, ...
 01885   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\Device\Floppy0"}, 0, 64, ... -2147482012, {status=0x0, info=1}, ) }, 0, 64, ... -2147482012, {status=0x0, info=1}, ) == 0x0
 01886   432   NtClose  (-2147482012, ... ) == 0x0
 01884   432   NtDeviceIoControlFile  ... {status=0x0, info=374},  ... {status=0x0, info=374}, "v\1\0\0\2\0\0\0\372\0\0\0`\0\0\08\0\0\0\244\0\0\0\334\0\0\0\36\0v\0Z\1\0\0\34\0\\08\0\0\0\244\0p\0\334\0\0\0\36\0\0\0\\0?\0?\0\\0F\0D\0C\0#\0G\0E\0N\0E\0R\0I\0C\0_\0F\0L\0O\0P\0P\0Y\0_\0D\0R\0I\0V\0E\0#\06\0&\01\04\03\05\0b\02\0e\02\0&\00\0&\00\0#\0{\05\03\0f\05\06\03\00\0d\0-\0b\06\0b\0f\0-\01\01\0d\00\0-\09\04\0f\02\0-\00\00\0a\00\0c\09\01\0e\0f\0b\08\0b\0}\0\\0D\0e\0v\0i\0c\0e\0\\0F\0l\0o\0p\0p\0y\00\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\06\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\\0D\0o\0s\0D\0e\0v\0i\0c\0e\0s\0\\0A\0:\0", ) , ) == 0x0
 01887   432   NtClose  (212, ... ) == 0x0
 01888   432   NtAllocateVirtualMemory  (-1, 1486848, 0, 4096, 4096, 4, ... 1486848, 4096, ) == 0x0
 01889   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 212, ) }, ... 212, ) == 0x0
 01890   432   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "{1a0315e6-a4ba-11db-9d02-806d6172696f}\"}, ... 216, ) }, ... 216, ) == 0x0
 01891   432   NtClose  (212, ... ) == 0x0
 01892   432   NtQueryValueKey  (216,  (216, "Data", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01893   432   NtQueryValueKey  (216,  (216, "Data", Partial, 712, ... TitleIdx=0, Type=3, Data="\0\0\0\0\\0\\0?\0\\0F\0D\0C\0#\0G\0E\0N\0E\0R\0I\0C\0_\0F\0L\0O\0P\0P\0Y\0_\0D\0R\0I\0V\0E\0#\06\0&\01\04\03\05\0b\02\0e\02\0&\00\0&\00\0#\0{\05\03\0f\05\06\03\00\0d\0-\0b\06\0b\0f\0-\01\01\0d\00\0-\09\04\0f\02\0-\00\00\0a\00\0c\09\01\0e\0f\0b\08\0b\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\0\\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\06\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\0\0\0\0\0\310\2\0\0f\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0f\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\7\0\0\250\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0T\0\0\0d\326\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\0\226\0\240\326\22\0\0\0\0\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0"}, 712, ) , Partial, 712, ... TitleIdx=0, Type=3, Data= (216, "Data", Partial, 712, ... TitleIdx=0, Type=3, Data="\0\0\0\0\\0\\0?\0\\0F\0D\0C\0#\0G\0E\0N\0E\0R\0I\0C\0_\0F\0L\0O\0P\0P\0Y\0_\0D\0R\0I\0V\0E\0#\06\0&\01\04\03\05\0b\02\0e\02\0&\00\0&\00\0#\0{\05\03\0f\05\06\03\00\0d\0-\0b\06\0b\0f\0-\01\01\0d\00\0-\09\04\0f\02\0-\00\00\0a\00\0c\09\01\0e\0f\0b\08\0b\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\0\\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\06\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\0\0\0\0\0\310\2\0\0f\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0f\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\7\0\0\250\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0T\0\0\0d\326\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\0\226\0\240\326\22\0\0\0\0\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0"}, 712, ) }, 712, ) == 0x0
 01894   432   NtClose  (216, ... ) == 0x0
 01895   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 216, ) }, ... 216, ) == 0x0
 01896   432   NtOpenKey  (0x2000000, {24, 216, 0x40, 0, 0,  (0x2000000, {24, 216, 0x40, 0, 0, "{1a0315e6-a4ba-11db-9d02-806d6172696f}\"}, ... 212, ) }, ... 212, ) == 0x0
 01897   432   NtClose  (216, ... ) == 0x0
 01898   432   NtQueryValueKey  (212,  (212, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01899   432   NtClose  (212, ... ) == 0x0
 01900   432   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\IDE#CdRomTEAC_CD-224E-N__________________________1.AA____#3031303030303030303030303030303030303130#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, 3, 96, ... 212, {status=0x0, info=0}, ) }, 3, 96, ... 212, {status=0x0, info=0}, ) == 0x0
 01901   432   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\IDE#CdRomTEAC_CD-224E-N__________________________1.AA____#3031303030303030303030303030303030303130#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, ... 216, ) }, ... 216, ) == 0x0
 01902   432   NtQuerySymbolicLinkObject  (216, ...  (216, ... "\Device\Ide\IdeDeviceP1T0L0-e", 60, ) , 60, ) == 0x0
 01903   432   NtClose  (216, ... ) == 0x0
 01904   432   NtQueryVolumeInformationFile  (212, 1234544, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01905   432   NtClose  (212, ... ) == 0x0
 01906   432   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\IDE#CdRomTEAC_CD-224E-N__________________________1.AA____#3031303030303030303030303030303030303130#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, 3, 16, ... 212, {status=0x0, info=0}, ) }, 3, 16, ... 212, {status=0x0, info=0}, ) == 0x0
 01907   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x4d0008, 0x0, 0, 520, ... {status=0x0, info=30},  (212, 0, 0x0, 0x0, 0x4d0008, 0x0, 0, 520, ... {status=0x0, info=30}, "\34\0\\0D\0e\0v\0i\0c\0e\0\\0C\0d\0R\0o\0m\00\0", ) , ) == 0x0
 01908   432   NtClose  (212, ... ) == 0x0
 01909   432   NtQueryInformationFile  (-1, 1234544, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 01910   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1234496,  (0x100080, {24, 0, 0x40, 0, 1234496, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 01911   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0008,  (212, 0, 0x0, 0x0, 0x6d0008, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\0\0\34\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0C\0d\0R\0o\0m\00\0", 52, 32, ... , 52, 32, ...
 01912   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\Device\CdRom0"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01913   432   NtClose  (-2147482012, ... ) == 0x0
 01911   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 01914   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0008,  (212, 0, 0x0, 0x0, 0x6d0008, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\0\0\34\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0C\0d\0R\0o\0m\00\0", 52, 490, ... , 52, 490, ...
 01915   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\Device\CdRom0"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01916   432   NtClose  (-2147482012, ... ) == 0x0
 01914   432   NtDeviceIoControlFile  ... {status=0x0, info=490},  ... {status=0x0, info=490}, "\352\1\0\0\2\0\0\0n\1\0\0`\0\0\08\0\0\0\32\1\0\0R\1\0\0\34\0v\0\316\1\0\0\34\0\\08\0\0\0\32\1o\0R\1\0\0\34\0\14\201\\0?\0?\0\\0I\0D\0E\0#\0C\0d\0R\0o\0m\0T\0E\0A\0C\0_\0C\0D\0-\02\02\04\0E\0-\0N\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\01\0.\0A\0A\0_\0_\0_\0_\0#\03\00\03\01\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\01\03\00\0#\0{\05\03\0f\05\06\03\00\0d\0-\0b\06\0b\0f\0-\01\01\0d\00\0-\09\04\0f\02\0-\00\00\0a\00\0c\09\01\0e\0f\0b\08\0b\0}\0\\0D\0e\0v\0i\0c\0e\0\\0C\0d\0R\0o\0m\00\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\07\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\\0D\0o\0s\0D\0e\0v\0i\0c\0e\0s\0\\0D\0:\0", ) , ) == 0x0
 01917   432   NtClose  (212, ... ) == 0x0
 01918   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 212, ) }, ... 212, ) == 0x0
 01919   432   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "{1a0315e7-a4ba-11db-9d02-806d6172696f}\"}, ... 216, ) }, ... 216, ) == 0x0
 01920   432   NtClose  (212, ... ) == 0x0
 01921   432   NtQueryValueKey  (216,  (216, "Data", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01922   432   NtQueryValueKey  (216,  (216, "Data", Partial, 712, ... TitleIdx=0, Type=3, Data="\0\0\0\0\\0\\0?\0\\0I\0D\0E\0#\0C\0d\0R\0o\0m\0T\0E\0A\0C\0_\0C\0D\0-\02\02\04\0E\0-\0N\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\01\0.\0A\0A\0_\0_\0_\0_\0#\03\00\03\01\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\01\03\00\0#\0{\05\03\0f\05\06\03\00\0d\0-\0b\06\0b\0f\0-\01\01\0d\00\0-\09\04\0f\02\0-\00\00\0a\00\0c\09\01\0e\0f\0b\08\0b\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\0\\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\07\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\0\0\0\0\0\310\2\0\0\203\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\203\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\7\0\0\250\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0T\0\0\0d\326\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\0\226\0\240\326\22\0\0\0\0\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0"}, 712, ) , Partial, 712, ... TitleIdx=0, Type=3, Data= (216, "Data", Partial, 712, ... TitleIdx=0, Type=3, Data="\0\0\0\0\\0\\0?\0\\0I\0D\0E\0#\0C\0d\0R\0o\0m\0T\0E\0A\0C\0_\0C\0D\0-\02\02\04\0E\0-\0N\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\0_\01\0.\0A\0A\0_\0_\0_\0_\0#\03\00\03\01\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\00\03\01\03\00\0#\0{\05\03\0f\05\06\03\00\0d\0-\0b\06\0b\0f\0-\01\01\0d\00\0-\09\04\0f\02\0-\00\00\0a\00\0c\09\01\0e\0f\0b\08\0b\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\0\\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\07\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\0\0\0\0\0\310\2\0\0\203\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\203\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\7\0\0\250\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0T\0\0\0d\326\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\0\226\0\240\326\22\0\0\0\0\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0"}, 712, ) }, 712, ) == 0x0
 01923   432   NtClose  (216, ... ) == 0x0
 01924   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 216, ) }, ... 216, ) == 0x0
 01925   432   NtOpenKey  (0x2000000, {24, 216, 0x40, 0, 0,  (0x2000000, {24, 216, 0x40, 0, 0, "{1a0315e7-a4ba-11db-9d02-806d6172696f}\"}, ... 212, ) }, ... 212, ) == 0x0
 01926   432   NtClose  (216, ... ) == 0x0
 01927   432   NtQueryValueKey  (212,  (212, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01928   432   NtClose  (212, ... ) == 0x0
 01929   432   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\STORAGE#Volume#1&30a96598&0&SignatureEF3BEF3BOffset7E00LengthBFB48200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, 3, 96, ... 212, {status=0x0, info=0}, ) }, 3, 96, ... 212, {status=0x0, info=0}, ) == 0x0
 01930   432   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\STORAGE#Volume#1&30a96598&0&SignatureEF3BEF3BOffset7E00LengthBFB48200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, ... 216, ) }, ... 216, ) == 0x0
 01931   432   NtQuerySymbolicLinkObject  (216, ...  (216, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 01932   432   NtClose  (216, ... ) == 0x0
 01933   432   NtQueryVolumeInformationFile  (212, 1234544, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01934   432   NtClose  (212, ... ) == 0x0
 01935   432   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\STORAGE#Volume#1&30a96598&0&SignatureEF3BEF3BOffset7E00LengthBFB48200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"}, 3, 16, ... 212, {status=0x0, info=0}, ) }, 3, 16, ... 212, {status=0x0, info=0}, ) == 0x0
 01936   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x4d0008, 0x0, 0, 520, ... {status=0x0, info=48},  (212, 0, 0x0, 0x0, 0x4d0008, 0x0, 0, 520, ... {status=0x0, info=48}, ".\0\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0", ) , ) == 0x0
 01937   432   NtClose  (212, ... ) == 0x0
 01938   432   NtQueryInformationFile  (-1, 1234544, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 01939   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1234496,  (0x100080, {24, 0, 0x40, 0, 1234496, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 01940   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0008,  (212, 0, 0x0, 0x0, 0x6d0008, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\0\0.\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0", 70, 32, ... , 70, 32, ...
 01941   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\Device\HarddiskVolume1"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01942   432   NtClose  (-2147482012, ... ) == 0x0
 01940   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 01943   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0008,  (212, 0, 0x0, 0x0, 0x6d0008, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\0\0.\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0", 70, 238, ... , 70, 238, ...
 01944   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\Device\HarddiskVolume1"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01945   432   NtClose  (-2147482012, ... ) == 0x0
 01943   432   NtDeviceIoControlFile  ... {status=0x0, info=238},  ... {status=0x0, info=238}, "\356\0\0\0\2\0\0\0r\0\0\0`\0\0\08\0\0\0\14\0\0\0D\0\0\0.\0v\0\322\0\0\0\34\0\\08\0\0\0\14\0d\0D\0\0\0.\0k\0;\357;\357\0~\0\0\0\0\0\0\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\09\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\\0D\0o\0s\0D\0e\0v\0i\0c\0e\0s\0\\0C\0:\0", ) , ) == 0x0
 01946   432   NtClose  (212, ... ) == 0x0
 01947   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 212, ) }, ... 212, ) == 0x0
 01948   432   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "{1a0315e9-a4ba-11db-9d02-806d6172696f}\"}, ... 216, ) }, ... 216, ) == 0x0
 01949   432   NtClose  (212, ... ) == 0x0
 01950   432   NtQueryValueKey  (216,  (216, "Data", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01951   432   NtQueryValueKey  (216,  (216, "Data", Partial, 712, ... TitleIdx=0, Type=3, Data="\0\0\0\0\\0\\0?\0\\0S\0T\0O\0R\0A\0G\0E\0#\0V\0o\0l\0u\0m\0e\0#\01\0&\03\00\0a\09\06\05\09\08\0&\00\0&\0S\0i\0g\0n\0a\0t\0u\0r\0e\0E\0F\03\0B\0E\0F\03\0B\0O\0f\0f\0s\0e\0t\07\0E\00\00\0L\0e\0n\0g\0t\0h\0B\0F\0B\04\08\02\00\00\0#\0{\05\03\0f\05\06\03\00\0d\0-\0b\06\0b\0f\0-\01\01\0d\00\0-\09\04\0f\02\0-\00\00\0a\00\0c\09\01\0e\0f\0b\08\0b\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\0\\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\09\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\0\0\0\0\0\310\2\0\0\240\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\240\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\7\0\0\250\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0T\0\0\0d\326\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\0\226\0\240\326\22\0\0\0\0\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0"}, 712, ) , Partial, 712, ... TitleIdx=0, Type=3, Data= (216, "Data", Partial, 712, ... TitleIdx=0, Type=3, Data="\0\0\0\0\\0\\0?\0\\0S\0T\0O\0R\0A\0G\0E\0#\0V\0o\0l\0u\0m\0e\0#\01\0&\03\00\0a\09\06\05\09\08\0&\00\0&\0S\0i\0g\0n\0a\0t\0u\0r\0e\0E\0F\03\0B\0E\0F\03\0B\0O\0f\0f\0s\0e\0t\07\0E\00\00\0L\0e\0n\0g\0t\0h\0B\0F\0B\04\08\02\00\00\0#\0{\05\03\0f\05\06\03\00\0d\0-\0b\06\0b\0f\0-\01\01\0d\00\0-\09\04\0f\02\0-\00\00\0a\00\0c\09\01\0e\0f\0b\08\0b\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\0\\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\09\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\0\0\0\0\0\310\2\0\0\240\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\240\7\0\0\250\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\7\0\0\250\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0\304\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0T\0\0\0d\326\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\0\226\0\240\326\22\0\0\0\0\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0"}, 712, ) }, 712, ) == 0x0
 01952   432   NtClose  (216, ... ) == 0x0
 01953   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 216, ) }, ... 216, ) == 0x0
 01954   432   NtOpenKey  (0x2000000, {24, 216, 0x40, 0, 0,  (0x2000000, {24, 216, 0x40, 0, 0, "{1a0315e9-a4ba-11db-9d02-806d6172696f}\"}, ... 212, ) }, ... 212, ) == 0x0
 01955   432   NtClose  (216, ... ) == 0x0
 01956   432   NtQueryValueKey  (212,  (212, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01957   432   NtClose  (212, ... ) == 0x0
 01958   432   NtAllocateVirtualMemory  (-1, 1490944, 0, 4096, 4096, 4, ... 1490944, 4096, ) == 0x0
 01959   432   NtQueryInformationFile  (-1, 1235748, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 01960   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1235700,  (0x100080, {24, 0, 0x40, 0, 1235700, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 01961   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\09\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 8, ... , 520, 8, ...
 01962   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e9-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01963   432   NtClose  (-2147482012, ... ) == 0x0
 01961   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 01964   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\09\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 16, ... , 520, 16, ...
 01965   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e9-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01966   432   NtClose  (-2147482012, ... ) == 0x0
 01964   432   NtDeviceIoControlFile  ... {status=0x0, info=12},  ... {status=0x0, info=12}, "\10\0\0\0C\0:\0\0\0\0\0", ) , ) == 0x0
 01967   432   NtClose  (212, ... ) == 0x0
 01968   432   NtQueryInformationFile  (-1, 1235748, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 01969   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1235700,  (0x100080, {24, 0, 0x40, 0, 1235700, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 01970   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\09\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 8, ... , 520, 8, ...
 01971   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e9-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01972   432   NtClose  (-2147482012, ... ) == 0x0
 01970   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 01973   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\09\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 16, ... , 520, 16, ...
 01974   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e9-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01975   432   NtClose  (-2147482012, ... ) == 0x0
 01973   432   NtDeviceIoControlFile  ... {status=0x0, info=12},  ... {status=0x0, info=12}, "\10\0\0\0C\0:\0\0\0\0\0", ) , ) == 0x0
 01976   432   NtClose  (212, ... ) == 0x0
 01977   432   NtCreateKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1a0315e9-a4ba-11db-9d02-806d6172696f}\"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01978   432   NtSetValueKey  (212,  (212, "BaseClass", 0, 1, "D\0r\0i\0v\0e\0\0\0", 12, ... ) , 0, 1,  (212, "BaseClass", 0, 1, "D\0r\0i\0v\0e\0\0\0", 12, ... ) , 12, ... ) == 0x0
 01979   432   NtClose  (212, ... ) == 0x0
 01980   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\C\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01981   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 01982   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "Applications\Explorer.exe\Drives\C\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01983   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Applications\Explorer.exe\Drives\C\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01984   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\C\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01985   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 01986   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "Applications\Explorer.exe\Drives\C\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01987   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Applications\Explorer.exe\Drives\C\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01988   432   NtQueryInformationFile  (-1, 1235748, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 01989   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1235700,  (0x100080, {24, 0, 0x40, 0, 1235700, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 01990   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\07\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 8, ... , 520, 8, ...
 01991   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e7-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01992   432   NtClose  (-2147482012, ... ) == 0x0
 01990   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 01993   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\07\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 16, ... , 520, 16, ...
 01994   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e7-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 01995   432   NtClose  (-2147482012, ... ) == 0x0
 01993   432   NtDeviceIoControlFile  ... {status=0x0, info=12},  ... {status=0x0, info=12}, "\10\0\0\0D\0:\0\0\0\0\0", ) , ) == 0x0
 01996   432   NtClose  (212, ... ) == 0x0
 01997   432   NtQueryInformationFile  (-1, 1235748, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 01998   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1235700,  (0x100080, {24, 0, 0x40, 0, 1235700, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 01999   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\07\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 8, ... , 520, 8, ...
 02000   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e7-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 02001   432   NtClose  (-2147482012, ... ) == 0x0
 01999   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 02002   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\07\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 16, ... , 520, 16, ...
 02003   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e7-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=0}, ) }, 0, 64, ... -2147482012, {status=0x0, info=0}, ) == 0x0
 02004   432   NtClose  (-2147482012, ... ) == 0x0
 02002   432   NtDeviceIoControlFile  ... {status=0x0, info=12},  ... {status=0x0, info=12}, "\10\0\0\0D\0:\0\0\0\0\0", ) , ) == 0x0
 02005   432   NtClose  (212, ... ) == 0x0
 02006   432   NtCreateKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1a0315e7-a4ba-11db-9d02-806d6172696f}\"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02007   432   NtSetValueKey  (212,  (212, "BaseClass", 0, 1, "D\0r\0i\0v\0e\0\0\0", 12, ... ) , 0, 1,  (212, "BaseClass", 0, 1, "D\0r\0i\0v\0e\0\0\0", 12, ... ) , 12, ... ) == 0x0
 02008   432   NtClose  (212, ... ) == 0x0
 02009   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\D\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02010   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 02011   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "Applications\Explorer.exe\Drives\D\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02012   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Applications\Explorer.exe\Drives\D\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02013   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\D\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02014   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 02015   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "Applications\Explorer.exe\Drives\D\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02016   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Applications\Explorer.exe\Drives\D\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02017   432   NtQueryInformationFile  (-1, 1235748, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 02018   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1235700,  (0x100080, {24, 0, 0x40, 0, 1235700, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 02019   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\06\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 8, ... , 520, 8, ...
 02020   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e6-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=1}, ) }, 0, 64, ... -2147482012, {status=0x0, info=1}, ) == 0x0
 02021   432   NtClose  (-2147482012, ... ) == 0x0
 02019   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 02022   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\06\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 16, ... , 520, 16, ...
 02023   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e6-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=1}, ) }, 0, 64, ... -2147482012, {status=0x0, info=1}, ) == 0x0
 02024   432   NtClose  (-2147482012, ... ) == 0x0
 02022   432   NtDeviceIoControlFile  ... {status=0x0, info=12},  ... {status=0x0, info=12}, "\10\0\0\0A\0:\0\0\0\0\0", ) , ) == 0x0
 02025   432   NtClose  (212, ... ) == 0x0
 02026   432   NtQueryInformationFile  (-1, 1235748, 4, Ea, ... ) == STATUS_OBJECT_TYPE_MISMATCH
 02027   432   NtCreateFile  (0x100080, {24, 0, 0x40, 0, 1235700,  (0x100080, {24, 0, 0x40, 0, 1235700, "\??\MountPointManager"}, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 96, 0, 0, ... 212, {status=0x0, info=0}, ) == 0x0
 02028   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\06\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 8, ... , 520, 8, ...
 02029   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e6-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=1}, ) }, 0, 64, ... -2147482012, {status=0x0, info=1}, ) == 0x0
 02030   432   NtClose  (-2147482012, ... ) == 0x0
 02028   432   NtDeviceIoControlFile  ... ) == STATUS_BUFFER_OVERFLOW
 02031   432   NtDeviceIoControlFile  (212, 0, 0x0, 0x0, 0x6d0034,  (212, 0, 0x0, 0x0, 0x6d0034, "`\0\\0?\0?\0\\0V\0o\0l\0u\0m\0e\0{\01\0a\00\03\01\05\0e\06\0-\0a\04\0b\0a\0-\01\01\0d\0b\0-\09\0d\00\02\0-\08\00\06\0d\06\01\07\02\06\09\06\0f\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 520, 16, ... , 520, 16, ...
 02032   432   NtOpenFile  (0x80, {24, 0, 0x200, 0, 0,  (0x80, {24, 0, 0x200, 0, 0, "\??\Volume{1a0315e6-a4ba-11db-9d02-806d6172696f}"}, 0, 64, ... -2147482012, {status=0x0, info=1}, ) }, 0, 64, ... -2147482012, {status=0x0, info=1}, ) == 0x0
 02033   432   NtClose  (-2147482012, ... ) == 0x0
 02031   432   NtDeviceIoControlFile  ... {status=0x0, info=12},  ... {status=0x0, info=12}, "\10\0\0\0A\0:\0\0\0\0\0", ) , ) == 0x0
 02034   432   NtClose  (212, ... ) == 0x0
 02035   432   NtCreateKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1a0315e6-a4ba-11db-9d02-806d6172696f}\"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02036   432   NtSetValueKey  (212,  (212, "BaseClass", 0, 1, "D\0r\0i\0v\0e\0\0\0", 12, ... ) , 0, 1,  (212, "BaseClass", 0, 1, "D\0r\0i\0v\0e\0\0\0", 12, ... ) , 12, ... ) == 0x0
 02037   432   NtClose  (212, ... ) == 0x0
 02038   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\A\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02039   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 02040   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "Applications\Explorer.exe\Drives\A\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02041   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Applications\Explorer.exe\Drives\A\DefaultIcon"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02042   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\A\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02043   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 02044   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "Applications\Explorer.exe\Drives\A\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02045   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Applications\Explorer.exe\Drives\A\DefaultLabel"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02046   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02047   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02048   432   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\F:"}, 3, 96, ... 212, {status=0x0, info=1}, ) }, 3, 96, ... 212, {status=0x0, info=1}, ) == 0x0
 02049   432   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\F:"}, ... 216, ) }, ... 216, ) == 0x0
 02050   432   NtQuerySymbolicLinkObject  (216, ...  (216, ... "\Device\WinDfs\F:00000000000091c1", 66, ) , 66, ) == 0x0
 02051   432   NtClose  (216, ... ) == 0x0
 02052   432   NtQueryVolumeInformationFile  (212, 1235792, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02053   432   NtClose  (212, ... ) == 0x0
 02054   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02055   432   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\U:"}, 3, 96, ... 212, {status=0x0, info=1}, ) }, 3, 96, ... 212, {status=0x0, info=1}, ) == 0x0
 02056   432   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\U:"}, ... 216, ) }, ... 216, ) == 0x0
 02057   432   NtQuerySymbolicLinkObject  (216, ...  (216, ... "\Device\WinDfs\U:00000000000091c1", 66, ) , 66, ) == 0x0
 02058   432   NtClose  (216, ... ) == 0x0
 02059   432   NtQueryVolumeInformationFile  (212, 1235792, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02060   432   NtClose  (212, ... ) == 0x0
 02061   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02062   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 212, ) }, ... 212, ) == 0x0
 02063   432   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "{1a0315e9-a4ba-11db-9d02-806d6172696f}\"}, ... 216, ) }, ... 216, ) == 0x0
 02064   432   NtClose  (212, ... ) == 0x0
 02065   432   NtQueryValueKey  (216,  (216, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (216, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02066   432   NtClose  (216, ... ) == 0x0
 02067   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02068   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233980, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233980, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02069   432   NtClose  (216, ... ) == 0x0
 02070   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 02071   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "Directory"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02072   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Directory"}, ... 216, ) }, ... 216, ) == 0x0
 02073   432   NtQueryKey  (218, Name, 384, ... {Name= (218, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02074   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02075   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 212, ) == 0x0
 02076   432   NtQueryInformationToken  (212, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02077   432   NtClose  (212, ... ) == 0x0
 02078   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory\CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02079   432   NtOpenKey  (0x1, {24, 218, 0x40, 0, 0,  (0x1, {24, 218, 0x40, 0, 0, "CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02080   432   NtQueryKey  (218, Name, 384, ... {Name= (218, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02081   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02082   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 212, ) == 0x0
 02083   432   NtQueryInformationToken  (212, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02084   432   NtClose  (212, ... ) == 0x0
 02085   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02086   432   NtOpenKey  (0x2000000, {24, 218, 0x40, 0, 0, ""}, ... 212, ) == 0x0
 02087   432   NtClose  (218, ... ) == 0x0
 02088   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 02089   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 02090   432   NtReleaseSemaphore  (176, 1, ... 0, ) == 0x0
 02091   432   NtWaitForSingleObject  (176, 0, {0, 0}, ... ) == 0x0
 02092   432   NtQueryKey  (214, Name, 384, ... {Name= (214, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02093   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02094   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 216, ) == 0x0
 02095   432   NtQueryInformationToken  (216, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02096   432   NtClose  (216, ... ) == 0x0
 02097   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory\ShellEx\IconHandler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02098   432   NtOpenKey  (0x1, {24, 214, 0x40, 0, 0,  (0x1, {24, 214, 0x40, 0, 0, "ShellEx\IconHandler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02099   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02100   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02101   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 216, ) == 0x0
 02102   432   NtQueryInformationToken  (216, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02103   432   NtClose  (216, ... ) == 0x0
 02104   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02105   432   NtQueryValueKey  (214,  (214, "DocObject", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02106   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02107   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02108   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 216, ) == 0x0
 02109   432   NtQueryInformationToken  (216, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02110   432   NtClose  (216, ... ) == 0x0
 02111   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02112   432   NtQueryValueKey  (214,  (214, "BrowseInPlace", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02113   432   NtQueryKey  (214, Name, 384, ... {Name= (214, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02114   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02115   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 216, ) == 0x0
 02116   432   NtQueryInformationToken  (216, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02117   432   NtClose  (216, ... ) == 0x0
 02118   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory\Clsid"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02119   432   NtOpenKey  (0x1, {24, 214, 0x40, 0, 0,  (0x1, {24, 214, 0x40, 0, 0, "Clsid"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02120   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02121   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "Folder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02122   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Folder"}, ... 216, ) }, ... 216, ) == 0x0
 02123   432   NtQueryKey  (218, Name, 384, ... {Name= (218, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Foldert"}, 86, ) }, 86, ) == 0x0
 02124   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02125   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02126   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02127   432   NtClose  (220, ... ) == 0x0
 02128   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Folder\Clsid"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02129   432   NtOpenKey  (0x1, {24, 218, 0x40, 0, 0,  (0x1, {24, 218, 0x40, 0, 0, "Clsid"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02130   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02131   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02132   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02133   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02134   432   NtClose  (220, ... ) == 0x0
 02135   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02136   432   NtQueryValueKey  (214,  (214, "IsShortcut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02137   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02138   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02139   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02140   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02141   432   NtClose  (220, ... ) == 0x0
 02142   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02143   432   NtQueryValueKey  (214,  (214, "AlwaysShowExt", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (214, "AlwaysShowExt", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02144   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Directory"}, 92, ) }, 92, ) == 0x0
 02145   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02146   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02147   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02148   432   NtClose  (220, ... ) == 0x0
 02149   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Directory"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02150   432   NtQueryValueKey  (214,  (214, "NeverShowExt", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02151   432   NtClose  (214, ... ) == 0x0
 02152   432   NtClose  (218, ... ) == 0x0
 02153   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02154   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233884, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233884, 616, BothDirectory, 1, "SRI-user", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02155   432   NtClose  (216, ... ) == 0x0
 02156   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02157   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233804, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233804, 616, BothDirectory, 1, "My Documents", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 02158   432   NtClose  (216, ... ) == 0x0
 02159   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02160   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02161   432   NtAllocateVirtualMemory  (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0
 02162   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 1229176, ... ) }, 1229176, ... ) == 0x0
 02163   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02164   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02165   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02166   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02167   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02168   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048659, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02169   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 83, 4096, 4, ... 11075584, 4096, ) == 0x0
 02170   432   NtReadFile  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79},  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79}, "[DeleteOnCopy]\15\12Owner=SRI-user\15\12Personalized=5\15\12PersonalizedName=My Documents\15\12", ) , ) == 0x0
 02171   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02172   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02173   432   NtClose  (216, ... ) == 0x0
 02174   432   NtAllocateVirtualMemory  (-1, 1495040, 0, 4096, 4096, 4, ... 1495040, 4096, ) == 0x0
 02175   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02176   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02177   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02178   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048659, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02179   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 83, 4096, 4, ... 11075584, 4096, ) == 0x0
 02180   432   NtReadFile  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79},  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79}, "[DeleteOnCopy]\15\12Owner=SRI-user\15\12Personalized=5\15\12PersonalizedName=My Documents\15\12", ) , ) == 0x0
 02181   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02182   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02183   432   NtClose  (216, ... ) == 0x0
 02184   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02185   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02186   432   NtClose  (216, ... ) == 0x0
 02187   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02188   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02189   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 1229176, ... ) }, 1229176, ... ) == 0x0
 02190   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02191   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02192   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02193   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02194   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02195   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048659, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02196   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 83, 4096, 4, ... 11075584, 4096, ) == 0x0
 02197   432   NtReadFile  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79},  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79}, "[DeleteOnCopy]\15\12Owner=SRI-user\15\12Personalized=5\15\12PersonalizedName=My Documents\15\12", ) , ) == 0x0
 02198   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02199   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02200   432   NtClose  (216, ... ) == 0x0
 02201   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02202   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02203   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02204   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048659, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02205   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 83, 4096, 4, ... 11075584, 4096, ) == 0x0
 02206   432   NtReadFile  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79},  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79}, "[DeleteOnCopy]\15\12Owner=SRI-user\15\12Personalized=5\15\12PersonalizedName=My Documents\15\12", ) , ) == 0x0
 02207   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02208   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02209   432   NtClose  (216, ... ) == 0x0
 02210   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02211   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02212   432   NtClose  (216, ... ) == 0x0
 02213   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02214   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02215   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 1231232, ... ) }, 1231232, ... ) == 0x0
 02216   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02217   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02218   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02219   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02220   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02221   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048659, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02222   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 83, 4096, 4, ... 11075584, 4096, ) == 0x0
 02223   432   NtReadFile  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79},  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79}, "[DeleteOnCopy]\15\12Owner=SRI-user\15\12Personalized=5\15\12PersonalizedName=My Documents\15\12", ) , ) == 0x0
 02224   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02225   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02226   432   NtClose  (216, ... ) == 0x0
 02227   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02228   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02229   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 1229512, ... ) }, 1229512, ... ) == 0x0
 02230   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02231   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02232   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02233   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02234   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02235   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048659, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02236   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 83, 4096, 4, ... 11075584, 4096, ) == 0x0
 02237   432   NtReadFile  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79},  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79}, "[DeleteOnCopy]\15\12Owner=SRI-user\15\12Personalized=5\15\12PersonalizedName=My Documents\15\12", ) , ) == 0x0
 02238   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02239   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02240   432   NtClose  (216, ... ) == 0x0
 02241   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02242   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02243   432   NtClose  (216, ... ) == 0x0
 02244   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02245   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02246   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 1229512, ... ) }, 1229512, ... ) == 0x0
 02247   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02248   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02249   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02250   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02251   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02252   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048659, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02253   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 83, 4096, 4, ... 11075584, 4096, ) == 0x0
 02254   432   NtReadFile  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79},  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79}, "[DeleteOnCopy]\15\12Owner=SRI-user\15\12Personalized=5\15\12PersonalizedName=My Documents\15\12", ) , ) == 0x0
 02255   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02256   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02257   432   NtClose  (216, ... ) == 0x0
 02258   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02259   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02260   432   NtClose  (216, ... ) == 0x0
 02261   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02262   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02263   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 1229512, ... ) }, 1229512, ... ) == 0x0
 02264   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02265   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02266   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\My Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02267   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02268   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02269   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048659, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02270   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 83, 4096, 4, ... 11075584, 4096, ) == 0x0
 02271   432   NtReadFile  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79},  (216, 0, 0, 0, 79, 0x0, 2012046884, ... {status=0x0, info=79}, "[DeleteOnCopy]\15\12Owner=SRI-user\15\12Personalized=5\15\12PersonalizedName=My Documents\15\12", ) , ) == 0x0
 02272   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02273   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02274   432   NtClose  (216, ... ) == 0x0
 02275   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02276   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02277   432   NtClose  (216, ... ) == 0x0
 02278   432   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 02279   432   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 02280   432   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 02281   432   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 02282   432   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 216, 2, ) }, 0, 0x0, 0, ... 216, 2, ) == 0x0
 02283   432   NtQueryValueKey  (216,  (216, "Common Documents", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (216, "Common Documents", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 68, ) }, 68, ) == 0x0
 02284   432   NtClose  (216, ... ) == 0x0
 02285   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents"}, 1235664, ... ) }, 1235664, ... ) == 0x0
 02286   432   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 216, 2, ) }, 0, 0x0, 0, ... 216, 2, ) == 0x0
 02287   432   NtSetValueKey  (216,  (216, "Common Documents", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0", 92, ... ) , 0, 1,  (216, "Common Documents", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0", 92, ... ) , 92, ... ) == 0x0
 02288   432   NtClose  (216, ... ) == 0x0
 02289   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 1234076, ... ) }, 1234076, ... ) == 0x0
 02290   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 5, 96, ... 216, {status=0x0, info=1}, ) }, 5, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02291   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 216, ... 212, ) == 0x0
 02292   432   NtClose  (216, ... ) == 0x0
 02293   432   NtMapViewOfSection  (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa90000), 0x0, 262144, ) == 0x0
 02294   432   NtClose  (212, ... ) == 0x0
 02295   432   NtUnmapViewOfSection  (-1, 0xa90000, ... ) == 0x0
 02296   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02297   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02298   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 212, ) }, ... 212, ) == 0x0
 02299   432   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "{1a0315e9-a4ba-11db-9d02-806d6172696f}\"}, ... 216, ) }, ... 216, ) == 0x0
 02300   432   NtClose  (212, ... ) == 0x0
 02301   432   NtQueryValueKey  (216,  (216, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (216, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02302   432   NtClose  (216, ... ) == 0x0
 02303   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02304   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233984, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233984, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02305   432   NtClose  (216, ... ) == 0x0
 02306   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02307   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233892, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233892, 616, BothDirectory, 1, "All Users", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 02308   432   NtClose  (216, ... ) == 0x0
 02309   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02310   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233820, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233820, 616, BothDirectory, 1, "Documents", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 02311   432   NtClose  (216, ... ) == 0x0
 02312   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02313   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02314   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 1229192, ... ) }, 1229192, ... ) == 0x0
 02315   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02316   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02317   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02318   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02319   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02320   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048718, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02321   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 142, 4096, 4, ... 11075584, 4096, ) == 0x0
 02322   432   NtReadFile  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138},  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138}, "[.ShellClassInfo]\15\12LocalizedResourceName=@shell32.dll,-21785\15\12[FileSharingInformation]\15\12ShortcutName=Shared Documents on SRI-S3S1K11CZE9\15\12", ) , ) == 0x0
 02323   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02324   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02325   432   NtClose  (216, ... ) == 0x0
 02326   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02327   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02328   432   NtClose  (216, ... ) == 0x0
 02329   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02330   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02331   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 1229164, ... ) }, 1229164, ... ) == 0x0
 02332   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02333   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02334   432   NtAllocateVirtualMemory  (-1, 1499136, 0, 4096, 4096, 4, ... 1499136, 4096, ) == 0x0
 02335   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02336   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02337   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02338   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048718, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02339   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 142, 4096, 4, ... 11075584, 4096, ) == 0x0
 02340   432   NtReadFile  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138},  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138}, "[.ShellClassInfo]\15\12LocalizedResourceName=@shell32.dll,-21785\15\12[FileSharingInformation]\15\12ShortcutName=Shared Documents on SRI-S3S1K11CZE9\15\12", ) , ) == 0x0
 02341   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02342   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02343   432   NtClose  (216, ... ) == 0x0
 02344   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02345   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02346   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 1229528, ... ) }, 1229528, ... ) == 0x0
 02347   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02348   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02349   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02350   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02351   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02352   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048718, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02353   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 142, 4096, 4, ... 11075584, 4096, ) == 0x0
 02354   432   NtReadFile  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138},  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138}, "[.ShellClassInfo]\15\12LocalizedResourceName=@shell32.dll,-21785\15\12[FileSharingInformation]\15\12ShortcutName=Shared Documents on SRI-S3S1K11CZE9\15\12", ) , ) == 0x0
 02355   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02356   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02357   432   NtClose  (216, ... ) == 0x0
 02358   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02359   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02360   432   NtClose  (216, ... ) == 0x0
 02361   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02362   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02363   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 1229528, ... ) }, 1229528, ... ) == 0x0
 02364   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02365   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02366   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02367   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02368   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02369   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048718, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02370   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 142, 4096, 4, ... 11075584, 4096, ) == 0x0
 02371   432   NtReadFile  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138},  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138}, "[.ShellClassInfo]\15\12LocalizedResourceName=@shell32.dll,-21785\15\12[FileSharingInformation]\15\12ShortcutName=Shared Documents on SRI-S3S1K11CZE9\15\12", ) , ) == 0x0
 02372   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02373   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02374   432   NtClose  (216, ... ) == 0x0
 02375   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02376   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02377   432   NtClose  (216, ... ) == 0x0
 02378   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02379   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02380   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 1229528, ... ) }, 1229528, ... ) == 0x0
 02381   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02382   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02383   432   NtOpenFile  (0x80100000, {24, 0, 0x40, 0, 0,  (0x80100000, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Documents\desktop.ini"}, 7, 96, ... 216, {status=0x0, info=1}, ) }, 7, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02384   432   NtLockFile  (216, 0, 0, 0, {0, 0}, {-1, -1}, 1, 0, 0, ... {status=0x0, info=-2142329745}, ) == 0x0
 02385   432   NtQueryInformationFile  (216, 1484944, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02386   432   NtAllocateVirtualMemory  (-1, 0, 0, 1048718, 8192, 4, ... 11075584, 1052672, ) == 0x0
 02387   432   NtAllocateVirtualMemory  (-1, 11075584, 0, 142, 4096, 4, ... 11075584, 4096, ) == 0x0
 02388   432   NtReadFile  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138},  (216, 0, 0, 0, 138, 0x0, 2012046884, ... {status=0x0, info=138}, "[.ShellClassInfo]\15\12LocalizedResourceName=@shell32.dll,-21785\15\12[FileSharingInformation]\15\12ShortcutName=Shared Documents on SRI-S3S1K11CZE9\15\12", ) , ) == 0x0
 02389   432   NtFreeVirtualMemory  (-1, (0xa90000), 1052672, 32768, ... (0xa90000), 1052672, ) == 0x0
 02390   432   NtUnlockFile  (216, {0, 0}, {-1, -1}, 432, ... ) == STATUS_RANGE_NOT_LOCKED
 02391   432   NtClose  (216, ... ) == 0x0
 02392   432   NtOpenProcessToken  (-1, 0x8, ... 216, ) == 0x0
 02393   432   NtQueryInformationToken  (216, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 02394   432   NtClose  (216, ... ) == 0x0
 02395   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02396   432   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 02397   432   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 02398   432   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 02399   432   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 02400   432   NtCreateKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 216, 2, ) }, 0, 0x0, 0, ... 216, 2, ) == 0x0
 02401   432   NtQueryValueKey  (216,  (216, "Desktop", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0D\0e\0s\0k\0t\0o\0p\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (216, "Desktop", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0D\0e\0s\0k\0t\0o\0p\0\0\0"}, 56, ) }, 56, ) == 0x0
 02402   432   NtClose  (216, ... ) == 0x0
 02403   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Desktop"}, 1235664, ... ) }, 1235664, ... ) == 0x0
 02404   432   NtCreateKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 216, 2, ) }, 0, 0x0, 0, ... 216, 2, ) == 0x0
 02405   432   NtSetValueKey  (216,  (216, "Desktop", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0D\0e\0s\0k\0t\0o\0p\0\0\0", 86, ... ) , 0, 1,  (216, "Desktop", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0D\0e\0s\0k\0t\0o\0p\0\0\0", 86, ... ) , 86, ... ) == 0x0
 02406   432   NtClose  (216, ... ) == 0x0
 02407   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 1234076, ... ) }, 1234076, ... ) == 0x0
 02408   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 5, 96, ... 216, {status=0x0, info=1}, ) }, 5, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02409   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 216, ... 212, ) == 0x0
 02410   432   NtClose  (216, ... ) == 0x0
 02411   432   NtMapViewOfSection  (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa90000), 0x0, 262144, ) == 0x0
 02412   432   NtClose  (212, ... ) == 0x0
 02413   432   NtUnmapViewOfSection  (-1, 0xa90000, ... ) == 0x0
 02414   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02415   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02416   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 212, ) }, ... 212, ) == 0x0
 02417   432   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "{1a0315e9-a4ba-11db-9d02-806d6172696f}\"}, ... 216, ) }, ... 216, ) == 0x0
 02418   432   NtClose  (212, ... ) == 0x0
 02419   432   NtQueryValueKey  (216,  (216, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (216, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02420   432   NtClose  (216, ... ) == 0x0
 02421   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02422   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233992, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233992, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02423   432   NtClose  (216, ... ) == 0x0
 02424   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02425   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233904, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233904, 616, BothDirectory, 1, "SRI-user", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02426   432   NtClose  (216, ... ) == 0x0
 02427   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02428   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233836, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233836, 616, BothDirectory, 1, "Desktop", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02429   432   NtClose  (216, ... ) == 0x0
 02430   432   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 02431   432   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 02432   432   NtReleaseSemaphore  (184, 1, ... 0, ) == 0x0
 02433   432   NtWaitForSingleObject  (184, 0, {0, 0}, ... ) == 0x0
 02434   432   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 216, 2, ) }, 0, 0x0, 0, ... 216, 2, ) == 0x0
 02435   432   NtQueryValueKey  (216,  (216, "Common Desktop", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0D\0e\0s\0k\0t\0o\0p\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (216, "Common Desktop", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0D\0e\0s\0k\0t\0o\0p\0\0\0"}, 64, ) }, 64, ) == 0x0
 02436   432   NtClose  (216, ... ) == 0x0
 02437   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Desktop"}, 1235664, ... ) }, 1235664, ... ) == 0x0
 02438   432   NtCreateKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 216, 2, ) }, 0, 0x0, 0, ... 216, 2, ) == 0x0
 02439   432   NtSetValueKey  (216,  (216, "Common Desktop", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0D\0e\0s\0k\0t\0o\0p\0\0\0", 88, ... ) , 0, 1,  (216, "Common Desktop", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0D\0e\0s\0k\0t\0o\0p\0\0\0", 88, ... ) , 88, ... ) == 0x0
 02440   432   NtClose  (216, ... ) == 0x0
 02441   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 1234076, ... ) }, 1234076, ... ) == 0x0
 02442   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 5, 96, ... 216, {status=0x0, info=1}, ) }, 5, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 02443   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 216, ... 212, ) == 0x0
 02444   432   NtClose  (216, ... ) == 0x0
 02445   432   NtMapViewOfSection  (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa90000), 0x0, 262144, ) == 0x0
 02446   432   NtClose  (212, ... ) == 0x0
 02447   432   NtUnmapViewOfSection  (-1, 0xa90000, ... ) == 0x0
 02448   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02449   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02450   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume"}, ... 212, ) }, ... 212, ) == 0x0
 02451   432   NtOpenKey  (0x2000000, {24, 212, 0x40, 0, 0,  (0x2000000, {24, 212, 0x40, 0, 0, "{1a0315e9-a4ba-11db-9d02-806d6172696f}\"}, ... 216, ) }, ... 216, ) == 0x0
 02452   432   NtClose  (212, ... ) == 0x0
 02453   432   NtQueryValueKey  (216,  (216, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (216, "Generation", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02454   432   NtClose  (216, ... ) == 0x0
 02455   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02456   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233988, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233988, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02457   432   NtClose  (216, ... ) == 0x0
 02458   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02459   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233900, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233900, 616, BothDirectory, 1, "All Users", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 02460   432   NtClose  (216, ... ) == 0x0
 02461   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 02462   432   NtQueryDirectoryFile  (216, 0, 0, 0, 1233832, 616, BothDirectory, 1,  (216, 0, 0, 0, 1233832, 616, BothDirectory, 1, "Desktop", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02463   432   NtClose  (216, ... ) == 0x0
 02464   432   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks"}, ... 216, ) }, ... 216, ) == 0x0
 02465   432   NtEnumerateValueKey  (216, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (216, 0, Full, 220, ... TitleIdx=0, Type=1, Name="{AEB6717E-7E19-11d0-97EE-00C04FD91972}", Data="\0\0"}, 98, ) , Data= (216, 0, Full, 220, ... TitleIdx=0, Type=1, Name="{AEB6717E-7E19-11d0-97EE-00C04FD91972}", Data="\0\0"}, 98, ) }, 98, ) == 0x0
 02466   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 02467   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, "CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02468   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32"}, ... 212, ) }, ... 212, ) == 0x0
 02469   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 02470   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02471   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02472   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02473   432   NtClose  (220, ... ) == 0x0
 02474   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02475   432   NtQueryValueKey  (214, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (214, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="s\0h\0e\0l\0l\03\02\0.\0d\0l\0l\0\0\0"}, 36, ) }, 36, ) == 0x0
 02476   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 02477   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02478   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02479   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02480   432   NtClose  (220, ... ) == 0x0
 02481   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02482   432   NtQueryValueKey  (214,  (214, "LoadWithoutCOM", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02483   432   NtClose  (214, ... ) == 0x0
 02484   432   NtEnumerateValueKey  (216, 1, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02485   432   NtClose  (216, ... ) == 0x0
 02486   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 216, ) }, ... 216, ) == 0x0
 02487   432   NtQueryValueKey  (216,  (216, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (216, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) , Data= (216, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) }, 60, ) == 0x0
 02488   432   NtClose  (216, ... ) == 0x0
 02489   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02490   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02491   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\tmp-490-wlr.bat"}, 1236000, ... ) }, 1236000, ... ) == 0x0
 02492   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02493   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02494   432   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 216, ) }, ... 216, ) == 0x0
 02495   432   NtQueryValueKey  (216,  (216, "ExecutableTypes", Partial, 0, ... ) , Partial, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 02496   432   NtQueryValueKey  (216,  (216, "ExecutableTypes", Partial, 260, ... TitleIdx=0, Type=7, Data="A\0D\0E\0\0\0A\0D\0P\0\0\0B\0A\0S\0\0\0B\0A\0T\0\0\0C\0H\0M\0\0\0C\0M\0D\0\0\0C\0O\0M\0\0\0C\0P\0L\0\0\0C\0R\0T\0\0\0E\0X\0E\0\0\0H\0L\0P\0\0\0H\0T\0A\0\0\0I\0N\0F\0\0\0I\0N\0S\0\0\0I\0S\0P\0\0\0L\0N\0K\0\0\0M\0D\0B\0\0\0M\0D\0E\0\0\0M\0S\0C\0\0\0M\0S\0I\0\0\0M\0S\0P\0\0\0M\0S\0T\0\0\0O\0C\0X\0\0\0P\0C\0D\0\0\0P\0I\0F\0\0\0R\0E\0G\0\0\0S\0C\0R\0\0\0S\0H\0S\0\0\0U\0R\0L\0\0\0V\0B\0\0\0W\0S\0C\0\0\0\0\0"}, 260, ) , Partial, 260, ... TitleIdx=0, Type=7, Data= (216, "ExecutableTypes", Partial, 260, ... TitleIdx=0, Type=7, Data="A\0D\0E\0\0\0A\0D\0P\0\0\0B\0A\0S\0\0\0B\0A\0T\0\0\0C\0H\0M\0\0\0C\0M\0D\0\0\0C\0O\0M\0\0\0C\0P\0L\0\0\0C\0R\0T\0\0\0E\0X\0E\0\0\0H\0L\0P\0\0\0H\0T\0A\0\0\0I\0N\0F\0\0\0I\0N\0S\0\0\0I\0S\0P\0\0\0L\0N\0K\0\0\0M\0D\0B\0\0\0M\0D\0E\0\0\0M\0S\0C\0\0\0M\0S\0I\0\0\0M\0S\0P\0\0\0M\0S\0T\0\0\0O\0C\0X\0\0\0P\0C\0D\0\0\0P\0I\0F\0\0\0R\0E\0G\0\0\0S\0C\0R\0\0\0S\0H\0S\0\0\0U\0R\0L\0\0\0V\0B\0\0\0W\0S\0C\0\0\0\0\0"}, 260, ) }, 260, ) == 0x0
 02497   432   NtClose  (216, ... ) == 0x0
 02498   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02499   432   NtOpenKey  (0x2000000, {24, 168, 0x40, 0, 0,  (0x2000000, {24, 168, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02500   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02501   432   NtOpenKey  (0x2000000, {24, 168, 0x40, 0, 0,  (0x2000000, {24, 168, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02502   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESD"}, 138, ) }, 138, ) == 0x0
 02503   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02504   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\.bat"}, ... 216, ) }, ... 216, ) == 0x0
 02505   432   NtQueryKey  (218, Name, 392, ... {Name= (218, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.bato"}, 82, ) }, 82, ) == 0x0
 02506   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02507   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 212, ) == 0x0
 02508   432   NtQueryInformationToken  (212, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02509   432   NtClose  (212, ... ) == 0x0
 02510   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02511   432   NtQueryValueKey  (218, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (218, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="b\0a\0t\0f\0i\0l\0e\0\0\0"}, 28, ) }, 28, ) == 0x0
 02512   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02513   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02514   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\batfile"}, ... 212, ) }, ... 212, ) == 0x0
 02515   432   NtQueryKey  (214, Name, 384, ... {Name= (214, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 02516   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02517   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02518   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02519   432   NtClose  (220, ... ) == 0x0
 02520   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02521   432   NtOpenKey  (0x1, {24, 214, 0x40, 0, 0,  (0x1, {24, 214, 0x40, 0, 0, "CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02522   432   NtQueryKey  (214, Name, 384, ... {Name= (214, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 02523   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02524   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02525   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02526   432   NtClose  (220, ... ) == 0x0
 02527   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02528   432   NtOpenKey  (0x2000000, {24, 214, 0x40, 0, 0, ""}, ... 220, ) == 0x0
 02529   432   NtClose  (214, ... ) == 0x0
 02530   432   NtQueryKey  (222, Name, 384, ... {Name= (222, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 02531   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02532   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 212, ) == 0x0
 02533   432   NtQueryInformationToken  (212, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02534   432   NtClose  (212, ... ) == 0x0
 02535   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\ShellEx\{C46CA590-3C3F-11D2-BEE6-0000F805CA57}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02536   432   NtOpenKey  (0x1, {24, 222, 0x40, 0, 0,  (0x1, {24, 222, 0x40, 0, 0, "ShellEx\{C46CA590-3C3F-11D2-BEE6-0000F805CA57}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02537   432   NtQueryKey  (218, Name, 384, ... {Name= (218, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.batC"}, 82, ) }, 82, ) == 0x0
 02538   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02539   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 212, ) == 0x0
 02540   432   NtQueryInformationToken  (212, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02541   432   NtClose  (212, ... ) == 0x0
 02542   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.bat\ShellEx\{C46CA590-3C3F-11D2-BEE6-0000F805CA57}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02543   432   NtOpenKey  (0x1, {24, 218, 0x40, 0, 0,  (0x1, {24, 218, 0x40, 0, 0, "ShellEx\{C46CA590-3C3F-11D2-BEE6-0000F805CA57}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02544   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02545   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "SystemFileAssociations\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02546   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\SystemFileAssociations\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02547   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESs"}, 138, ) }, 138, ) == 0x0
 02548   432   NtOpenKey  (0x1, {24, 162, 0x40, 0, 0,  (0x1, {24, 162, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02549   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\.bat"}, ... 212, ) }, ... 212, ) == 0x0
 02550   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.bato"}, 82, ) }, 82, ) == 0x0
 02551   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02552   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 224, ) == 0x0
 02553   432   NtQueryInformationToken  (224, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02554   432   NtClose  (224, ... ) == 0x0
 02555   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02556   432   NtQueryValueKey  (214,  (214, "PerceivedType", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02557   432   NtClose  (214, ... ) == 0x0
 02558   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02559   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "*"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02560   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\*"}, ... 212, ) }, ... 212, ) == 0x0
 02561   432   NtQueryKey  (214, Name, 384, ... {Name= (214, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\*"}, 76, ) }, 76, ) == 0x0
 02562   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02563   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 224, ) == 0x0
 02564   432   NtQueryInformationToken  (224, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02565   432   NtClose  (224, ... ) == 0x0
 02566   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\*\ShellEx\{C46CA590-3C3F-11D2-BEE6-0000F805CA57}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02567   432   NtOpenKey  (0x1, {24, 214, 0x40, 0, 0,  (0x1, {24, 214, 0x40, 0, 0, "ShellEx\{C46CA590-3C3F-11D2-BEE6-0000F805CA57}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02568   432   NtClose  (218, ... ) == 0x0
 02569   432   NtClose  (222, ... ) == 0x0
 02570   432   NtClose  (214, ... ) == 0x0
 02571   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02572   432   NtOpenKey  (0x2000000, {24, 168, 0x40, 0, 0,  (0x2000000, {24, 168, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02573   432   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02574   432   NtOpenKey  (0x2000000, {24, 168, 0x40, 0, 0,  (0x2000000, {24, 168, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02575   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02576   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, ".bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02577   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\.bat"}, ... 212, ) }, ... 212, ) == 0x0
 02578   432   NtQueryKey  (214, Name, 392, ... {Name= (214, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.bato"}, 82, ) }, 82, ) == 0x0
 02579   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02580   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02581   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02582   432   NtClose  (220, ... ) == 0x0
 02583   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02584   432   NtQueryValueKey  (214, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (214, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="b\0a\0t\0f\0i\0l\0e\0\0\0"}, 28, ) }, 28, ) == 0x0
 02585   432   NtQueryKey  (162, Name, 384, ... {Name= (162, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02586   432   NtOpenKey  (0x2000000, {24, 162, 0x40, 0, 0,  (0x2000000, {24, 162, 0x40, 0, 0, "batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02587   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\batfile"}, ... 220, ) }, ... 220, ) == 0x0
 02588   432   NtQueryKey  (222, Name, 384, ... {Name= (222, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 02589   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02590   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 216, ) == 0x0
 02591   432   NtQueryInformationToken  (216, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02592   432   NtClose  (216, ... ) == 0x0
 02593   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02594   432   NtOpenKey  (0x1, {24, 222, 0x40, 0, 0,  (0x1, {24, 222, 0x40, 0, 0, "CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02595   432   NtQueryKey  (222, Name, 384, ... {Name= (222, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 02596   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02597   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 216, ) == 0x0
 02598   432   NtQueryInformationToken  (216, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02599   432   NtClose  (216, ... ) == 0x0
 02600   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02601   432   NtOpenKey  (0x2000000, {24, 222, 0x40, 0, 0, ""}, ... 216, ) == 0x0
 02602   432   NtClose  (222, ... ) == 0x0
 02603   432   NtQueryKey  (218, Name, 384, ... {Name= (218, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile"}, 88, ) }, 88, ) == 0x0
 02604   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02605   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02606   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02607   432   NtClose  (220, ... ) == 0x0
 02608   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02609   432   NtOpenKey  (0x2000000, {24, 218, 0x40, 0, 0,  (0x2000000, {24, 218, 0x40, 0, 0, "shell"}, ... 220, ) }, ... 220, ) == 0x0
 02610   432   NtQueryKey  (222, Name, 392, ... {Name= (222, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell"}, 100, ) }, 100, ) == 0x0
 02611   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02612   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 224, ) == 0x0
 02613   432   NtQueryInformationToken  (224, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02614   432   NtClose  (224, ... ) == 0x0
 02615   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02616   432   NtQueryValueKey  (222, 0x0, Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02617   432   NtQueryKey  (222, Name, 384, ... {Name= (222, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell"}, 100, ) }, 100, ) == 0x0
 02618   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02619   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 224, ) == 0x0
 02620   432   NtQueryInformationToken  (224, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02621   432   NtClose  (224, ... ) == 0x0
 02622   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02623   432   NtOpenKey  (0x2000000, {24, 222, 0x40, 0, 0,  (0x2000000, {24, 222, 0x40, 0, 0, "open"}, ... 224, ) }, ... 224, ) == 0x0
 02624   432   NtClose  (222, ... ) == 0x0
 02625   432   NtQueryKey  (226, Name, 384, ... {Name= (226, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open3"}, 110, ) }, 110, ) == 0x0
 02626   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02627   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02628   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02629   432   NtClose  (220, ... ) == 0x0
 02630   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02631   432   NtOpenKey  (0x1, {24, 226, 0x40, 0, 0,  (0x1, {24, 226, 0x40, 0, 0, "command"}, ... 220, ) }, ... 220, ) == 0x0
 02632   432   NtQueryKey  (222, Name, 392, ... {Name= (222, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command8"}, 126, ) }, 126, ) == 0x0
 02633   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02634   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 228, ) == 0x0
 02635   432   NtQueryInformationToken  (228, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02636   432   NtClose  (228, ... ) == 0x0
 02637   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02638   432   NtQueryValueKey  (222, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=" (222, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=""\0%\01\0"\0 \0%\0*\0\0\0"}, 28, ) \0 \0%\0*\0\0\0"}, 28, ) == 0x0
 02639   432   NtClose  (222, ... ) == 0x0
 02640   432   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02641   432   NtQueryKey  (226, Name, 384, ... {Name= (226, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\opent"}, 110, ) }, 110, ) == 0x0
 02642   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02643   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02644   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02645   432   NtClose  (220, ... ) == 0x0
 02646   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02647   432   NtOpenKey  (0x1, {24, 226, 0x40, 0, 0,  (0x1, {24, 226, 0x40, 0, 0, "command"}, ... 220, ) }, ... 220, ) == 0x0
 02648   432   NtQueryKey  (222, Name, 392, ... {Name= (222, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command8"}, 126, ) }, 126, ) == 0x0
 02649   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02650   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 228, ) == 0x0
 02651   432   NtQueryInformationToken  (228, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02652   432   NtClose  (228, ... ) == 0x0
 02653   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02654   432   NtQueryValueKey  (222,  (222, "command", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02655   432   NtClose  (222, ... ) == 0x0
 02656   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\App Paths\tmp-490-wlr.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02657   432   NtQueryKey  (226, Name, 384, ... {Name= (226, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\opent"}, 110, ) }, 110, ) == 0x0
 02658   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02659   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02660   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02661   432   NtClose  (220, ... ) == 0x0
 02662   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02663   432   NtOpenKey  (0x1, {24, 226, 0x40, 0, 0,  (0x1, {24, 226, 0x40, 0, 0, "command"}, ... 220, ) }, ... 220, ) == 0x0
 02664   432   NtQueryKey  (222, Name, 392, ... {Name= (222, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command8"}, 126, ) }, 126, ) == 0x0
 02665   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02666   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 228, ) == 0x0
 02667   432   NtQueryInformationToken  (228, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02668   432   NtClose  (228, ... ) == 0x0
 02669   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02670   432   NtQueryValueKey  (222, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=" (222, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=""\0%\01\0"\0 \0%\0*\0\0\0"}, 28, ) \0 \0%\0*\0\0\0"}, 28, ) == 0x0
 02671   432   NtClose  (222, ... ) == 0x0
 02672   432   NtQueryKey  (226, Name, 384, ... {Name= (226, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open3"}, 110, ) }, 110, ) == 0x0
 02673   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02674   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02675   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02676   432   NtClose  (220, ... ) == 0x0
 02677   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\ddeexec"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02678   432   NtOpenKey  (0x1, {24, 226, 0x40, 0, 0,  (0x1, {24, 226, 0x40, 0, 0, "ddeexec"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02679   432   NtUserGetForegroundWindow  (... ) == 0x100aa
 02680   432   NtQueryKey  (226, Name, 384, ... {Name= (226, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open3"}, 110, ) }, 110, ) == 0x0
 02681   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02682   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 220, ) == 0x0
 02683   432   NtQueryInformationToken  (220, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02684   432   NtClose  (220, ... ) == 0x0
 02685   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02686   432   NtOpenKey  (0x1, {24, 226, 0x40, 0, 0,  (0x1, {24, 226, 0x40, 0, 0, "command"}, ... 220, ) }, ... 220, ) == 0x0
 02687   432   NtQueryKey  (222, Name, 392, ... {Name= (222, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command8"}, 126, ) }, 126, ) == 0x0
 02688   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02689   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 228, ) == 0x0
 02690   432   NtQueryInformationToken  (228, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02691   432   NtClose  (228, ... ) == 0x0
 02692   432   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\batfile\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02693   432   NtQueryValueKey  (222, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=" (222, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=""\0%\01\0"\0 \0%\0*\0\0\0"}, 28, ) \0 \0%\0*\0\0\0"}, 28, ) == 0x0
 02694   432   NtClose  (222, ... ) == 0x0
 02695   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 02696   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 02697   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02698   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 220, ) }, ... 220, ) == 0x0
 02699   432   NtQueryValueKey  (220,  (220, "RestrictRun", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02700   432   NtClose  (220, ... ) == 0x0
 02701   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 02702   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 02703   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02704   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 220, ) }, ... 220, ) == 0x0
 02705   432   NtQueryValueKey  (220,  (220, "DisallowRun", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02706   432   NtClose  (220, ... ) == 0x0
 02707   432   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\AppCompatibility\tmp-490-wlr.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02708   432   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\CheckBadApps"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02709   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\App Paths\tmp-490-wlr.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02710   432   NtReleaseSemaphore  (156, 1, ... 0, ) == 0x0
 02711   432   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 02712   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02713   432   NtOpenKey  (0x1, {24, 84, 0x40, 0, 0,  (0x1, {24, 84, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 220, ) }, ... 220, ) == 0x0
 02714   432   NtQueryValueKey  (220,  (220, "NoRunasInstallPrompt", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02715   432   NtClose  (220, ... ) == 0x0
 02716   432   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\App Paths\tmp-490-wlr.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02717   432   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 02718   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\tmp-490-wlr.bat"}, 1231300, ... ) }, 1231300, ... ) == 0x0
 02719   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\tmp-490-wlr.bat"}, 1231992, ... ) }, 1231992, ... ) == 0x0
 02720   432   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\tmp-490-wlr.bat"}, 5, 96, ... 220, {status=0x0, info=1}, ) }, 5, 96, ... 220, {status=0x0, info=1}, ) == 0x0
 02721   432   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 220, ... ) == STATUS_INVALID_IMAGE_NOT_MZ
 02722   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 228, ) }, ... 228, ) == 0x0
 02723   432   NtQueryValueKey  (228,  (228, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02724   432   NtClose  (228, ... ) == 0x0
 02725   432   NtQueryVolumeInformationFile  (220, 1231300, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02726   432   NtOpenMutant  (0x120001, {24, 52, 0x0, 0, 0,  (0x120001, {24, 52, 0x0, 0, 0, "ShimCacheMutex"}, ... 228, ) }, ... 228, ) == 0x0
 02727   432   NtAllocateVirtualMemory  (-1, 1503232, 0, 4096, 4096, 4, ... 1503232, 4096, ) == 0x0
 02728   432   NtWaitForSingleObject  (228, 0, {-1000000, -1}, ... ) == 0x0
 02729   432   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "ShimSharedMemory"}, ... 232, ) }, ... 232, ) == 0x0
 02730   432   NtMapViewOfSection  (232, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa90000), {0, 0}, 57344, ) == 0x0
 02731   432   NtReleaseMutant  (228, ... 0x0, ) == 0x0
 02732   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1229284, ... ) }, 1229284, ... ) == 0x0
 02733   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0
 02734   432   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 236, ... 240, ) == 0x0
 02735   432   NtClose  (236, ... ) == 0x0
 02736   432   NtMapViewOfSection  (240, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xaa0000), 0x0, 106496, ) == 0x0
 02737   432   NtClose  (240, ... ) == 0x0
 02738   432   NtUnmapViewOfSection  (-1, 0xaa0000, ... ) == 0x0
 02739   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1229600, ... ) }, 1229600, ... ) == 0x0
 02740   432   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 240, {status=0x0, info=1}, ) }, 5, 96, ... 240, {status=0x0, info=1}, ) == 0x0
 02741   432   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 240, ... 236, ) == 0x0
 02742   432   NtQuerySection  (236, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02743   432   NtClose  (240, ... ) == 0x0
 02744   432   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75f40000), 0x0, 118784, ) == 0x0
 02745   432   NtClose  (236, ... ) == 0x0
 02746   432   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0
 02747   432   NtQueryInformationFile  (236, 1229888, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02748   432   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 236, ... 240, ) == 0x0
 02749   432   NtMapViewOfSection  (240, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xaa0000), 0x0, 1028096, ) == 0x0
 02750   432   NtQueryInformationFile  (236, 1229984, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02751   432   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02752   432   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02753   432   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02754   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0
 02755   432   NtQueryDirectoryFile  (244, 0, 0, 0, 1227548, 616, BothDirectory, 1,  (244, 0, 0, 0, 1227548, 616, BothDirectory, 1, "tmp-490-wlr.bat", 0, ... {status=0x0, info=124}, ) , 0, ... {status=0x0, info=124}, ) == 0x0
 02756   432   NtClose  (244, ... ) == 0x0
 02757   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02758   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02759   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\tmp-490-wlr.bat"}, 1226936, ... ) }, 1226936, ... ) == 0x0
 02760   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0
 02761   432   NtQueryDirectoryFile  (244, 0, 0, 0, 1226296, 616, BothDirectory, 1,  (244, 0, 0, 0, 1226296, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02762   432   NtClose  (244, ... ) == 0x0
 02763   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0
 02764   432   NtQueryDirectoryFile  (244, 0, 0, 0, 1226296, 616, BothDirectory, 1,  (244, 0, 0, 0, 1226296, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02765   432   NtClose  (244, ... ) == 0x0
 02766   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02767   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02768   432   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02769   432   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02770   432   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 02771   432   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02772   432   NtClose  (244, ... ) == 0x0
 02773   432   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02774   432   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\tmp-490-wlr.bat"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02775   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02776   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02777   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\tmp-490-wlr.bat"}, 1229216, ... ) }, 1229216, ... ) == 0x0
 02778   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0
 02779   432   NtQueryDirectoryFile  (244, 0, 0, 0, 1228576, 616, BothDirectory, 1,  (244, 0, 0, 0, 1228576, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02780   432   NtClose  (244, ... ) == 0x0
 02781   432   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0
 02782   432   NtQueryDirectoryFile  (244, 0, 0, 0, 1228576, 616, BothDirectory, 1,  (244, 0, 0, 0, 1228576, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02783   432   NtClose  (244, ... ) == 0x0
 02784   432   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02785   432   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02786   432   NtWaitForSingleObject  (228, 0, {-1000000, -1}, ... ) == 0x0
 02787   432   NtQueryVolumeInformationFile  (220, 1229860, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02788   432   NtQueryInformationFile  (220, 1229840, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02789   432   NtQueryInformationFile  (220, 1229880, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02790   432   NtReleaseMutant  (228, ... 0x0, ) == 0x0
 02791   432   NtUnmapViewOfSection  (-1, 0xaa0000, ... ) == 0x0
 02792   432   NtClose  (240, ... ) == 0x0
 02793   432   NtClose  (236, ... ) == 0x0
 02794   432   NtClose  (220, ... ) == 0x0
 02795   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\cmd.exe"}, 1231276, ... ) }, 1231276, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02796   432   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "cmd.exe"}, 1231276, ... ) }, 1231276, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02797   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cmd.exe"}, 1231276, ... ) }, 1231276, ... ) == 0x0
 02798   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cmd.exe"}, 1231992, ... ) }, 1231992, ... ) == 0x0
 02799   432   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cmd.exe"}, 5, 96, ... 220, {status=0x0, info=1}, ) }, 5, 96, ... 220, {status=0x0, info=1}, ) == 0x0
 02800   432   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 220, ... 236, ) == 0x0
 02801   432   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02802   432   NtQuerySection  (236, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02803   432   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02804   432   NtCreateProcessEx  (1233928, 2035711, 0, -1, 0, 236, 0, 0, 0, ... ) == 0x0
 02805   432   NtOpenSection  (0x6, {24, 52, 0x0, 0, 0,  (0x6, {24, 52, 0x0, 0, 0, "W32_Virtu"}, ... 244, ) }, ... 244, ) == 0x0
 02806   432   NtMapViewOfSection  (244, 240, (0x0), 0, 22585, 0x0, 22585, 2, 1048576, 4, ... (0x7ffa0000), 0x0, 24576, ) == 0x0
 02807   432   NtClose  (244, ... ) == 0x0
 02808   432   NtProtectVirtualMemory  (240, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 02809   432   NtWriteVirtualMemory  (240, 0x77f7e603,  (240, 0x77f7e603, "\350q-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02810   432   NtProtectVirtualMemory  (240, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 02811   432   NtWriteVirtualMemory  (240, 0x77f7e6a3,  (240, 0x77f7e6a3, "\350\36-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02812   432   NtProtectVirtualMemory  (240, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 02813   432   NtWriteVirtualMemory  (240, 0x77f7e6b3,  (240, 0x77f7e6b3, "\350\33-\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02814   432   NtSetInformationProcess  (240, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02815   432   NtQueryInformationProcess  (240, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=888,ParentPid=424,}, 0x0, ) == 0x0
 02816   432   NtReadVirtualMemory  (240, 0x7ffdf008, 4, ...  (240, 0x7ffdf008, 4, ... "\0\0\320J", 0x0, ) , 0x0, ) == 0x0
 02817   432   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cmd.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02818   432   NtAllocateVirtualMemory  (-1, 1507328, 0, 8192, 4096, 4, ... 1507328, 8192, ) == 0x0
 02819   432   NtReadVirtualMemory  (240, 0x4ad00000, 4096, ...  (240, 0x4ad00000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\13+S\231OJ=\312OJ=\312OJ=\312\265i}\312IJ=\312OJ<\312\235J=\312\265i$\312HJ=\312\224h \312MJ=\312\330ix\312NJ=\312\225i!\312\177J=\312\265i\0\312NJ=\312RichOJ=\312\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0&\343};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\310\1\0\0\364\3\0\0\0\0\0\226\245\0\0\0\20\0\0\0\300\1\0\0\0\320J\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\340\5\0\0\4\0\0\374\313\5\0\3\0\0\200\0\0\20\0\0\0\20\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\300\310\1\0P\0\0\0\0\260\3\0\230(\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\327\1\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0P\2\0\0X\0\0\0\0\20\0\0\344\2\0\0d\305\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\270\307\1\0\0\20\0\0\0\310\1\0\0\4\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 02820   432   NtReadVirtualMemory  (240, 0x4ad3b000, 256, ...  (240, 0x4ad3b000, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\3\0\0\00\0\0\200\13\0\0\0\200\0\0\200\16\0\0\0\230\0\0\200\20\0\0\0\260\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\1\0\0\0\310\0\0\200\2\0\0\0\340\0\0\200\3\0\0\0\370\0\0\200\4\0\0\0\20\1\0\200\5\0\0\0(\1\0\200\6\0\0\0@\1\0\200\7\0\0\0X\1\0\200\10\0\0\0p\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\1\0\0\0\210\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\200\2\0\200\240\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\1\0\0\0\270\1\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\4\0\0\320\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\4\0\0\340\1\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 02821   432   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02822   432   NtQueryInformationProcess  (240, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=888,ParentPid=424,}, 0x0, ) == 0x0
 02823   432   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\startupscripts"}, 1231992, ... ) }, 1231992, ... ) == 0x0
 02824   432   NtAllocateVirtualMemory  (-1, 0, 0, 1676, 4096, 4, ... 11141120, 4096, ) == 0x0
 02825   432   NtAllocateVirtualMemory  (240, 0, 0, 1910, 4096, 4, ... 65536, 4096, ) == 0x0
 02826   432   NtWriteVirtualMemory  (240, 0x10000,  (240, 0x10000, "=\0:\0:\0=\0:\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0p\0o\0l\0y\0u\0n\0p\0a\0c\0k\0\0\0=\0E\0x\0i\0t\0C\0o\0d\0e\0=\00\00\00\00\00\00\00\02\0\0\0=\0U\0:\0=\0U\0:\0\\0s\0t\0a\0r\0t\0u\0p\0s\0c\0r\0i\0p\0t\0s\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0C\0L\0I\0E\0N\0T\0N\0A\0M\0E\0=\0C\0o\0n\0s\0o\0l\0e\0\0\0C\0o\0m\0m\0o\0n\0P\0r\0o\0g\0r\0a\0m\0F\0i\0l\0e\0s\0=\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0C\0O\0M\0", 1910, ... 0x0, ) , 1910, ... 0x0, ) == 0x0
 02827   432   NtAllocateVirtualMemory  (240, 0, 0, 1676, 4096, 4, ... 131072, 4096, ) == 0x0
 02828   432   NtWriteVirtualMemory  (240, 0x20000,  (240, 0x20000, "\0\20\0\0\214\6\0\0\0\0\0\0\0\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"\0\10\2\220\2\0\0\0\0\0\0\374\0\376\0\230\4\0\06\08\0\230\5\0\0^\0`\0\320\5\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\06\08\00\6\0\0\36\0 \0h\6\0\0\0\0\2\0\210\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1676, ... 0x0, ) \0\10\2\220\2\0\0\0\0\0\0\374\0\376\0\230\4\0\06\08\0\230\5\0\0^\0`\0\320\5\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\06\08\00\6\0\0\36\0 \0h\6\0\0\0\0\2\0\210\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1676, ... 0x0, ) == 0x0
 02829   432   NtWriteVirtualMemory  (240, 0x7ffdf010,  (240, 0x7ffdf010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02830   432   NtWriteVirtualMemory  (240, 0x7ffdf1e8,  (240, 0x7ffdf1e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02831   432   NtFreeVirtualMemory  (-1, (0xaa0000), 0, 32768, ... (0xaa0000), 4096, ) == 0x0
 02832   432   NtAllocateVirtualMemory  (240, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 02833   432   NtAllocateVirtualMemory  (240, 196608, 0, 1048576, 4096, 4, ... 196608, 1048576, ) == 0x0
 02834   432   NtCreateThread  (0x1f03ff, 0x0, 240, 1232192, 1232912, 1, ... 244, {888, 892}, ) == 0x0
 02835   432   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 0, 1234024, 0, 0}  (24, {168, 196, new_msg, 0, 0, 1234024, 0, 0} "\0\0\0\0\0\0\1\0\24\0\0\0\1\0\0\0\360\0\0\0\364\0\0\0x\3\0\0|\3\0\0\0\0\0\0\0\0\0\0\20\4\0\4\0\0\0\0\0\0\0\0\364\326\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\0\0\0\0\0\0" ... {168, 196, reply, 0, 424, 432, 1589, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\1\0\0\0\360\0\0\0\364\0\0\0x\3\0\0|\3\0\0\0\0\0\0\0\0\0\0\20\4\0\4\0\0\0\0\0\0\0\0\364\326\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {168, 196, reply, 0, 424, 432, 1589, 0}  (24, {168, 196, new_msg, 0, 0, 1234024, 0, 0} "\0\0\0\0\0\0\1\0\24\0\0\0\1\0\0\0\360\0\0\0\364\0\0\0x\3\0\0|\3\0\0\0\0\0\0\0\0\0\0\20\4\0\4\0\0\0\0\0\0\0\0\364\326\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\0\0\0\0\0\0" ... {168, 196, reply, 0, 424, 432, 1589, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\1\0\0\0\360\0\0\0\364\0\0\0x\3\0\0|\3\0\0\0\0\0\0\0\0\0\0\20\4\0\4\0\0\0\0\0\0\0\0\364\326\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02836   432   NtResumeThread  (244, ... 1, ) == 0x0
 02837   432   NtClose  (220, ... ) == 0x0
 02838   432   NtClose  (236, ... ) == 0x0
 02839   432   NtClose  (226, ... ) == 0x0
 02840   432   NtClose  (214, ... ) == 0x0
 02841   432   NtClose  (218, ... ) == 0x0
 02842   432   NtClose  (240, ... ) == 0x0
 02843   432   NtClose  (244, ... ) == 0x0
 02844   432   NtUserDestroyWindow  (131250, ...
 02845   432   NtUserRemoveProp  (131250, 43288, ... ) == 0xffffffff
 02846   432   NtUserRemoveProp  (131250, 43282, ... ) == 0x0
 02847   432   NtUserRemoveProp  (131250, 43287, ... ) == 0x0
 02844   432   NtUserDestroyWindow  ... ) == 0x1
 02848   432   NtUserUnregisterClass  (1237372, 1998258176, 1237360, ... ) == 0x1
 02849   432   NtTerminateProcess  (0, 0, ... ) == 0x0
 02850   432   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x11,}, 4, ... ) == 0x0
 02851   432   NtWaitForMultipleObjects  (2, (180, 172, ), 1, 0, 0x0, ... ) == 0x1
 02852   432   NtClose  (172, ... ) == 0x0
 02853   432   NtSetEvent  (180, ... 0x0, ) == 0x0
 02854   432   NtClose  (180, ... ) == 0x0
 02855   432   NtWaitForMultipleObjects  (2, (188, 192, ), 1, 0, 0x0, ... ) == 0x1
 02856   432   NtClose  (192, ... ) == 0x0
 02857   432   NtSetEvent  (188, ... 0x0, ) == 0x0
 02858   432   NtClose  (188, ... ) == 0x0
 02859   432   NtWaitForMultipleObjects  (2, (196, 200, ), 1, 0, 0x0, ... ) == 0x1
 02860   432   NtClose  (200, ... ) == 0x0
 02861   432   NtSetEvent  (196, ... 0x0, ) == 0x0
 02862   432   NtClose  (196, ... ) == 0x0
 02863   432   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x10,}, 4, ... ) == 0x0
 02864   432   NtUnmapViewOfSection  (-1, 0xa30000, ... ) == 0x0
 02865   432   NtClose  (152, ... ) == 0x0
 02866   432   NtGdiDeleteObjectApp  (17826903, ... ) == 0x1
 02867   432   NtUserGetProcessWindowStation  (... ) == 0x28
 02868   432   NtUserBuildNameList  (40, 256, 1392152, 1241836, ... ) == 0x0
 02869   432   NtUserGetProcessWindowStation  (... ) == 0x28
 02870   432   NtUserOpenDesktop  ({24, 40, 0x40, 0, 0,  ({24, 40, 0x40, 0, 0, "Default"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x98
 02871   432   NtUserBuildHwndList  (152, 0, 0, 0, 64, ... (0x30048, 0x100de, 0x100a6, 0x100a4, 0x6002c, 0x20064, 0x20062, 0x10084, 0x10078, 0x10068, 0x30046, 0x10066, 0x30038, 0x1009c, 0x10090, 0x10080, 0x10026, 0x100e2, 0x100da, 0x100d0, 0x100be, 0x100bc, 0x100ba, 0x100b8, 0x100b6, 0x100b4, 0x100b0, 0x100ae, 0x2005e, 0x100aa, 0x100cc, 0x100c2, 0x100c0, 0x100ac, 0x10070, 0x5004a, 0x4004e, 0x8002a, 0x10082, 0x1007a, 0x1, ), 41, ) == 0x0
 02872   432   NtUserQueryWindow  (196680, 0, ... ) == 0x778
 02873   432   NtUserQueryWindow  (196680, 1, ... ) == 0x79c
 02874   432   NtUserQueryWindow  (65758, 0, ... ) == 0x778
 02875   432   NtUserQueryWindow  (65758, 1, ... ) == 0x79c
 02876   432   NtUserQueryWindow  (65702, 0, ... ) == 0x7e0
 02877   432   NtUserQueryWindow  (65702, 1, ... ) == 0x7e4
 02878   432   NtUserQueryWindow  (65700, 0, ... ) == 0x7e0
 02879   432   NtUserQueryWindow  (65700, 1, ... ) == 0x7e4
 02880   432   NtUserQueryWindow  (393260, 0, ... ) == 0x7e0
 02881   432   NtUserQueryWindow  (393260, 1, ... ) == 0x7e4
 02882   432   NtUserQueryWindow  (131172, 0, ... ) == 0x7e0
 02883   432   NtUserQueryWindow  (131172, 1, ... ) == 0x7e4
 02884   432   NtUserQueryWindow  (131170, 0, ... ) == 0x778
 02885   432   NtUserQueryWindow  (131170, 1, ... ) == 0x79c
 02886   432   NtUserQueryWindow  (65668, 0, ... ) == 0x778
 02887   432   NtUserQueryWindow  (65668, 1, ... ) == 0x79c
 02888   432   NtUserBuildHwndList  (0, 65668, 1, 0, 64, ... (0x10086, 0x1008a, 0x1008c, 0x1008e, 0x10092, 0x10094, 0x10096, 0x10098, 0x1009a, 0x1009e, 0x100a0, 0x100a2, 0x1, ), 13, ) == 0x0
 02889   432   NtUserQueryWindow  (65670, 0, ... ) == 0x778
 02890   432   NtUserQueryWindow  (65670, 1, ... ) == 0x79c
 02891   432   NtUserQueryWindow  (65674, 0, ... ) == 0x778
 02892   432   NtUserQueryWindow  (65674, 1, ... ) == 0x79c
 02893   432   NtUserQueryWindow  (65676, 0, ... ) == 0x778
 02894   432   NtUserQueryWindow  (65676, 1, ... ) == 0x79c
 02895   432   NtUserQueryWindow  (65678, 0, ... ) == 0x778
 02896   432   NtUserQueryWindow  (65678, 1, ... ) == 0x79c
 02897   432   NtUserQueryWindow  (65682, 0, ... ) == 0x778
 02898   432   NtUserQueryWindow  (65682, 1, ... ) == 0x79c
 02899   432   NtUserQueryWindow  (65684, 0, ... ) == 0x778
 02900   432   NtUserQueryWindow  (65684, 1, ... ) == 0x79c
 02901   432   NtUserQueryWindow  (65686, 0, ... ) == 0x778
 02902   432   NtUserQueryWindow  (65686, 1, ... ) == 0x79c
 02903   432   NtUserQueryWindow  (65688, 0, ... ) == 0x778
 02904   432   NtUserQueryWindow  (65688, 1, ... ) == 0x79c
 02905   432   NtUserQueryWindow  (65690, 0, ... ) == 0x778
 02906   432   NtUserQueryWindow  (65690, 1, ... ) == 0x79c
 02907   432   NtUserQueryWindow  (65694, 0, ... ) == 0x778
 02908   432   NtUserQueryWindow  (65694, 1, ... ) == 0x79c
 02909   432   NtUserQueryWindow  (65696, 0, ... ) == 0x778
 02910   432   NtUserQueryWindow  (65696, 1, ... ) == 0x79c
 02911   432   NtUserQueryWindow  (65698, 0, ... ) == 0x778
 02912   432   NtUserQueryWindow  (65698, 1, ... ) == 0x79c
 02913   432   NtUserQueryWindow  (65656, 0, ... ) == 0x778
 02914   432   NtUserQueryWindow  (65656, 1, ... ) == 0x79c
 02915   432   NtUserQueryWindow  (65640, 0, ... ) == 0x778
 02916   432   NtUserQueryWindow  (65640, 1, ... ) == 0x79c
 02917   432   NtUserQueryWindow  (196678, 0, ... ) == 0x778
 02918   432   NtUserQueryWindow  (196678, 1, ... ) == 0x79c
 02919   432   NtUserQueryWindow  (65638, 0, ... ) == 0x778
 02920   432   NtUserQueryWindow  (65638, 1, ... ) == 0x79c
 02921   432   NtUserQueryWindow  (196664, 0, ... ) == 0x778
 02922   432   NtUserQueryWindow  (196664, 1, ... ) == 0x79c
 02923   432   NtUserBuildHwndList  (0, 196664, 1, 0, 64, ... (0x3003a, 0x3003e, 0x3003c, 0x30040, 0x30042, 0x30044, 0x1006a, 0x10072, 0x10076, 0x1, ), 10, ) == 0x0
 02924   432   NtUserQueryWindow  (196666, 0, ... ) == 0x778
 02925   432   NtUserQueryWindow  (196666, 1, ... ) == 0x79c
 02926   432   NtUserQueryWindow  (196670, 0, ... ) == 0x778
 02927   432   NtUserQueryWindow  (196670, 1, ... ) == 0x79c
 02928   432   NtUserQueryWindow  (196668, 0, ... ) == 0x778
 02929   432   NtUserQueryWindow  (196668, 1, ... ) == 0x79c
 02930   432   NtUserQueryWindow  (196672, 0, ... ) == 0x778
 02931   432   NtUserQueryWindow  (196672, 1, ... ) == 0x79c
 02932   432   NtUserQueryWindow  (196674, 0, ... ) == 0x778
 02933   432   NtUserQueryWindow  (196674, 1, ... ) == 0x79c
 02934   432   NtUserQueryWindow  (196676, 0, ... ) == 0x778
 02935   432   NtUserQueryWindow  (196676, 1, ... ) == 0x79c
 02936   432   NtUserQueryWindow  (65642, 0, ... ) == 0x778
 02937   432   NtUserQueryWindow  (65642, 1, ... ) == 0x79c
 02938   432   NtUserQueryWindow  (65650, 0, ... ) == 0x778
 02939   432   NtUserQueryWindow  (65650, 1, ... ) == 0x79c
 02940   432   NtUserQueryWindow  (65654, 0, ... ) == 0x778
 02941   432   NtUserQueryWindow  (65654, 1, ... ) == 0x79c
 02942   432   NtUserQueryWindow  (65692, 0, ... ) == 0x778
 02943   432   NtUserQueryWindow  (65692, 1, ... ) == 0x79c
 02944   432   NtUserQueryWindow  (65680, 0, ... ) == 0x778
 02945   432   NtUserQueryWindow  (65680, 1, ... ) == 0x79c
 02946   432   NtUserQueryWindow  (65664, 0, ... ) == 0x778
 02947   432   NtUserQueryWindow  (65664, 1, ... ) == 0x77c
 02948   432   NtUserQueryWindow  (65574, 0, ... ) == 0x26c
 02949   432   NtUserQueryWindow  (65574, 1, ... ) == 0x2c8
 02950   432   NtUserQueryWindow  (65762, 0, ... ) == 0x378
 02951   432   NtUserQueryWindow  (65762, 1, ... ) == 0x37c
 02952   432   NtUserQueryWindow  (65754, 0, ... ) == 0x108
 02953   432   NtUserQueryWindow  (65754, 1, ... ) == 0x10c
 02954   432   NtUserQueryWindow  (65744, 0, ... ) == 0x108
 02955   432   NtUserQueryWindow  (65744, 1, ... ) == 0x10c
 02956   432   NtUserQueryWindow  (65726, 0, ... ) == 0x7e8
 02957   432   NtUserQueryWindow  (65726, 1, ... ) == 0x7ec
 02958   432   NtUserQueryWindow  (65724, 0, ... ) == 0x7e8
 02959   432   NtUserQueryWindow  (65724, 1, ... ) == 0x7ec
 02960   432   NtUserQueryWindow  (65722, 0, ... ) == 0x7e8
 02961   432   NtUserQueryWindow  (65722, 1, ... ) == 0x7ec
 02962   432   NtUserQueryWindow  (65720, 0, ... ) == 0x7e8
 02963   432   NtUserQueryWindow  (65720, 1, ... ) == 0x7ec
 02964   432   NtUserQueryWindow  (65718, 0, ... ) == 0x7e8
 02965   432   NtUserQueryWindow  (65718, 1, ... ) == 0x7ec
 02966   432   NtUserQueryWindow  (65716, 0, ... ) == 0x7e8
 02967   432   NtUserQueryWindow  (65716, 1, ... ) == 0x7ec
 02968   432   NtUserQueryWindow  (65712, 0, ... ) == 0x7e8
 02969   432   NtUserQueryWindow  (65712, 1, ... ) == 0x7ec
 02970   432   NtUserQueryWindow  (65710, 0, ... ) == 0x7e8
 02971   432   NtUserQueryWindow  (65710, 1, ... ) == 0x7ec
 02972   432   NtUserQueryWindow  (131166, 0, ... ) == 0x7d8
 02973   432   NtUserQueryWindow  (131166, 1, ... ) == 0x7dc
 02974   432   NtUserQueryWindow  (65706, 0, ... ) == 0x7f4
 02975   432   NtUserQueryWindow  (65706, 1, ... ) == 0x7f8
 02976   432   NtUserQueryWindow  (65740, 0, ... ) == 0x778
 02977   432   NtUserQueryWindow  (65740, 1, ... ) == 0x118
 02978   432   NtUserQueryWindow  (65730, 0, ... ) == 0x778
 02979   432   NtUserQueryWindow  (65730, 1, ... ) == 0x118
 02980   432   NtUserBuildHwndList  (0, 65730, 1, 0, 64, ... (0x100c4, 0x100c6, 0x100c8, 0x100ca, 0x1, ), 5, ) == 0x0
 02981   432   NtUserQueryWindow  (65732, 0, ... ) == 0x778
 02982   432   NtUserQueryWindow  (65732, 1, ... ) == 0x118
 02983   432   NtUserQueryWindow  (65734, 0, ... ) == 0x778
 02984   432   NtUserQueryWindow  (65734, 1, ... ) == 0x118
 02985   432   NtUserQueryWindow  (65736, 0, ... ) == 0x778
 02986   432   NtUserQueryWindow  (65736, 1, ... ) == 0x118
 02987   432   NtUserQueryWindow  (65738, 0, ... ) == 0x778
 02988   432   NtUserQueryWindow  (65738, 1, ... ) == 0x118
 02989   432   NtUserQueryWindow  (65728, 0, ... ) == 0x778
 02990   432   NtUserQueryWindow  (65728, 1, ... ) == 0x79c
 02991   432   NtUserQueryWindow  (65708, 0, ... ) == 0x7e0
 02992   432   NtUserQueryWindow  (65708, 1, ... ) == 0x7e4
 02993   432   NtUserQueryWindow  (65648, 0, ... ) == 0x778
 02994   432   NtUserQueryWindow  (65648, 1, ... ) == 0x7c8
 02995   432   NtUserQueryWindow  (327754, 0, ... ) == 0x778
 02996   432   NtUserQueryWindow  (327754, 1, ... ) == 0x77c
 02997   432   NtUserQueryWindow  (262222, 0, ... ) == 0x778
 02998   432   NtUserQueryWindow  (262222, 1, ... ) == 0x77c
 02999   432   NtUserQueryWindow  (524330, 0, ... ) == 0x778
 03000   432   NtUserQueryWindow  (524330, 1, ... ) == 0x77c
 03001   432   NtUserQueryWindow  (65666, 0, ... ) == 0x778
 03002   432   NtUserQueryWindow  (65666, 1, ... ) == 0x77c
 03003   432   NtUserQueryWindow  (65658, 0, ... ) == 0x778
 03004   432   NtUserQueryWindow  (65658, 1, ... ) == 0x77c
 03005   432   NtUserBuildHwndList  (0, 65658, 1, 0, 64, ... (0x1007c, 0x1007e, 0x1, ), 3, ) == 0x0
 03006   432   NtUserQueryWindow  (65660, 0, ... ) == 0x778
 03007   432   NtUserQueryWindow  (65660, 1, ... ) == 0x77c
 03008   432   NtUserQueryWindow  (65662, 0, ... ) == 0x778
 03009   432   NtUserQueryWindow  (65662, 1, ... ) == 0x77c
 03010   432   NtUserCloseDesktop  (152, ...
 03011   432   NtClose  (152, ... ) == 0x0
 03010   432   NtUserCloseDesktop  ... ) == 0x1
 03012   432   NtUserGetProcessWindowStation  (... ) == 0x28
 03013   432   NtUserOpenDesktop  ({24, 40, 0x40, 0, 0,  ({24, 40, 0x40, 0, 0, "Disconnect"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0
 03014   432   NtUserGetProcessWindowStation  (... ) == 0x28
 03015   432   NtUserOpenDesktop  ({24, 40, 0x40, 0, 0,  ({24, 40, 0x40, 0, 0, "Winlogon"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0
 03016   432   NtGdiDeleteObjectApp  (134874196, ... ) == 0x1
 03017   432   NtGdiDeleteObjectApp  (101319765, ... ) == 0x1
 03018   432   NtClose  (104, ... ) == 0x0
 03019   432   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xf,}, 4, ... ) == 0x0
 03020   432   NtClose  (96, ... ) == 0x0
 03021   432   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 03022   432   NtClose  (100, ... ) == 0x0
 03023   432   NtClose  (80, ... ) == 0x0
 03024   432   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xa,}, 4, ... ) == 0x0
 03025   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc03b
 03026   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03027   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc03d
 03028   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03029   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc03f
 03030   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03031   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc041
 03032   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03033   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc043
 03034   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03035   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc045
 03036   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03037   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc047
 03038   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03039   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc049
 03040   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03041   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc04b
 03042   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03043   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc04d
 03044   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03045   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc04f
 03046   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03047   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc051
 03048   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03049   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc053
 03050   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03051   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc057
 03052   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03053   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc059
 03054   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03055   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc05b
 03056   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03057   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc05d
 03058   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03059   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc05f
 03060   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03061   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc017
 03062   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03063   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc019
 03064   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03065   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc018
 03066   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03067   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc01a
 03068   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03069   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc01c
 03070   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03071   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc01e
 03072   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03073   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc01b
 03074   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03075   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc068
 03076   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03077   432   NtUserGetClassInfo  (1905590272, 1241884, 1241836, 1241912, 0, ... ) == 0xc06a
 03078   432   NtUserUnregisterClass  (1241888, 1905590272, 1241876, ... ) == 0x1
 03079   432   NtUnmapViewOfSection  (-1, 0x900000, ... ) == 0x0
 03080   432   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0
 03081   432   NtClose  (184, ... ) == 0x0
 03082   432   NtClose  (156, ... ) == 0x0
 03083   432   NtClose  (176, ... ) == 0x0
 03084   432   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x1,}, 4, ... ) == 0x0
 03085   432   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 03086   432   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 03087   432   NtClose  (164, ... ) == 0x0
 03088   432   NtClose  (168, ... ) == 0x0
 03089   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc03b
 03090   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03091   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc03d
 03092   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03093   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc03f
 03094   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03095   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc041
 03096   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03097   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc043
 03098   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03099   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc045
 03100   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03101   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc047
 03102   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03103   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc049
 03104   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03105   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc04b
 03106   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03107   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc04d
 03108   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03109   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc04f
 03110   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03111   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc051
 03112   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03113   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc053
 03114   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03115   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc057
 03116   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03117   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc059
 03118   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03119   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc05b
 03120   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03121   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc05d
 03122   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03123   432   NtUserGetClassInfo  (1999896576, 1241884, 1241836, 1241912, 0, ... ) == 0xc05f
 03124   432   NtUserUnregisterClass  (1241888, 1999896576, 1241876, ... ) == 0x1
 03125   432   NtClose  (112, ... ) == 0x0
 03126   432   NtFreeVirtualMemory  (-1, (0x0), 0, 32768, ... ) == STATUS_MEMORY_NOT_ALLOCATED
 03127   432   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 0, 0, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 424, 432, 1606, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 424, 432, 1606, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 424, 432, 1606, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03128   432   NtTerminateProcess  (-1, 0, ...
 03129   432   NtClose  (44, ... ) == 0x0