Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtDeleteAtom(>) 
 2 
NtGdiBitBlt(>) 
 7 
NtQueryInformationProcess(>) 
 15 

NtCallbackReturn(>) 
 1 
NtEnumerateKey(>) 
 2 
NtGdiCreateDIBitmapInternal(>) 
 7 
NtCreateSection(>) 
 17 

NtCreateMutant(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtGdiGetDCObject(>) 
 7 
NtGdiDeleteObjectApp(>) 
 18 

NtCreateProcessEx(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtGdiGetDCforBitmap(>) 
 7 
NtReadFile(>) 
 19 

NtCreateThread(>) 
 1 
NtOpenEvent(>) 
 2 
NtGdiGetStockObject(>) 
 7 
NtContinue(>) 
 20 

NtDelayExecution(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 2 
NtGdiRestoreDC(>) 
 7 
NtQuerySystemInformation(>) 
 20 

NtDuplicateToken(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtGdiSaveDC(>) 
 7 
NtUserCallOneParam(>) 
 20 

NtEnumerateValueKey(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtGdiSetDIBitsToDeviceInternal(>) 
 7 
NtWaitForSingleObject(>) 
 21 

NtGdiCreatePaletteInternal(>) 
 1 
NtReadVirtualMemory(>) 
 2 
NtOpenProcessToken(>) 
 7 
NtFlushInstructionCache(>) 
 23 

NtGdiInit(>) 
 1 
NtTerminateProcess(>) 
 2 
NtUserDestroyCursor(>) 
 7 
NtWriteFile(>) 
 23 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserWaitForInputIdle(>) 
 2 
NtUserSetCursorIconData(>) 
 7 
NtOpenProcessTokenEx(>) 
 24 

NtNotifyChangeKey(>) 
 1 
NtAddAtom(>) 
 3 
NtGdiCreateBitmap(>) 
 8 
NtOpenThreadTokenEx(>) 
 24 

NtOpenKeyedEvent(>) 
 1 
NtCreateSemaphore(>) 
 3 
NtQuerySection(>) 
 8 
NtOpenSection(>) 
 25 

NtOpenProcess(>) 
 1 
NtDuplicateObject(>) 
 3 
NtRequestWaitReplyPort(>) 
 8 
NtOpenFile(>) 
 30 

NtQueryInformationJobObject(>) 
 1 
NtFreeVirtualMemory(>) 
 3 
NtSetInformationThread(>) 
 8 
NtQueryAttributesFile(>) 
 31 

NtQueryObject(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtQueryDebugFilterState(>) 
 9 
NtQueryInformationToken(>) 
 31 

NtQuerySystemTime(>) 
 1 
NtOpenMutant(>) 
 3 
NtSetInformationFile(>) 
 9 
NtMapViewOfSection(>) 
 37 

NtRegisterThreadTerminatePort(>) 
 1 
NtSetInformationObject(>) 
 3 
NtCreateEvent(>) 
 10 
NtReleaseMutant(>) 
 40 

NtResumeThread(>) 
 1 
NtFsControlFile(>) 
 4 
NtGdiCreateCompatibleDC(>) 
 10 
NtAllocateVirtualMemory(>) 
 41 

NtSecureConnectPort(>) 
 1 
NtOpenThreadToken(>) 
 4 
NtGdiExtGetObjectW(>) 
 10 
NtProtectVirtualMemory(>) 
 45 

NtTestAlert(>) 
 1 
NtSetValueKey(>) 
 4 
NtQueryDirectoryFile(>) 
 10 
NtUserUnregisterClass(>) 
 45 

NtUserCallNoParam(>) 
 1 
NtWriteVirtualMemory(>) 
 4 
NtCreateFile(>) 
 11 
NtQueryValueKey(>) 
 51 

NtUserEnumDisplayMonitors(>) 
 1 
NtUserRegisterWindowMessage(>) 
 5 
NtUserGetDC(>) 
 11 
NtGdiSelectBitmap(>) 
 57 

NtUserGetKeyboardLayoutList(>) 
 1 
NtCreateKey(>) 
 6 
NtUnmapViewOfSection(>) 
 12 
NtUserRegisterClassExWOW(>) 
 63 

NtUserGetThreadDesktop(>) 
 1 
NtQueryDefaultUILanguage(>) 
 6 
NtQueryDefaultLocale(>) 
 13 
NtUserGetClassInfo(>) 
 64 

NtUserSetWindowsHookEx(>) 
 1 
NtQueryVirtualMemory(>) 
 6 
NtQueryInformationFile(>) 
 13 
NtUserFindExistingCursorIcon(>) 
 72 

NtAccessCheck(>) 
 2 
NtQueryVolumeInformationFile(>) 
 6 
NtUserSystemParametersInfo(>) 
 13 
NtOpenKey(>) 
 112 

NtCreateIoCompletion(>) 
 2 
NtSetInformationProcess(>) 
 6 
NtUserSelectPalette(>) 
 14 
NtClose(>) 
 165 


Trace:
 00001   464   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   464   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   464   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   464   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   464   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   464   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   464   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   464   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   464   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   464   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   464   NtClose  (12, ... ) == 0x0
 00014   464   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   464   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   464   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   464   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   464   NtClose  (16, ... ) == 0x0
 00021   464   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   464   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   464   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   464   NtClose  (16, ... ) == 0x0
 00026   464   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   464   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   464   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   464   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   464   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 456, 464, 1523, 0} "\330\375\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 456, 464, 1523, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 456, 464, 1523, 0} "\330\375\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   464   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   464   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   464   NtClose  (16, ... ) == 0x0
 00036   464   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   464   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   464   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   464   NtClose  (28, ... ) == 0x0
 00041   464   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   464   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   464   NtClose  (28, ... ) == 0x0
 00045   464   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   464   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   464   NtClose  (28, ... ) == 0x0
 00049   464   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   464   NtClose  (28, ... ) == 0x0
 00052   464   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   464   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   464   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   464   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 456, 464, 1528, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 456, 464, 1528, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 456, 464, 1528, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 128, ) == 0x0
 00057   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 128, ... (0x31428000), 8192, 4, ) == 0x0
 00058   464   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00059   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00061   464   NtClose  (28, ... ) == 0x0
 00062   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00064   464   NtClose  (28, ... ) == 0x0
 00065   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00066   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00067   464   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00068   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 00070   464   NtClose  (28, ... ) == 0x0
 00071   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00072   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00073   464   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00074   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00075   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00076   464   NtClose  (28, ... ) == 0x0
 00077   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00078   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00079   464   NtClose  (28, ... ) == 0x0
 00080   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00081   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00082   464   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00083   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00084   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0
 00085   464   NtClose  (28, ... ) == 0x0
 00086   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00087   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0
 00088   464   NtClose  (28, ... ) == 0x0
 00089   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00090   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0
 00091   464   NtClose  (28, ... ) == 0x0
 00092   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00093   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0
 00094   464   NtClose  (28, ... ) == 0x0
 00095   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00096   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00097   464   NtClose  (28, ... ) == 0x0
 00098   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 28, ) }, ... 28, ) == 0x0
 00099   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 00100   464   NtClose  (28, ... ) == 0x0
 00101   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00102   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00103   464   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00104   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00105   464   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00106   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00107   464   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00108   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == 0x0
 00109   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00110   464   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0
 00111   464   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00112   464   NtOpenProcessToken  (-1, 0x8, ... 36, ) == 0x0
 00113   464   NtQueryInformationToken  (36, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00114   464   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00115   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 40, ) }, ... 40, ) == 0x0
 00116   464   NtQueryValueKey  (40,  (40, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (40, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00117   464   NtClose  (40, ... ) == 0x0
 00118   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00119   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 40, ) == 0x0
 00120   464   NtQueryInformationToken  (40, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00121   464   NtClose  (40, ... ) == 0x0
 00122   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00123   464   NtClose  (36, ... ) == 0x0
 00124   464   NtClose  (28, ... ) == 0x0
 00125   464   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0
 00126   464   NtClose  (32, ... ) == 0x0
 00127   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00128   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00129   464   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00130   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == 0x0
 00131   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00132   464   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 32, ... 28, ) == 0x0
 00133   464   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00134   464   NtClose  (32, ... ) == 0x0
 00135   464   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00136   464   NtClose  (28, ... ) == 0x0
 00137   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00138   464   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00139   464   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00140   464   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00141   464   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00142   464   NtClose  (28, ... ) == 0x0
 00143   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00144   464   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00145   464   NtClose  (28, ... ) == 0x0
 00146   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00147   464   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00148   464   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00149   464   NtClose  (28, ... ) == 0x0
 00150   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00151   464   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00152   464   NtClose  (28, ... ) == 0x0
 00153   464   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00154   464   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00155   464   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00156   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00157   464   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00158   464   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00159   464   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00160   464   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 32, ) }, ... 32, ) == 0x0
 00161   464   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00162   464   NtClose  (32, ... ) == 0x0
 00163   464   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00164   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00165   464   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\31\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 456, 464, 1566, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 456, 464, 1566, 0}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\31\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 456, 464, 1566, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00166   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00167   464   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x410000), 0x0, 1060864, ) == 0x0
 00168   464   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00169   464   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00170   464   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482020, ) == 0x0
 00171   464   NtQueryInformationToken  (-2147482020, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00172   464   NtQueryInformationToken  (-2147482020, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00173   464   NtClose  (-2147482020, ... ) == 0x0
 00174   464   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5373952, 4096, ) == 0x0
 00175   464   NtFreeVirtualMemory  (-1, (0x520000), 4096, 32768, ... (0x520000), 4096, ) == 0x0
 00176   464   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00177   464   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00178   464   NtQueryValueKey  (-2147482020,  (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00179   464   NtClose  (-2147482020, ... ) == 0x0
 00180   464   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00181   464   NtQueryValueKey  (-2147482020,  (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00182   464   NtClose  (-2147482020, ... ) == 0x0
 00183   464   NtQueryDefaultLocale  (0, -135984628, ... ) == 0x0
 00184   464   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00185   464   NtUserCallNoParam  (24, ... ) == 0x0
 00186   464   NtGdiCreateCompatibleDC  (0, ...
 00187   464   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5373952, 4096, ) == 0x0
 00186   464   NtGdiCreateCompatibleDC  ... ) == 0xf010451
 00188   464   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00189   464   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00190   464   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0xb050458
 00191   464   NtGdiCreateSolidBrush  (0, 0, ...
 00192   464   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8585216, 4096, ) == 0x0
 00191   464   NtGdiCreateSolidBrush  ... ) == 0x810045b
 00193   464   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00194   464   NtGdiCreateCompatibleDC  (0, ... ) == 0x601045c
 00195   464   NtGdiSelectBitmap  (100729948, 184878168, ... ) == 0x185000f
 00196   464   NtUserGetThreadDesktop  (464, 0, ... ) == 0x2c
 00197   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00198   464   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00199   464   NtClose  (52, ... ) == 0x0
 00200   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00201   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810cc017
 00202   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00203   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810cc01c
 00204   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00205   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810cc01e
 00206   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00207   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810c8002
 00208   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00209   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810cc018
 00210   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00211   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810cc01a
 00212   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00213   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810cc01d
 00214   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00215   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... ) == 0x810cc026
 00216   464   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00217   464   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810cc019
 00218   464   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc020
 00219   464   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc022
 00220   464   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc023
 00221   464   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc024
 00222   464   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ...
 00223   464   NtAllocateVirtualMemory  (-1, 5550080, 0, 4096, 4096, 32, ... 5550080, 4096, ) == 0x0
 00222   464   NtUserRegisterClassExWOW  ... ) == 0x810cc025
 00224   464   NtCallbackReturn  (0, 0, 0, ...
 00225   464   NtGdiInit  (... ) == 0x1
 00226   464   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00227   464   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00228   464   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00229   464   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00230   464   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00231   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00232   464   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00233   464   NtClose  (52, ... ) == 0x0
 00234   464   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00235   464   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00236   464   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00237   464   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00238   464   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1243532, 0,  (0x1f0003, {24, 52, 0x80, 1243532, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 00239   464   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 56, ) }, ... 56, ) == 0x0
 00240   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00241   464   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00242   464   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 60, ) }, ... 60, ) == 0x0
 00243   464   NtQueryValueKey  (60,  (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00244   464   NtClose  (60, ... ) == 0x0
 00245   464   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00246   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00247   464   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00248   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00249   464   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00250   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 60, ) }, ... 60, ) == 0x0
 00251   464   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00252   464   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00253   464   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00254   464   NtClose  (60, ... ) == 0x0
 00255   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 60, ) }, ... 60, ) == 0x0
 00256   464   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00257   464   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00258   464   NtClose  (60, ... ) == 0x0
 00259   464   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00260   464   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 00261   464   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00262   464   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00263   464   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00264   464   NtAllocateVirtualMemory  (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0
 00265   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00266   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 60, ) == 0x0
 00267   464   NtQueryInformationToken  (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00268   464   NtClose  (60, ... ) == 0x0
 00269   464   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 60, ) }, ... 60, ) == 0x0
 00270   464   NtSetInformationObject  (60, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00271   464   NtCreateKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 64, 2, ) }, 0, 0x0, 0, ... 64, 2, ) == 0x0
 00272   464   NtQueryDefaultUILanguage  (1241768, ...
 00273   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00274   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482020, ) == 0x0
 00275   464   NtQueryInformationToken  (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00276   464   NtClose  (-2147482020, ... ) == 0x0
 00277   464   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00278   464   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00279   464   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00280   464   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00281   464   NtClose  (-2147482032, ... ) == 0x0
 00282   464   NtClose  (-2147482020, ... ) == 0x0
 00272   464   NtQueryDefaultUILanguage  ... ) == 0x0
 00283   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00284   464   NtQueryInstallUILanguage  (2012047340, ... ) == 0x0
 00285   464   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00286   464   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 72, ) == 0x0
 00287   464   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x840000), 0x0, 593920, ) == 0x0
 00288   464   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00289   464   NtQueryDefaultUILanguage  (2013024600, ...
 00290   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00291   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482020, ) == 0x0
 00292   464   NtQueryInformationToken  (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00293   464   NtClose  (-2147482020, ... ) == 0x0
 00294   464   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00295   464   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00296   464   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00297   464   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00298   464   NtClose  (-2147482032, ... ) == 0x0
 00299   464   NtClose  (-2147482020, ... ) == 0x0
 00289   464   NtQueryDefaultUILanguage  ... ) == 0x0
 00300   464   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00301   464   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 00302   464   NtQueryDefaultLocale  (1, 1239804, ... ) == 0x0
 00303   464   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00304   464   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1240660, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1240660, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275\213\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\365\22\0\0\0\0\0" ... {128, 156, reply, 0, 456, 464, 1567, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275\213\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\365\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 456, 464, 1567, 0}  (24, {128, 156, new_msg, 0, 1240660, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275\213\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\365\22\0\0\0\0\0" ... {128, 156, reply, 0, 456, 464, 1567, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275\213\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\365\22\0\0\0\0\0" )  ) == 0x0
 00305   464   NtClose  (68, ... ) == 0x0
 00306   464   NtClose  (72, ... ) == 0x0
 00307   464   NtUnmapViewOfSection  (-1, 0x840000, ... ) == 0x0
 00308   464   NtUnmapViewOfSection  (-1, 0x12f554, ... ) == STATUS_NOT_MAPPED_VIEW
 00309   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00310   464   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00311   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00312   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00313   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238344, ... ) }, 1238344, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00314   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00315   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00316   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00317   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1238936, ... ) }, 1238936, ... ) == 0x0
 00318   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 72, {status=0x0, info=1}, ) }, 3, 33, ... 72, {status=0x0, info=1}, ) == 0x0
 00319   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00320   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00321   464   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00322   464   NtClose  (68, ... ) == 0x0
 00323   464   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8f0000), 0x0, 921600, ) == 0x0
 00324   464   NtClose  (76, ... ) == 0x0
 00325   464   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 00326   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 76, {status=0x0, info=1}, ) }, 5, 96, ... 76, {status=0x0, info=1}, ) == 0x0
 00327   464   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 76, ... 68, ) == 0x0
 00328   464   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00329   464   NtClose  (76, ... ) == 0x0
 00330   464   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0
 00331   464   NtClose  (68, ... ) == 0x0
 00332   464   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00333   464   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00334   464   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00335   464   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00336   464   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00337   464   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00338   464   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00339   464   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00340   464   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00341   464   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00342   464   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00343   464   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00344   464   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00345   464   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00346   464   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00347   464   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00348   464   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00349   464   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00350   464   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00351   464   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00352   464   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00353   464   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240120, ... ) , 42, 1240120, ... ) == 0x0
 00354   464   NtQueryDefaultUILanguage  (1238836, ...
 00355   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00356   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482020, ) == 0x0
 00357   464   NtQueryInformationToken  (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00358   464   NtClose  (-2147482020, ... ) == 0x0
 00359   464   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00360   464   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00361   464   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00362   464   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00363   464   NtClose  (-2147482032, ... ) == 0x0
 00364   464   NtClose  (-2147482020, ... ) == 0x0
 00354   464   NtQueryDefaultUILanguage  ... ) == 0x0
 00365   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00366   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237688, ... ) }, 1237688, ... ) == 0x0
 00367   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00368   464   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00369   464   NtClose  (68, ... ) == 0x0
 00370   464   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x840000), 0x0, 4096, ) == 0x0
 00371   464   NtClose  (76, ... ) == 0x0
 00372   464   NtUnmapViewOfSection  (-1, 0x840000, ... ) == 0x0
 00373   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237328, ... ) }, 1237328, ... ) == 0x0
 00374   464   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238028,  (0x80100080, {24, 0, 0x40, 0, 1238028, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) == 0x0
 00375   464   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 76, ... 68, ) == 0x0
 00376   464   NtClose  (76, ... ) == 0x0
 00377   464   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x840000), {0, 0}, 4096, ) == 0x0
 00378   464   NtClose  (68, ... ) == 0x0
 00379   464   NtUnmapViewOfSection  (-1, 0x840000, ... ) == 0x0
 00380   464   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00381   464   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 76, ) == 0x0
 00382   464   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x840000), 0x0, 4096, ) == 0x0
 00383   464   NtQueryInformationFile  (68, 1237648, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 00384   464   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00385   464   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 456, 464, 1568, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 456, 464, 1568, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 456, 464, 1568, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ) == 0x0
 00386   464   NtClose  (68, ... ) == 0x0
 00387   464   NtClose  (76, ... ) == 0x0
 00388   464   NtUnmapViewOfSection  (-1, 0x840000, ... ) == 0x0
 00389   464   NtUnmapViewOfSection  (-1, 0x12e9e0, ... ) == STATUS_NOT_MAPPED_VIEW
 00390   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00391   464   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00392   464   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 00393   464   NtUserGetDC  (0, ... ) == 0x1010052
 00394   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00395   464   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 00396   464   NtUserSystemParametersInfo  (66, 12, 1240140, 0, ... ) == 0x1
 00397   464   NtOpenProcessToken  (-1, 0x8, ... 76, ) == 0x0
 00398   464   NtAccessCheck  (1344424, 76, 0x1, 1239544, 1239488, 56, 1239572, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00399   464   NtClose  (76, ... ) == 0x0
 00400   464   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 76, ) }, ... 76, ) == 0x0
 00401   464   NtQueryValueKey  (76,  (76, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00402   464   NtClose  (76, ... ) == 0x0
 00403   464   NtUserSystemParametersInfo  (41, 500, 1239640, 0, ... ) == 0x1
 00404   464   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 76, ) }, ... 76, ) == 0x0
 00405   464   NtQueryValueKey  (76,  (76, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00406   464   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 68, ) }, ... 68, ) == 0x0
 00407   464   NtQueryValueKey  (68,  (68, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00408   464   NtClose  (68, ... ) == 0x0
 00409   464   NtClose  (76, ... ) == 0x0
 00410   464   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 00411   464   NtUserSystemParametersInfo  (4130, 0, 1240164, 0, ... ) == 0x1
 00412   464   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 76, ) }, ... 76, ) == 0x0
 00413   464   NtEnumerateValueKey  (76, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00414   464   NtClose  (76, ... ) == 0x0
 00415   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00416   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc03b
 00417   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc03d
 00418   464   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00419   464   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc03f
 00420   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00421   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc041
 00422   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00423   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc043
 00424   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc045
 00425   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00426   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc047
 00427   464   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00428   464   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc049
 00429   464   NtUserGetClassInfo  (1905590272, 1240060, 1240012, 1240088, 0, ... ) == 0xc049
 00430   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00431   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc04b
 00432   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00433   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc04d
 00434   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00435   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc04f
 00436   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc051
 00437   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00438   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc053
 00439   464   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00440   464   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc055
 00441   464   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc057
 00442   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00443   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc059
 00444   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10013
 00445   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc05b
 00446   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00447   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc05d
 00448   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00449   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc05f
 00450   464   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00451   464   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc017
 00452   464   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00453   464   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc019
 00454   464   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10013
 00455   464   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc018
 00456   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00457   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc01a
 00458   464   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00459   464   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc01c
 00460   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00461   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc01e
 00462   464   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00463   464   NtUserRegisterClassExWOW  (1239956, 1240036, 1240020, 1240052, 0, 384, 0, ... ) == 0x810cc01b
 00464   464   NtUserFindExistingCursorIcon  (1239440, 1239456, 1240024, ... ) == 0x10011
 00465   464   NtUserRegisterClassExWOW  (1239952, 1240032, 1240016, 1240048, 0, 384, 0, ... ) == 0x810cc068
 00466   464   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00467   464   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc06a
 00468   464   NtCreateKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 76, 2, ) }, 0, 0x0, 0, ... 76, 2, ) == 0x0
 00469   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00470   464   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00471   464   NtTestAlert  (... ) == 0x0
 00472   464   NtContinue  (1244464, 1, ...
 00473   464   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x3142a000,}, 4, ... ) == 0x0
 00474   464   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 68, ) }, ... 68, ) == 0x0
 00475   464   NtQueryValueKey  (68,  (68, "PINF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00476   464   NtClose  (68, ... ) == 0x0
 00477   464   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00478   464   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1234112,  (0x80100080, {24, 0, 0x40, 0, 1234112, "\??\u:\work\packed.exe"}, 0x0, 1, 1, 1, 96, 0, 0, ... 68, {status=0x0, info=1}, ) }, 0x0, 1, 1, 1, 96, 0, 0, ... 68, {status=0x0, info=1}, ) == 0x0
 00479   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp"}, 1233828, ... ) }, 1233828, ... ) == 0x0
 00480   464   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1354040, 1354584, 1234168, 0}  (24, {20, 48, new_msg, 0, 1354040, 1354584, 1234168, 0} "\0\0\0\0\2\0\1\0\225\0\0\0\0\0\0\0\215\26\365w" ... {20, 48, reply, 0, 456, 464, 1569, 0} "\0\0\0\0\2\0\1\0\1\0\0\0\0\0\0\0\1\0\0\0" )  ... {20, 48, reply, 0, 456, 464, 1569, 0}  (24, {20, 48, new_msg, 0, 1354040, 1354584, 1234168, 0} "\0\0\0\0\2\0\1\0\225\0\0\0\0\0\0\0\215\26\365w" ... {20, 48, reply, 0, 456, 464, 1569, 0} "\0\0\0\0\2\0\1\0\1\0\0\0\0\0\0\0\1\0\0\0" )  ) == 0x0
 00481   464   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233836,  (0x80100080, {24, 0, 0x40, 0, 1233836, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.tmp"}, 0x0, 128, 0, 2, 96, 0, 0, ... 80, {status=0x0, info=2}, ) }, 0x0, 128, 0, 2, 96, 0, 0, ... 80, {status=0x0, info=2}, ) == 0x0
 00482   464   NtClose  (80, ... ) == 0x0
 00483   464   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234112,  (0xc0100080, {24, 0, 0x40, 0, 1234112, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.tmp"}, 0x0, 128, 1, 5, 96, 0, 0, ... }, 0x0, 128, 1, 5, 96, 0, 0, ...
 00484   464   NtClose  (-2147482020, ... ) == 0x0
 00483   464   NtCreateFile  ... 80, {status=0x0, info=3}, ) == 0x0
 00485   464   NtSetInformationFile  (68, 1234204, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00486   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "SF\26\0\34\34F\0\32\34I\0\341\343F\0\246\34F\0\36\34F\0^\34\\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\36F\0\244\14F\16\1\250O\315?\244GL\323=\326\220Jt/s>l4oyn'm>q3sj<$e>n3n>i(d{nfWwru2\23\26b7\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0\36\34F\0", ) , ) == 0x0
 00487   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "MZP\0\2\0\0\0\4\0\17\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\32\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00488   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\22\343V\377\12\343\352\3G]\1U\252\327PY\323\35\33\364\35T)<9\25]^RQ\23olev\11(\0z\260s\1M\230\216\3\251l\341O\234\361\213]v(tX,\302\232&]bb\276\351?\177\260\370\16Z\257\356\310\336z\315P\307@\2\252\37\236\363/r\214\252U\362\221a\355\37^\7\2412\227\206\275\12"\263u.4<3{<\25R\346'\323An\230\255^,\10zj\3620\7\3563:jnf\31d\312K\34?\350\14\256\315\7\215\341=%\2t\202"\27\0\250\222\376D\27\27&D\12\220\6\212*\25\246\320\200\332z5^\223\14\3449C\332\370VI\372\32.OK\264\250<\33\311_c\322\24\274\202\346()6?\307\26d\356Dx6\15\230'\31Y\375\301lkB\216\310M\320\273\320\16\2624\360\24\370\222\240^\27[`\314vD"\37\355G\21\235M\212\234\33\362\305\33\322\332Fg7\312\2260\2677\332S0\6\6W[\22\257\1+(\222\220\204\306\212I\13\31k\314:\16f_\313\272\212@'\370\312\343\266\260j\271^\27\206\264\20H&\24\332\236\21\24\355\12\33\3b\244*\301v\274@E\256\241\213\316\266\275~\203fD+0^4\236\21\360V\36fB\252\326\34\326<\30\24\341\343\314\326\256\276\20\37\216\14[\313_$\27l\25089\212\307\360\313M\362\357\26\33]\252\340\274\?\256y\366\253\17\263#\370`\344F\27\315\11\246\3073\2\34\4"\233\222\264\317BF\22\20\204\272\372\325\\371[D%^N\3\3E\251.\376\1\32b\360Yz\5\273\25\\22y\250(G\262\13v\366\17\252\312\B\337\14\36372\347zi_0\321\345xf~\213S]\3\334\302\23\310\266\374\245L\252_X\221 \327=\232Y", ) \263u.4<3{<\25R\346'\323An\230\255^,\10zj\3620\7\3563:jnf\31d\312K\34?\350\14\256\315\7\215\341=%\2t\202 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\22\343V\377\12\343\352\3G]\1U\252\327PY\323\35\33\364\35T)<9\25]^RQ\23olev\11(\0z\260s\1M\230\216\3\251l\341O\234\361\213]v(tX,\302\232&]bb\276\351?\177\260\370\16Z\257\356\310\336z\315P\307@\2\252\37\236\363/r\214\252U\362\221a\355\37^\7\2412\227\206\275\12"\263u.4<3{<\25R\346'\323An\230\255^,\10zj\3620\7\3563:jnf\31d\312K\34?\350\14\256\315\7\215\341=%\2t\202"\27\0\250\222\376D\27\27&D\12\220\6\212*\25\246\320\200\332z5^\223\14\3449C\332\370VI\372\32.OK\264\250<\33\311_c\322\24\274\202\346()6?\307\26d\356Dx6\15\230'\31Y\375\301lkB\216\310M\320\273\320\16\2624\360\24\370\222\240^\27[`\314vD"\37\355G\21\235M\212\234\33\362\305\33\322\332Fg7\312\2260\2677\332S0\6\6W[\22\257\1+(\222\220\204\306\212I\13\31k\314:\16f_\313\272\212@'\370\312\343\266\260j\271^\27\206\264\20H&\24\332\236\21\24\355\12\33\3b\244*\301v\274@E\256\241\213\316\266\275~\203fD+0^4\236\21\360V\36fB\252\326\34\326<\30\24\341\343\314\326\256\276\20\37\216\14[\313_$\27l\25089\212\307\360\313M\362\357\26\33]\252\340\274\?\256y\366\253\17\263#\370`\344F\27\315\11\246\3073\2\34\4"\233\222\264\317BF\22\20\204\272\372\325\\371[D%^N\3\3E\251.\376\1\32b\360Yz\5\273\25\\22y\250(G\262\13v\366\17\252\312\B\337\14\36372\347zi_0\321\345xf~\213S]\3\334\302\23\310\266\374\245L\252_X\221 \327=\232Y", ) \37\355G\21\235M\212\234\33\362\305\33\322\332Fg7\312\2260\2677\332S0\6\6W[\22\257\1+(\222\220\204\306\212I\13\31k\314:\16f_\313\272\212@'\370\312\343\266\260j\271^\27\206\264\20H&\24\332\236\21\24\355\12\33\3b\244*\301v\274@E\256\241\213\316\266\275~\203fD+0^4\236\21\360V\36fB\252\326\34\326<\30\24\341\343\314\326\256\276\20\37\216\14[\313_$\27l\25089\212\307\360\313M\362\357\26\33]\252\340\274\?\256y\366\253\17\263#\370`\344F\27\315\11\246\3073\2\34\4 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\22\343V\377\12\343\352\3G]\1U\252\327PY\323\35\33\364\35T)<9\25]^RQ\23olev\11(\0z\260s\1M\230\216\3\251l\341O\234\361\213]v(tX,\302\232&]bb\276\351?\177\260\370\16Z\257\356\310\336z\315P\307@\2\252\37\236\363/r\214\252U\362\221a\355\37^\7\2412\227\206\275\12"\263u.4<3{<\25R\346'\323An\230\255^,\10zj\3620\7\3563:jnf\31d\312K\34?\350\14\256\315\7\215\341=%\2t\202"\27\0\250\222\376D\27\27&D\12\220\6\212*\25\246\320\200\332z5^\223\14\3449C\332\370VI\372\32.OK\264\250<\33\311_c\322\24\274\202\346()6?\307\26d\356Dx6\15\230'\31Y\375\301lkB\216\310M\320\273\320\16\2624\360\24\370\222\240^\27[`\314vD"\37\355G\21\235M\212\234\33\362\305\33\322\332Fg7\312\2260\2677\332S0\6\6W[\22\257\1+(\222\220\204\306\212I\13\31k\314:\16f_\313\272\212@'\370\312\343\266\260j\271^\27\206\264\20H&\24\332\236\21\24\355\12\33\3b\244*\301v\274@E\256\241\213\316\266\275~\203fD+0^4\236\21\360V\36fB\252\326\34\326<\30\24\341\343\314\326\256\276\20\37\216\14[\313_$\27l\25089\212\307\360\313M\362\357\26\33]\252\340\274\?\256y\366\253\17\263#\370`\344F\27\315\11\246\3073\2\34\4"\233\222\264\317BF\22\20\204\272\372\325\\371[D%^N\3\3E\251.\376\1\32b\360Yz\5\273\25\\22y\250(G\262\13v\366\17\252\312\B\337\14\36372\347zi_0\321\345xf~\213S]\3\334\302\23\310\266\374\245L\252_X\221 \327=\232Y", ) , ) == 0x0
 00489   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\14\377\20\377\24\377\254\3YAGU\264\313\26Y\315\1]\364\3Ho<'\11\33^LMUory0\116\34<\260m\35\13\230\220\37\357l\377S\332\361\225A0(jDj\302\204:\33b|\242\257?a\254\276\16D\263\250\310\300f\213P\331\D\252\1\202\265/l\220\354U\354\215'\355\1BA\241,\213\300\275\24>\365u0(z3e SR\370;\225Ap\204\353^2\24\312U\0y\350\22\262\213\7\223\375{%\34h\304"\11\34\356\222\340XQ\278XL\220\30\226l\25\270\314\306\332d)\30\223\22\370\177C\304\344\20I\344\6hOU\250\356<\5\325\31c\314\10\372\202\3704o6!\333Pd\360X>6\23\204a\31G\341\207lu^\310\310S\314\375\320\20\256r\360\12\344\324\240@\13\35`\322j\2"\1\361\1\21\203Q\314\234\5\356\203\33\314\306\0g)\326\3200\251+\234S.\32@WE\16\351\154\324\220\232\332\314I\25\5-\314$\22 _\325\246\314@9\344\214\343\250\254,\271@\13\300\264\16T`\24\304\202W\24\363\26]\3|\270l\301h\240\6E\260\275\315\316\250\2418\203xXm0@(\330\21\356JXf\\266\220\34\310 ^\24\377\377\212\326\260\242V\37\220\20\35\313A8Ql\266$\177\212\331\354\215M\354\363P\33C\266\246\274B#\350y\350\267I\263=\344&\344X\13\213\11\270\333u\2\2\30d\233\214\250\211BX\16V\204\244\346\223\\347G\2%@RE\3[\265h\376\37\6$\360GfC\273\13@Ty\2664\1\262\25j\260\17\264\326\32B\301\20\2657,\373350\22\262\213\7\223\375{%\34h\304 (80, 0, 0, 0, "\14\377\20\377\24\377\254\3YAGU\264\313\26Y\315\1]\364\3Ho<'\11\33^LMUory0\116\34<\260m\35\13\230\220\37\357l\377S\332\361\225A0(jDj\302\204:\33b|\242\257?a\254\276\16D\263\250\310\300f\213P\331\D\252\1\202\265/l\220\354U\354\215'\355\1BA\241,\213\300\275\24>\365u0(z3e SR\370;\225Ap\204\353^2\24\312U\0y\350\22\262\213\7\223\375{%\34h\304"\11\34\356\222\340XQ\278XL\220\30\226l\25\270\314\306\332d)\30\223\22\370\177C\304\344\20I\344\6hOU\250\356<\5\325\31c\314\10\372\202\3704o6!\333Pd\360X>6\23\204a\31G\341\207lu^\310\310S\314\375\320\20\256r\360\12\344\324\240@\13\35`\322j\2"\1\361\1\21\203Q\314\234\5\356\203\33\314\306\0g)\326\3200\251+\234S.\32@WE\16\351\154\324\220\232\332\314I\25\5-\314$\22 _\325\246\314@9\344\214\343\250\254,\271@\13\300\264\16T`\24\304\202W\24\363\26]\3|\270l\301h\240\6E\260\275\315\316\250\2418\203xXm0@(\330\21\356JXf\\266\220\34\310 ^\24\377\377\212\326\260\242V\37\220\20\35\313A8Ql\266$\177\212\331\354\215M\354\363P\33C\266\246\274B#\350y\350\267I\263=\344&\344X\13\213\11\270\333u\2\2\30d\233\214\250\211BX\16V\204\244\346\223\\347G\2%@RE\3[\265h\376\37\6$\360GfC\273\13@Ty\2664\1\262\25j\260\17\264\326\32B\301\20\2657,\3731\361\1\21\203Q\314\234\5\356\203\33\314\306\0g)\326\3200\251+\234S.\32@WE\16\351\154\324\220\232\332\314I\25\5-\314$\22 _\325\246\314@9\344\214\343\250\254,\271@\13\300\264\16T`\24\304\202W\24\363\26]\3|\270l\301h\240\6E\260\275\315\316\250\2418\203xXm0@(\330\21\356JXf\\266\220\34\310 ^\24\377\377\212\326\260\242V\37\220\20\35\313A8Ql\266$\177\212\331\354\215M\354\363P\33C\266\246\274B#\350y\350\267I\263=\344&\344X\13\213\11\270\333u\2\2\30d\233\214\250\211BX\16V\204\244\346\223\\347G\2%@RE\3[\265h\376\37\6$\360GfC\273\13@Ty\2664\1\262\25j\260\17\264\326\32B\301\20\2657,\373227\345fz8\213MAE\334\334\17\216\266\342\271\12\252AD\327 \311!\334Y", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00490   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "U\177\22P2\233*#|\10pd~\256Z\262\222vglv\3264\310,nJtn\271e\312\327<|+Tc\20\215d\5\202Q?^\177\233\202\333\244\272\20\204\25\20\247\2659\264XD\361\252L\177\34\234\353\206+\225\232\177\232\235T'@q6\307\246\341\363\370(\224[N:\316h\177\366X\247u\230K\217\354]\302KB\371\307\226\374n\32Zr\363X\3\200m\23346\270.\10C\14P\4<\100V\200h\260\240\33\350\304Q\13\236W\6X\335\27Z\227"\260\374\263\252\337-\270o\210\36\217\3729\376x\212\35\261\14n\335\371\344X}*s\231O1\313>\3\22rkyG.\35-\224\212Z8>\253N\12\2\20\34+c.\352G1;/\325\314H]XN_\374\343Q\272\36\24\313u\21\227:\10\31-\206\212\20'\14\374k\241\263\13\303\222\32\12\354\0H\366\335\303\331Ik\355W\177\305F\277\27^8H\1'\3448\3354!mh\332'\30689\335\21j\306\347\2042\30x\270\270\351\253\235_\261\225\227\11\177\27\314G\2246\307\341\341\30397f51\333\224D%\224\224BLlb\2\271\302\263\265M\26\6\223X\15'D\\200\371\303\177\313\37\346\260\6\342\253FO\17\4]u\362\255\260\366h\7f\227\365\324y\200\373\303|\32\365\376[|E\374\260\212r\6\327l\6^\203\222\371W3\360\317c\247\4\221\277|\213!\257B\200!\33\235\2\305\262\305\321Q\35\361\17\354VVz\376\243V\301\31\342tr\25kK\17\241\325E\\227G\363<\331\343\227\216\220A\275_\266%G\301\224\35\306\373\34nL~\31\30\346\332\360\3044\2\30oY\23m\14BA\257]Re\2339\210\262\253\312\11_}#J\5\341\273\35\350\351\357\231\327", ) \260\374\263\252\337-\270o\210\36\217\3729\376x\212\35\261\14n\335\371\344X}*s\231O1\313>\3\22rkyG.\35-\224\212Z8>\253N\12\2\20\34+c.\352G1;/\325\314H]XN_\374\343Q\272\36\24\313u\21\227:\10\31-\206\212\20'\14\374k\241\263\13\303\222\32\12\354\0H\366\335\303\331Ik\355W\177\305F\277\27^8H\1'\3448\3354!mh\332'\30689\335\21j\306\347\2042\30x\270\270\351\253\235_\261\225\227\11\177\27\314G\2246\307\341\341\30397f51\333\224D%\224\224BLlb\2\271\302\263\265M\26\6\223X\15'D\\200\371\303\177\313\37\346\260\6\342\253FO\17\4]u\362\255\260\366h\7f\227\365\324y\200\373\303|\32\365\376[|E\374\260\212r\6\327l\6^\203\222\371W3\360\317c\247\4\221\277|\213!\257B\200!\33\235\2\305\262\305\321Q\35\361\17\354VVz\376\243V\301\31\342tr\25kK\17\241\325E\\227G\363<\331\343\227\216\220A\275_\266%G\301\224\35\306\373\34nL~\31\30\346\332\360\3044\2\30oY\23m\14BA\257]Re\2339\210\262\253\312\11_}#J\5\341\273\35\350\351\357\231\327", ) == 0x0
 00491   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "KcTP,\207l#b\246d`\262\34\262\214j!lh\312r\3102r\14tp\245#\31,\313z|5H%\20\223xC\202O#\30\177\205\236\235\244\244\14\302\25\16\273\3639\252D\2\361\264P9\34\202\367\300+\213\2069\232\203Ha@o*\201\246\377\357\276(\212G\10:\320t9\366F\2733\230U\223\252]\334W\4\371\331\212\272n\4F4\363F\37\306m\205(p\2700\24\5\14N\30z\10.JV0v\254\346\33\366\330\27\13\200K@X\303\13\34\227<\254\272\263\264\303k\270q\224X\217\344%\270x\224\1\367\14p\301\277\344Fals\207Sw\313 \37True\1.\31\322\212D$x\253P\26D\20\27%.\364[w;1\311\212HCD\10_\342\377\27\272\0\10\215u\17\213|\10\71\300\212\16;J\374u\275\365\13\335\216\\12\362\34\16\366\303\337\237Iu\361\21\177\333Z\371\27@$\16\19\370~\335*=+h\304;\2008'\301Wj\330\373\3022\6d\376\270\367\267\333_\257\211\321\11a\13\212G\212*\201\341\377\337\1777x)w\333\212Xc\224\212^\12l|\36\377\302\255\251\13\26\30\217\36\159X\32\200\347\3379\313\1\372\366\6\374\267\0O\21\30\33u\354\261\366\366v\33 \227\353\310?\200\345\337:\32\353\342\35|[\340\366\212l\32\221l\30B\305\222\347Ku\360\321\177\341\4\217\243:\213?\263\4\200?\7\333\2\333\256\203\321O\1\267\17\362J\20z\340\277\20\301\7\3762r\13w\15\17\277\311\3\\211[\265<\307\377\321\216\216]\373_\2509\1\301\212\1\200\373\2r\12~\7\4\240\332\356\330r\2\6s\37\23s\20\4A\261A\24e\205%\316\262\265\326O_c?\14\5\377\247[\350\367\363\337\327", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00492   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\226\226\313\225 \264\276\367\322\371\316\263o6\2060\7@\325&\236\333D\212\221j\315\316\232&!\10\226\30\37,\277\276\4?\231\276\351\352:\3552cL8D4\300\206\267U\26Ns\210\222Y\12t\13%R\214\224\20\221m\17\355\304\6O\26\273\200/\260[\13i\10\325\212K\347v\266\350\232QQ[js\201;z\207i\372-\201x\@0\2142\36U\204\234\6\341\232\232\27\276\26\236gs\266n\205\354\267!\23\226\236\2122\20\235^.Y^/a{\223\31R!\215\372\205\3028RD\377x\275\2324x\273,K\303\316f\364\13\26~\364\316\326D\5u\24V\3263\305\202\337\326)\0%Lz2\26m~/2kz\207\222\0t8"$zbL\250b8\271d\366\235\14\373}wE\22\322\36\302\345\302\341\37\11\2\233\26fg\340\34v@,\333\177\3477\244\333\20\272\350\336V\360O\221.A\277\6\220\310\372&\275\4(@\324X\356\367Z\30\276\232zk\24\274V\35-\325Gp\246\6\22\17\211\360^!\364\274\376\1\325\250\205^!\2443\2303\35m\271K\342f\3359S\262\26\347\352\3\376iJk`zS\236\3534\15\272\243\335\337\344\26\300aM`\212\274\317\326)\5\14O\217X\244\20\256\375\33\25\26\00)X>\7\364]\226T\20u\214F\16\352F)\21\346\35\10`t\354\352U0\276\324\0\236\30B(\200\214\341\1\11\34\262\202{XM'\35\11\342\11\271\364\336l\271Fg\363t\351@\360+\265\256\234\362\317G\32\36\353\6\370\202O1~+p\20a\366cV\37\2\371\\270\314\344\23\351N\23Xp\352\323h\311\13\330\2f\351\333D \257Q\361\11Kaqb\340\367h\16]\250\343\210\22\334\201wh1\233s\23\312N\260", ) $zbL\250b8\271d\366\235\14\373}wE\22\322\36\302\345\302\341\37\11\2\233\26fg\340\34v@,\333\177\3477\244\333\20\272\350\336V\360O\221.A\277\6\220\310\372&\275\4(@\324X\356\367Z\30\276\232zk\24\274V\35-\325Gp\246\6\22\17\211\360^!\364\274\376\1\325\250\205^!\2443\2303\35m\271K\342f\3359S\262\26\347\352\3\376iJk`zS\236\3534\15\272\243\335\337\344\26\300aM`\212\274\317\326)\5\14O\217X\244\20\256\375\33\25\26\00)X>\7\364]\226T\20u\214F\16\352F)\21\346\35\10`t\354\352U0\276\324\0\236\30B(\200\214\341\1\11\34\262\202{XM'\35\11\342\11\271\364\336l\271Fg\363t\351@\360+\265\256\234\362\317G\32\36\353\6\370\202O1~+p\20a\366cV\37\2\371\\270\314\344\23\351N\23Xp\352\323h\311\13\330\2f\351\333D \257Q\361\11Kaqb\340\367h\16]\250\343\210\22\334\201wh1\233s\23\312N\260", ) == 0x0
 00493   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\210\212\215\225>\250\370\367\314\345\210\263q*\3000\31\\223&\200\307\2\212\217v\213\316\204:g\10\210\4Y,\241\242B?\207\242\257\352$\361tcR$\24\336\232\361U\10R5\210\214ELt\259\24\214\212\14\327m\21\361\202\6Q\12\375\2001\254\35\13w\24\223\212U\3730\266\366\206\27QEv5\201%f\301i\3441\307xB\v\214,\2\23\204\202\32\247\232\204\13\370\26\200{5\266p\231\252\26)=U\226\200\226t\20\203BhY@3'{\215\5\24!\223\346\303\302&N\2\377f\241\3344f\247jK\335\322 \364\25\128\364\320\312\2\5k\10\20\326-\331\304\337\4*o\0;P<2\10q8/,w<\207\214\3428<8A\364C\212\22\20k\220\0\16\364Zo\21\370\1N`j\360\254U.\242\222\0\200\4\4(\236\220\247\1\27\0\364\202eD\13'\3\25\244\11\247\350\230l\247Z!\363j\365\6\3605\251\350\234\354\323\1\32\0\367@\370\234Sw~5lVa\350\177\20\37\34\345\32\270\322\370U\351P\17\36p\364\317.\311\25\304Df\367\307\2 \261M\267\11U}7b\376\353.\16C\264\245\210\14\300\307wv-\335s\15\326\10\260", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) A\364C\212\22\20k\220\0\16\364Zo\21\370\1N`j\360\254U.\242\222\0\200\4\4(\236\220\247\1\27\0\364\202eD\13'\3\25\244\11\247\350\230l\247Z!\363j\365\6\3605\251\350\234\354\323\1\32\0\367@\370\234Sw~5lVa\350\177\20\37\34\345\32\270\322\370U\351P\17\36p\364\317.\311\25\304Df\367\307\2 \261M\267\11U}7b\376\353.\16C\264\245\210\14\300\307wv-\335s\15\326\10\260", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00494   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\226+\24\20\233\14I=\263\337qK\346e\334{K\305\220,\34\302\300n\7\244\262\374\25\226\36B\307C\34\370o\310\2{\250n& \37\22\12_\214\323\350[\374TN\36\264\266FUA\227\354\247\314\214\217_j\337\304@\255\3\21C;g\367\350\257p\3348\365?(\5\256AP{\336qKPl\1U^\254A\252\353#\255\374\370\231\3076\356\16hOF\26\272a\25\302\337\252\303\265e\264lz\251\241\252\2108\274\300^\245J|\37%\302\231\27\2420\264\14\177\12F\22U\222qIb\27\300\27O}\237kU'\17\377\323\342;[\2343>JjrJ\364\326\265J\337\206\250?\352\254\4$nS2\264}\263p\23t\347j~I*\360\221\267\217HN,\260\236lS\226d\256\21\332\214-r\324o\232\307\363\33\236\350\254\31s.\236a\25\320sz0<^UQm\363\352G\206W,\11\3017h\226vU\305\266UB\25\242|\17\0\13L\242%\16\363\2438nY\242d\325\36\230\278\222H#S\332\266\205~\225Rj=w\6\302Z({@\35\254W\333\223\272Dr\13f\264\14\372\367f]\211\220G\343\\227,h\330\271\17\14G\373\264\22\376\177D\322\216\3704Pp\374J\362\33\31\235\1\4\374\364\17\231\201\236\12\322'22\340\234\37\12\207\374qS\306gww\270\15\372*\205p\317\261\352cJ\226M`\20\242\335\22^\13Vn\21\32\374\355\214\240"G4\201\10\32\35\262\357\325P\3147\377\7\11\367\\345p'\230\346`\330o^\2_\217~\3606\246&\330\37W\5s\35#~\263\23\365\315\350\237\354\241n\256\257N\301!b\31\317\16\215\214\234", ) G4\201\10\32\35\262\357\325P\3147\377\7\11\367\\345p'\230\346`\330o^\2_\217~\3606\246&\330\37W\5s\35#~\263\23\365\315\350\237\354\241n\256\257N\301!b\31\317\16\215\214\234", ) == 0x0
 00495   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\2107zw%\211X&w\326\215p\30\27v6\307\12\211\34\311\217\331H\367\22\13 \10V\233\22U{\263\301m\15\346{\300=K\333\214j\34\334\334(\7\272\256\272\25\210\2\4\307]\0\276o\326\36=\250p:f\37\14\26\31\214\315\364\35\374JRE6\252\252\0U_\213\252\247\322\220\311_t\303\202@\263\37WC%{\261\350\261l\2328\353#n\5\260]\26{\300m\15Pr\35\23^\262]\354\353=\261\272\370\207\333p\356\20t\11F\10\246'\25\334\303\354\303\253y\362ld\265\347\252\226$\372\300@\271\14|\19\204\231\11\276v\264\22cLF\14I\324qW~Q\300\11S;\237uIa\17\341\317\244;E\200u>Tv4J\0(\220\265T\303\300\250!\366\352\4:r\252\252a\365p\15h\241j`Ul\360\217\253\311HP0\366\236rO\320d\260\15\234\2143n\222o\204\333\265\33\200\364\352\31m2\330a\13\3145z. \30UOq\265\352Y\232\21,\27\335qh\210j\23\305\250I\4\25\274`I\0\25P\344%\20\357\3458pE\344d\313\2\336\27&\216\16#M\306\360\205`\211\24j#k@\302D4=@\3\260\21\333\215\246\2r\25z\362\14\344\353 ]\227\214\1\343B\213jh\306\245I\14Y\347\362\22\340c\2\322\220\344rPn\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\314;t2\376\200Y\12\231\3407S\330{1w\246\21\274*\233l\211\261\364\177\14\226S|V\242\303\16\30\13HrW\32\342\361\312\240<[r\201\26\6[\262\361\311\26\314)\343A\11\351@\243p9\204\240`\306s\30\2A\2238\360(\272`\330\1KCs\3?8\263\15\351\213\350\201\360\347n\260\263\10\301?~_\317\20\221\312\234", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00496   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\202~\315\373\216\13H\322\345\307\374\332x\343P-\32'\255Ju\206\216\331G\363mUjDq\22\35T\217\225\238c\21j\313zM\261\210\306N\204\223#\377\232@>\21\372;\310\252\310a\330\267\233\152%([\257>,~"\300\230\0\266\25\35zN\204\2637\253u\247IG\245@\330b\1*Q1\253\233\205\225\31\35%\23qu2\13\323\214\257\245\324\24\12Vx\204v\223WtB\265\216\337]\3\10\375\267LI\14\330\212\270\254\261\5\254<\\3TA\263\356\234\242\307x\12$8\23K:\375v\\260\347'ix\22\317L\32\3604\330xVS\225\1\277J&\367_\310[7\\304\4*p\330\25\22\224\24\21\26y\220\264\3\236;M8\356\256\34KK\345\330\213\206\372N\315\5\30\220@>#\343y\244v\316\225d\306]/\257\1\305\24\4\205\235\336leHsy\200>\343U\211\32\332\6,\37v\224\265\36\37c@\215.\2276\40 \210\32\315N\370P(=~a\234\22=\16\354\241\237\350\224K\353Y2\371\22\6\223q\274\341\253\246*\3148\4q\367@\205\314aD\300O)\320F5\30U\353K\333\232e5\1X\14jQk\27\167}\2\31\236\204\263`\14Z\344\201\331\334\273\3267\214\15(\23\33\20j\1\33\0/\12\362\205\307\244+a\326<\306\342\340\225\246\366\242\260\5\36\204\34}ij\5\317s\177\7\266\14N\1B\311,\234\12\302%,\306\350\2"\357\312\364\20\7SB\306\237!\372\335\6\300w\36\37\245\205\35\224\234U\30:\307\32\311|\0j_\263\342\357\2004\237\200\374\350\307\-\264\32SP\15\260\202\263", ) \300\230\0\266\25\35zN\204\2637\253u\247IG\245@\330b\1*Q1\253\233\205\225\31\35%\23qu2\13\323\214\257\245\324\24\12Vx\204v\223WtB\265\216\337]\3\10\375\267LI\14\330\212\270\254\261\5\254<\\3TA\263\356\234\242\307x\12$8\23K:\375v\\260\347'ix\22\317L\32\3604\330xVS\225\1\277J&\367_\310[7\\304\4*p\330\25\22\224\24\21\26y\220\264\3\236;M8\356\256\34KK\345\330\213\206\372N\315\5\30\220@>#\343y\244v\316\225d\306]/\257\1\305\24\4\205\235\336leHsy\200>\343U\211\32\332\6,\37v\224\265\36\37c@\215.\2276\40 \210\32\315N\370P(=~a\234\22=\16\354\241\237\350\224K\353Y2\371\22\6\223q\274\341\253\246*\3148\4q\367@\205\314aD\300O)\320F5\30U\353K\333\232e5\1X\14jQk\27\167}\2\31\236\204\263`\14Z\344\201\331\334\273\3267\214\15(\23\33\20j\1\33\0/\12\362\205\307\244+a\326<\306\342\340\225\246\366\242\260\5\36\204\34}ij\5\317s\177\7\266\14N\1B\311,\234\12\302%,\306\350\2347}\26\257I\210\32+,$q\27\258\11\225\268\20\274)\2408\14\303\311c\31T (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\202~\315\373\216\13H\322\345\307\374\332x\343P-\32'\255Ju\206\216\331G\363mUjDq\22\35T\217\225\238c\21j\313zM\261\210\306N\204\223#\377\232@>\21\372;\310\252\310a\330\267\233\152%([\257>,~"\300\230\0\266\25\35zN\204\2637\253u\247IG\245@\330b\1*Q1\253\233\205\225\31\35%\23qu2\13\323\214\257\245\324\24\12Vx\204v\223WtB\265\216\337]\3\10\375\267LI\14\330\212\270\254\261\5\254<\\3TA\263\356\234\242\307x\12$8\23K:\375v\\260\347'ix\22\317L\32\3604\330xVS\225\1\277J&\367_\310[7\\304\4*p\330\25\22\224\24\21\26y\220\264\3\236;M8\356\256\34KK\345\330\213\206\372N\315\5\30\220@>#\343y\244v\316\225d\306]/\257\1\305\24\4\205\235\336leHsy\200>\343U\211\32\332\6,\37v\224\265\36\37c@\215.\2276\40 \210\32\315N\370P(=~a\234\22=\16\354\241\237\350\224K\353Y2\371\22\6\223q\274\341\253\246*\3148\4q\367@\205\314aD\300O)\320F5\30U\353K\333\232e5\1X\14jQk\27\167}\2\31\236\204\263`\14Z\344\201\331\334\273\3267\214\15(\23\33\20j\1\33\0/\12\362\205\307\244+a\326<\306\342\340\225\246\366\242\260\5\36\204\34}ij\5\317s\177\7\266\14N\1B\311,\234\12\302%,\306\350\2"\357\312\364\20\7SB\306\237!\372\335\6\300w\36\37\245\205\35\224\234U\30:\307\32\311|\0j_\263\342\357\2004\237\200\374\350\307\-\264\32SP\15\260\202\263", ) , ) == 0x0
 00497   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\234b\213\373\220\27\16\322\373\333\272\332f\377\26-\4;\353Jk\232\310\331Y\357+UtX7\22\3H\311\225\15$%\21t\3272bd\300\206\34\360\25\3f\10\204\255+\355u\271U\1\245^\304$\14Mw\253\205\231\323\31\39Uqk.M\323\222\263\343\324\34(LVf\2300\223Ih\4\265\220\303\33\3\26\341\361LW\20\236\212\246\260\367\5\262 \32\3J]\365\356\202\276\201x\248~\23U&\273vB\254\241'wdT\317R\6\2664\306d\20S\213\35\371J8\353\31\310E+\32\304\3266\330\13\16\322\24\17\12?\220\252\37\330;S$\250\256\2W\15\345\306\227\300\372P\321C\30\216\x#\375e\342v\320\211"\306C3\351\1\333\10B\205\203\302*eVo?\200 \377\23\211\4\306@,\1j\322\265\0\3%@\2232\3216\32,f\210\4\321\10\370N4{~\177\200T=\20\360\347\237\366\210\15\35-Et\371\14\32\325q\242\375\355\2464\320~\4o\353\6\205\322}\2\300Q5\226F+\4\23\353U\307\334e+\35\36\14tM-\27\20+;\2\7\202\302\263~\20\34\344\237\305\232\273\310+\312\156\17]\20t\35]\01\26\264\205\331\270ma\310 \200\342\376\211\340\366\274\254C\36\232\0;it\31\211sa\33\360\14P\35\4\3112\200L\302;0\200\350\34 \2700#\241}\10\263\17\210\47j$o\13S8\27\211P8\16\240o\240&\20\205\311}\5\22"\361\326\262\20\31O\4\306\201=\274\335\30\3341\36\1\271\303\35\212\200\23\30$\333\\311b\34,_\255\376\251\200*\203\306\374\366\333\32-\252\6\25P\23\254\304\263", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \306C3\351\1\333\10B\205\203\302*eVo?\200 \377\23\211\4\306@,\1j\322\265\0\3%@\2232\3216\32,f\210\4\321\10\370N4{~\177\200T=\20\360\347\237\366\210\15\35-Et\371\14\32\325q\242\375\355\2464\320~\4o\353\6\205\322}\2\300Q5\226F+\4\23\353U\307\334e+\35\36\14tM-\27\20+;\2\7\202\302\263~\20\34\344\237\305\232\273\310+\312\156\17]\20t\35]\01\26\264\205\331\270ma\310 \200\342\376\211\340\366\274\254C\36\232\0;it\31\211sa\33\360\14P\35\4\3112\200L\302;0\200\350\34 \2700#\241}\10\263\17\210\47j$o\13S8\27\211P8\16\240o\240&\20\205\311}\5\22 (80, 0, 0, 0, "\234b\213\373\220\27\16\322\373\333\272\332f\377\26-\4;\353Jk\232\310\331Y\357+UtX7\22\3H\311\225\15$%\21t\3272bd\300\206\34\360\25\3f\10\204\255+\355u\271U\1\245^\304$\14Mw\253\205\231\323\31\39Uqk.M\323\222\263\343\324\34(LVf\2300\223Ih\4\265\220\303\33\3\26\341\361LW\20\236\212\246\260\367\5\262 \32\3J]\365\356\202\276\201x\248~\23U&\273vB\254\241'wdT\317R\6\2664\306d\20S\213\35\371J8\353\31\310E+\32\304\3266\330\13\16\322\24\17\12?\220\252\37\330;S$\250\256\2W\15\345\306\227\300\372P\321C\30\216\x#\375e\342v\320\211"\306C3\351\1\333\10B\205\203\302*eVo?\200 \377\23\211\4\306@,\1j\322\265\0\3%@\2232\3216\32,f\210\4\321\10\370N4{~\177\200T=\20\360\347\237\366\210\15\35-Et\371\14\32\325q\242\375\355\2464\320~\4o\353\6\205\322}\2\300Q5\226F+\4\23\353U\307\334e+\35\36\14tM-\27\20+;\2\7\202\302\263~\20\34\344\237\305\232\273\310+\312\156\17]\20t\35]\01\26\264\205\331\270ma\310 \200\342\376\211\340\366\274\254C\36\232\0;it\31\211sa\33\360\14P\35\4\3112\200L\302;0\200\350\34 \2700#\241}\10\263\17\210\47j$o\13S8\27\211P8\16\240o\240&\20\205\311}\5\22"\361\326\262\20\31O\4\306\201=\274\335\30\3341\36\1\271\303\35\212\200\23\30$\333\\311b\34,_\255\376\251\200*\203\306\374\366\333\32-\252\6\25P\23\254\304\263", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00498   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\276\242\227mfU\6Jk\302\31r\345Q\346\342\252L6\14\345\214\245A\221\374\336~\264T\354\2362\274b\243i\36k@FZ\2H\245\5\323{Y\5\275\230\30\322\21!V\314\347\212\375ud:\367\210\223\255\346S\263\3502#\253\330U\267\222\316\351\2426K\372\10UF#\254\221;\370\273\+\2307j2\303\247\230\27\260\226\34\241\36=\322\26\343x\244\335+\336\7Dm\2EF\243\37\254\236\35a*H\200;2tpA*q[Z\333~L\22Y\205\302\264\251]V,M\262\37y\351(\307\10\321c\335\12\266\36\364\27\212\270(@\226|\352*\2179\225\240}\237\216\226_DS\341vS\344\262~\223\331\16\2\22\4\223\13#\236OR\22]\35,\220y \374\2231\321\225~\15\351\326A]\24&\14j\7k\377\261\236)\272<\16\307C\32\226\26G0\337[\4\367\3677\17\246\344z\344\216U\276\370]\30Fr;\233\276\370\336\377\13\310\346\3444\271\33\231\242eu3\222w\22\226b\263\375\343\272\304_\3356<\212\307\315|^\330fEB\370`$'\267f\321\354\4H\35b+\335\212M[\3668\22\367\177\3445\214L\263\34-\12\6\273\370M\2/0Z\25\241\270\304\260\334\2602v\216QC\203\226q\326\302\262\5\313U\234\10\16\3239\265\246\213\366,-\2/\35\324'\214/D1M\337J dsFO\257\336\344\242|\214fNH\354\177\330z4>\0\222|\300Q\216\334a\30},4-\30n\164\35`CB\337\363D2l\275\246H\2266r\310\240\230\304\1\372\203E\314\376L\304\344W\36ty\33\2373\5.'\307\304\261\266^\1062\364\21\26\31dWl=a\231", ) , ) == 0x0
 00499   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\240\276\321mxI@Ju\336_r\373M\240\342\264Pp\14\373\220\343A\217\340\230~\252H\252\236,\240$\243w\2-@XFDH\273\31\225{G\31\373\230\6\316W!H\320\241\212\343i":\351\224\325\255\370O\365\350,?\355\330"T|\212\1\4U\266\326Y\35\26\21mu\321\223\335xU\251\216\210\351\274*\15\372\26I\0#\262\215}\370\245@m\230)vt\303\271\204Q\260\210\0\347\36#\6t\26\375d\342\3355\302ADs\36\3F\275\3\352\236\3}lH\236'ttn]lqEF\235~R\16\37\205\334\250\357]H0\13\262\1e\257(\331\24\227c\303\26\360\36\352\13\314\2706\\320|\3646\3119\213\274;\237\220\212\31DM\3750S\372\2568\223\307\22D\22\32\217M#\200S\24\22C\1j\220g<\272\223/\315\323~\23\365\220AC\10`\14t\33-\377\257\202o\272"\22\201C\4\212PG.\303\35\4\351\353q\17\270\370<\344\220I\370\370C\4\0r%\207\370\370\300\343M\310\370\370r\271\5\205\344ek/\324w\14\212$\263\343\377\374\304A\301p<\224\333\213|@\304 E\\344&$9\253 \321\362\30\16\35|7\233\212SG\2608\14\3539\344+\220\12\263\21L\6\245\344\13\21,\34\25\277\244\202\260\302\254tv\220M\5\203\210m\220\302\254\31\215U\202\24H\323'\251\340\213\3500k\21\1\222'\2223\21S\303\14 zo\0O\261\302\242\242b\220 NV\3609\330d(x\0\214`\206Q\220\300'\30c0r-\6rH4\3|\5B\301\357\22r\241\340H\210*4\310\276\204\202\1\344\237\3\314\340P\202\344I\22y\5\203u\50;\201\304\257\252\30\10(.\262\21\10\5"Wr!'\231", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) :\351\224\325\255\370O\365\350,?\355\330 (80, 0, 0, 0, "\240\276\321mxI@Ju\336_r\373M\240\342\264Pp\14\373\220\343A\217\340\230~\252H\252\236,\240$\243w\2-@XFDH\273\31\225{G\31\373\230\6\316W!H\320\241\212\343i":\351\224\325\255\370O\365\350,?\355\330"T|\212\1\4U\266\326Y\35\26\21mu\321\223\335xU\251\216\210\351\274*\15\372\26I\0#\262\215}\370\245@m\230)vt\303\271\204Q\260\210\0\347\36#\6t\26\375d\342\3355\302ADs\36\3F\275\3\352\236\3}lH\236'ttn]lqEF\235~R\16\37\205\334\250\357]H0\13\262\1e\257(\331\24\227c\303\26\360\36\352\13\314\2706\\320|\3646\3119\213\274;\237\220\212\31DM\3750S\372\2568\223\307\22D\22\32\217M#\200S\24\22C\1j\220g<\272\223/\315\323~\23\365\220AC\10`\14t\33-\377\257\202o\272"\22\201C\4\212PG.\303\35\4\351\353q\17\270\370<\344\220I\370\370C\4\0r%\207\370\370\300\343M\310\370\370r\271\5\205\344ek/\324w\14\212$\263\343\377\374\304A\301p<\224\333\213|@\304 E\\344&$9\253 \321\362\30\16\35|7\233\212SG\2608\14\3539\344+\220\12\263\21L\6\245\344\13\21,\34\25\277\244\202\260\302\254tv\220M\5\203\210m\220\302\254\31\215U\202\24H\323'\251\340\213\3500k\21\1\222'\2223\21S\303\14 zo\0O\261\302\242\242b\220 NV\3609\330d(x\0\214`\206Q\220\300'\30c0r-\6rH4\3|\5B\301\357\22r\241\340H\210*4\310\276\204\202\1\344\237\3\314\340P\202\344I\22y\5\203u\50;\201\304\257\252\30\10(.\262\21\10\5"Wr!'\231", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \22\201C\4\212PG.\303\35\4\351\353q\17\270\370<\344\220I\370\370C\4\0r%\207\370\370\300\343M\310\370\370r\271\5\205\344ek/\324w\14\212$\263\343\377\374\304A\301p<\224\333\213|@\304 E\\344&$9\253 \321\362\30\16\35|7\233\212SG\2608\14\3539\344+\220\12\263\21L\6\245\344\13\21,\34\25\277\244\202\260\302\254tv\220M\5\203\210m\220\302\254\31\215U\202\24H\323'\251\340\213\3500k\21\1\222'\2223\21S\303\14 zo\0O\261\302\242\242b\220 NV\3609\330d(x\0\214`\206Q\220\300'\30c0r-\6rH4\3|\5B\301\357\22r\241\340H\210*4\310\276\204\202\1\344\237\3\314\340P\202\344I\22y\5\203u\50;\201\304\257\252\30\10(.\262\21\10\5 (80, 0, 0, 0, "\240\276\321mxI@Ju\336_r\373M\240\342\264Pp\14\373\220\343A\217\340\230~\252H\252\236,\240$\243w\2-@XFDH\273\31\225{G\31\373\230\6\316W!H\320\241\212\343i":\351\224\325\255\370O\365\350,?\355\330"T|\212\1\4U\266\326Y\35\26\21mu\321\223\335xU\251\216\210\351\274*\15\372\26I\0#\262\215}\370\245@m\230)vt\303\271\204Q\260\210\0\347\36#\6t\26\375d\342\3355\302ADs\36\3F\275\3\352\236\3}lH\236'ttn]lqEF\235~R\16\37\205\334\250\357]H0\13\262\1e\257(\331\24\227c\303\26\360\36\352\13\314\2706\\320|\3646\3119\213\274;\237\220\212\31DM\3750S\372\2568\223\307\22D\22\32\217M#\200S\24\22C\1j\220g<\272\223/\315\323~\23\365\220AC\10`\14t\33-\377\257\202o\272"\22\201C\4\212PG.\303\35\4\351\353q\17\270\370<\344\220I\370\370C\4\0r%\207\370\370\300\343M\310\370\370r\271\5\205\344ek/\324w\14\212$\263\343\377\374\304A\301p<\224\333\213|@\304 E\\344&$9\253 \321\362\30\16\35|7\233\212SG\2608\14\3539\344+\220\12\263\21L\6\245\344\13\21,\34\25\277\244\202\260\302\254tv\220M\5\203\210m\220\302\254\31\215U\202\24H\323'\251\340\213\3500k\21\1\222'\2223\21S\303\14 zo\0O\261\302\242\242b\220 NV\3609\330d(x\0\214`\206Q\220\300'\30c0r-\6rH4\3|\5B\301\357\22r\241\340H\210*4\310\276\204\202\1\344\237\3\314\340P\202\344I\22y\5\203u\50;\201\304\257\252\30\10(.\262\21\10\5"Wr!'\231", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00500   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "?\300\206[\351\207F7\226\261\256\15\15/S\313\214\300n\233C`I\15\242\220\306DI\227\220a\226O\266\0\276\220\25\159\15C\200f\305\255C\24\226\361\20?\327\17\272\346J7\240\264p\23\:\352\14b_\226\205\256KY\215M\35\377\1]\214\346\342\32>:\35\336\22&\31\234Bj\332\13\376\253\0f\24l\5\277\25\267:\0\22\221|\252\277I\224\10Z\226\2713y{\202\351[\22\215\10\225[ (<\27\5\215\6Nu\274\233\324\247\341\225\317\234\16\326\301\302\276\373D\212~\34\346"Y\250!\3073EB\364\374\257\352\241\336\35C\221\336H\270!t\17<|&'>\4\\355+C2\343E\24%JN|\325Ij\211t\33\367\232\275\206\363\252\33\6s\201\236\206\376\364a=L\362\33\347\276-\31\351\26-\6\37\321\350S\157\211\306E\226\4\223Q\276=Z\354\302\346\227\270N\313\264\366}\1=\224\362\10\10\335\205\224d\300\17(\276\337\304\17\26\230\216\15\367)\\266\12\360\236F\217a\257\24e\14\376\09\30\223\17\341\263\306\217\36\320\13Hk\21\23\210c#\2Y&\367{\276L\330N\0o\275z\3538\264LZ\3330\327\365\27\374\233\207\233\30\326*\24vDVe\267\356\20+M\270\200\236\304+uY\333\34d\2540\35\300\200\31J\14\16\327\364,\325\14R\24\6\4f,\325\256j :8n(8\234\236\26220\221\361}'S\305\225\210F\253M\23\344YJ\14\371\210\210\{K\225\36\263\250\366\315E\245h\34K\201dvvj4\226Q\303\375\237\207\10V\11\12"\35\34\331\34\237\325\312[\35!S\344\264v\371\272a\42F3\11\345(\204W\22Pj_x\304h\257\336\222QS\275NT2\373i\276a\24S\276\5<", ) Y\250!\3073EB\364\374\257\352\241\336\35C\221\336H\270!t\17<|&'>\4\\355+C2\343E\24%JN|\325Ij\211t\33\367\232\275\206\363\252\33\6s\201\236\206\376\364a=L\362\33\347\276-\31\351\26-\6\37\321\350S\157\211\306E\226\4\223Q\276=Z\354\302\346\227\270N\313\264\366}\1=\224\362\10\10\335\205\224d\300\17(\276\337\304\17\26\230\216\15\367)\\266\12\360\236F\217a\257\24e\14\376\09\30\223\17\341\263\306\217\36\320\13Hk\21\23\210c#\2Y&\367{\276L\330N\0o\275z\3538\264LZ\3330\327\365\27\374\233\207\233\30\326*\24vDVe\267\356\20+M\270\200\236\304+uY\333\34d\2540\35\300\200\31J\14\16\327\364,\325\14R\24\6\4f,\325\256j :8n(8\234\236\26220\221\361}'S\305\225\210F\253M\23\344YJ\14\371\210\210\{K\225\36\263\250\366\315E\245h\34K\201dvvj4\226Q\303\375\237\207\10V\11\12 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "?\300\206[\351\207F7\226\261\256\15\15/S\313\214\300n\233C`I\15\242\220\306DI\227\220a\226O\266\0\276\220\25\159\15C\200f\305\255C\24\226\361\20?\327\17\272\346J7\240\264p\23\:\352\14b_\226\205\256KY\215M\35\377\1]\214\346\342\32>:\35\336\22&\31\234Bj\332\13\376\253\0f\24l\5\277\25\267:\0\22\221|\252\277I\224\10Z\226\2713y{\202\351[\22\215\10\225[ (<\27\5\215\6Nu\274\233\324\247\341\225\317\234\16\326\301\302\276\373D\212~\34\346"Y\250!\3073EB\364\374\257\352\241\336\35C\221\336H\270!t\17<|&'>\4\\355+C2\343E\24%JN|\325Ij\211t\33\367\232\275\206\363\252\33\6s\201\236\206\376\364a=L\362\33\347\276-\31\351\26-\6\37\321\350S\157\211\306E\226\4\223Q\276=Z\354\302\346\227\270N\313\264\366}\1=\224\362\10\10\335\205\224d\300\17(\276\337\304\17\26\230\216\15\367)\\266\12\360\236F\217a\257\24e\14\376\09\30\223\17\341\263\306\217\36\320\13Hk\21\23\210c#\2Y&\367{\276L\330N\0o\275z\3538\264LZ\3330\327\365\27\374\233\207\233\30\326*\24vDVe\267\356\20+M\270\200\236\304+uY\333\34d\2540\35\300\200\31J\14\16\327\364,\325\14R\24\6\4f,\325\256j :8n(8\234\236\26220\221\361}'S\305\225\210F\253M\23\344YJ\14\371\210\210\{K\225\36\263\250\366\315E\245h\34K\201dvvj4\226Q\303\375\237\207\10V\11\12"\35\34\331\34\237\325\312[\35!S\344\264v\371\272a\42F3\11\345(\204W\22Pj_x\304h\257\336\222QS\275NT2\373i\276a\24S\276\5<", ) , ) == 0x0
 00501   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "!\334\300[\367\233\07\210\255\350\15\233\25\313\222\334(\233]|\17\15\274\214\200DW\213\326a\210S\360\0\240\214S\15'\21\5\200x\331\353C\12\212\267\20!\313I\272\370Vq\240\252lD3B&\254\14|C\320\205\260W\37\215S\1\271\1C\220\240\342\4"|\35\300\16`\31\202^,\332\25\342\355\0x\10*\5\241\11\361:\36\16\327|\264\243\17\224\26F\320\271-e=\202\367GT\215\26\211\35 6 Q\5\223\32\10u\242\207\222\247\377\211\211\234\20\312\207\302\240\347\2\212`\0\240"G\264g\307-Y\4\364\342\263\254\241\300\1\5\221\300T\376!j\23z|8;x\4B\361mC,\377\3\24;V\10|\313U,\211j\7\261\232\243\232\265\252\5\325\201\200\232\270\364\177!\12\362\5\373\370-\7\365P-\30\3\227\350M\21q\211\330Y\320\4\215M\370=D\360\204\346\211\244\10\313\252\352;\1#\210\264\10\26\301\303\224z\334I(\240\303\202\17\10\204\310\15\3515\32\266\24\354\330F\221}\351\24{\20\270\0'\4\325\17\377\257\200\217\0\314MHu\15U\210}?DY8\353=\276R\304\10\0q\241<\353&\250\12Z\305,\221\365\11\340\335\207\205\4\220*\12j\2V{\253\250\205Q\376\200\200\330muG\307Zd\262,[\300\236\5\14\14\20\313\262,\313\20\24\24\30\30 ,\313\262, $$((&\200\330\262,,\327\361c;\25\305\213\224\0\253S\17\242YT\20\277\210\226@=K\213\2\365\250\350\321\3\245v\0\15\201zj0j*\212\27\303\343\203\301\10H\25L"\3\0\237\34\201\311\214[\3=\25\344\252j\277\272\177\30tF-\25\243(\232KTPtC>\304v\263]6\214M\25\275PHt\373w\242'\24M\242C<", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) |\35\300\16`\31\202^,\332\25\342\355\0x\10*\5\241\11\361:\36\16\327|\264\243\17\224\26F\320\271-e=\202\367GT\215\26\211\35 6 Q\5\223\32\10u\242\207\222\247\377\211\211\234\20\312\207\302\240\347\2\212`\0\240 (80, 0, 0, 0, "!\334\300[\367\233\07\210\255\350\15\233\25\313\222\334(\233]|\17\15\274\214\200DW\213\326a\210S\360\0\240\214S\15'\21\5\200x\331\353C\12\212\267\20!\313I\272\370Vq\240\252lD3B&\254\14|C\320\205\260W\37\215S\1\271\1C\220\240\342\4"|\35\300\16`\31\202^,\332\25\342\355\0x\10*\5\241\11\361:\36\16\327|\264\243\17\224\26F\320\271-e=\202\367GT\215\26\211\35 6 Q\5\223\32\10u\242\207\222\247\377\211\211\234\20\312\207\302\240\347\2\212`\0\240"G\264g\307-Y\4\364\342\263\254\241\300\1\5\221\300T\376!j\23z|8;x\4B\361mC,\377\3\24;V\10|\313U,\211j\7\261\232\243\232\265\252\5\325\201\200\232\270\364\177!\12\362\5\373\370-\7\365P-\30\3\227\350M\21q\211\330Y\320\4\215M\370=D\360\204\346\211\244\10\313\252\352;\1#\210\264\10\26\301\303\224z\334I(\240\303\202\17\10\204\310\15\3515\32\266\24\354\330F\221}\351\24{\20\270\0'\4\325\17\377\257\200\217\0\314MHu\15U\210}?DY8\353=\276R\304\10\0q\241<\353&\250\12Z\305,\221\365\11\340\335\207\205\4\220*\12j\2V{\253\250\205Q\376\200\200\330muG\307Zd\262,[\300\236\5\14\14\20\313\262,\313\20\24\24\30\30 ,\313\262, $$((&\200\330\262,,\327\361c;\25\305\213\224\0\253S\17\242YT\20\277\210\226@=K\213\2\365\250\350\321\3\245v\0\15\201zj0j*\212\27\303\343\203\301\10H\25L"\3\0\237\34\201\311\214[\3=\25\344\252j\277\272\177\30tF-\25\243(\232KTPtC>\304v\263]6\214M\25\275PHt\373w\242'\24M\242C<", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \3\0\237\34\201\311\214[\3=\25\344\252j\277\272\177\30tF-\25\243(\232KTPtC>\304v\263]6\214M\25\275PHt\373w\242'\24M\242C<", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00502   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, ">\7\257PU\0\22\301\241\325H\212\301\374|PO\15f\240\202o\221\216_,\254\20\221?Gp\204H>\322-.pX\2024M|\2\377:0\36\232V\213[\354\306f\35\355\306\02a\233\214\33\263\253\271`\331[\25\217.A\344\37N\374\336\264\300~\344\216_\360Y\26\36E\4\24:A9\33/\206\276\217\240\342\303\300\255\366h=E#\306\272\20\230\222\237\215\22\301\305\322^\254<\220\336s\31\315\221\36\276f\206\242\214\36\372\22T\2\3H%\231W9\11\305\230\216\225\13^\26!\342\354\325\217\316\\301B\365!\227\333\1`Z\363\24\350\212B\242\26\16\307f\1\31\321R\0\335b(z\17;\360\27\246-\316K_\34\5~i\302\212\2\326\323\322\37\352\36\246Y22M\2\314^\22E\237\232R\27K\254\252\10\36\213$\10\4f\15\32\354\262xZ\374\374z\337\7\343\0@\256F93TQ!\237\354\342\344\15\312\16\16\376|m\3644\21\15\22\331\262l$?9Q{\7\35\313\305\214\3\23\332\377Ss\260\231\10}.Y\377\306\1(D1\24\301\234\341h\227{\223\206\331\3370=\214\303\247V\341\317\14\333\221NRMF\37\274\2325l\316\375\264T\255\7\254\37N\13\268M\23\0\3311\32\7cPC\334\254\200\355\351\302\340*?\13pD\261)R\31388\264\25\6\21\347\213j\265\374\266\320#\247\12YM;\21\16H\375\21ii\263\7u\260\306\205%\276O\252\26\324\15\225\361\36L\254\257\214\344\5\357!\276\333\261\43\335\230\272\301\236\302\20*\305\214\361c\353\23\22r-\2656W\22aG\260\262\213[|\237\32HJ@^W\336G\20\36\0\210>\361 \370\226\252\0\306\260\352,\347\300\360T(\304\33jK\310\24\343\210Th\247\330", ) , ) == 0x0
 00503   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, " \33\351PK\34T\301\277\311\16\212\337\340:PQ\21 \240\234s\327\216A0\352\20\217#\1p\232Tx\322326X\234(\13|\34\343|0\0\206\20\213E\360\200f\3\361\200\0,}\335\214\5\257\355\271~\305\35\25\2212\7\344\1R\272\336\252\3348\344\220C\266Y\10\2\3\4\12&\79\53\300\276\221\274\244\303\336\261\260h#Ye\306\244\14\336\222\201\221T\301\333\316\30\254"\16v\336m\5\213\221\0\242 \206\274\220X\372\14HD\3V9\337W'\25\203\230\220\211M^\10=\244\354\313\223\210\\337^\263!\211\307G`D\357R\350\224^\344\26\20\333 \1\7\315\24\0\303~nz\21'\266\27\2701\210KA\0C~w\336\314\2\310\317\224\37\364\2\340Y,.\13\2\322BTE\201\206\24\27U\260\354\10\0\15u$\26\30 \15\4\360\364xD\340\272z\301\33\245\0^\262\09-H\27!\201\360\244\344\23\326H\16\340`+\364*\15K\22\307\256*$!%\27{\31\1\215\305\222\37U\332\341O5\260\207\24;.G\343\200\16Xw\24\337\200\247h\211g\325\206\307\303v=\222\337\341V\377\323J\333\217R\24MX\3\372\232+p\210\375\252H\353\7\262\3\10\13\10$\13\23\36\305w\32\31\177\26C\302\260\306\355\367\336\246*!\276D\2575\24\313&$\362\25\30\15\241\213t\251\272\266\316?\341\12GQ}\21\20T\273\21wu\365\7k\254\200\205;\242\11\252\10\310K\225\357\2\12\254\261\220\242\5\361=\370\333\257\30u\335\206\246\207\236\334\14l\305\222\355%\353\15\164-\253*\21\22\177[\366\262\225G:\237\4T\14@@K\230G\16\2F\210 \355f\370\210\266F\306\256\366j\347\336\354\22(\332\7,K\326\10\245\210Jt\341\330", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \16v\336m\5\213\221\0\242 \206\274\220X\372\14HD\3V9\337W'\25\203\230\220\211M^\10=\244\354\313\223\210\\337^\263!\211\307G`D\357R\350\224^\344\26\20\333 \1\7\315\24\0\303~nz\21'\266\27\2701\210KA\0C~w\336\314\2\310\317\224\37\364\2\340Y,.\13\2\322BTE\201\206\24\27U\260\354\10\0\15u$\26\30 \15\4\360\364xD\340\272z\301\33\245\0^\262\09-H\27!\201\360\244\344\23\326H\16\340`+\364*\15K\22\307\256*$!%\27{\31\1\215\305\222\37U\332\341O5\260\207\24;.G\343\200\16Xw\24\337\200\247h\211g\325\206\307\303v=\222\337\341V\377\323J\333\217R\24MX\3\372\232+p\210\375\252H\353\7\262\3\10\13\10$\13\23\36\305w\32\31\177\26C\302\260\306\355\367\336\246*!\276D\2575\24\313&$\362\25\30\15\241\213t\251\272\266\316?\341\12GQ}\21\20T\273\21wu\365\7k\254\200\205;\242\11\252\10\310K\225\357\2\12\254\261\220\242\5\361=\370\333\257\30u\335\206\246\207\236\334\14l\305\222\355%\353\15\164-\253*\21\22\177[\366\262\225G:\237\4T\14@@K\230G\16\2F\210 \355f\370\210\266F\306\256\366j\347\336\354\22(\332\7,K\326\10\245\210Jt\341\330", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00504   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\23>B\224\231\24\22\340\302\217\276\353\30&AU\302r{m\35\375\261:\34i\k\316zui\254\216>R\231\313&\267\273\32~\244\2\13\261R\3;vAB+1\6:>\34V-\17U\302F\251\216\316E\304\376TqH\250\210]\14\260\205\321\34\332\370<\334.\371\5\226\31\3334<\317\13\2Z\166^\333\240>\236\307\0D\0\374y\234-<`\210\336E\231\10\33D5\14&\251\255\235\227\252W\211@x\20\302Yp\2\37\20\34p\203\272\367\4F0\320\3132\6\20p\1v\212\302\354\236\221\303\220\301PYJ\336Wf-\2J\276"U\300]ts\274fbG\212\213\316\33\10R\30\6y-\360"\205\2>|\352\333F\22\25\216\266q%\16S6\326{\4\2k%FA2\2573*5\230u\340\310\334,\14\220\375\7=^\310\367<\346\234l\216z3{\230^, ) U\300]ts\274fbG\212\213\316\33\10R\30\6y-\360351\14\22i\215\245\215\20^\2\12'3\12\26\246\220\261\235\221\31\24\371\12\317g\342[\366\33\333\332\221G\264x\255\27\324ls{A\17^\36\6{\324 z\15\202\204\362\266`D[SP\20\260\271\351\25\225\5P\21\230\276\367sw\333\371\326\227\7\14\20\7L|\\36\202v\310\300\14\30\15\24\346P\251M\332,\325\252-!\12\20^\30\22o\331-\250\4k\273VLN\15\236\24WK\6G\261ZNI\365\304U\244?:\236\247\304\206\251\206\204\1774\360\220\216\363b\17\374\33\344mb\14`Q (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\23>B\224\231\24\22\340\302\217\276\353\30&AU\302r{m\35\375\261:\34i\k\316zui\254\216>R\231\313&\267\273\32~\244\2\13\261R\3;vAB+1\6:>\34V-\17U\302F\251\216\316E\304\376TqH\250\210]\14\260\205\321\34\332\370<\334.\371\5\226\31\3334<\317\13\2Z\166^\333\240>\236\307\0D\0\374y\234-<`\210\336E\231\10\33D5\14&\251\255\235\227\252W\211@x\20\302Yp\2\37\20\34p\203\272\367\4F0\320\3132\6\20p\1v\212\302\354\236\221\303\220\301PYJ\336Wf-\2J\276"U\300]ts\274fbG\212\213\316\33\10R\30\6y-\360"\205\2>|\352\333F\22\25\216\266q%\16S6\326{\4\2k%FA2\2573*5\230u\340\310\334,\14\220\375\7=^\310\367<\346\234l\216z3{\230^, ) , ) == 0x0
 00505   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\15"\4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$"ZV3\23\23\302X\265\310\316[\330\270ToT\356\210C\20\366\205\317\0\234\370"\300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370"K\334\33tm\240 bY\226\315\316\5\24\24\30\30ek\360"s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27"\233\36x|\364\307\0\22\13\222\360q;\22\256\310gB\2u9\0A,\263u*+\2043\340\326\300j\14\216\341A=@\324\261<\370\200*\216d/=\230@ 2\17\217\370\16\333?E\275\300\304\3r\30;\306\31\336\200\333e(8\15\320Pd'k4d\33\214\264\223\330'\20\205\362\314\203\352\17\3763\207=\20}\21\273\24\367\20<\354\1\12\222yH\177o\262\227\263$\6\207z\307\177Z\254\235\254[v\177O\343\200\360", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$ (80, 0, 0, 0, "\15"\4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$"ZV3\23\23\302X\265\310\316[\330\270ToT\356\210C\20\366\205\317\0\234\370"\300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370"K\334\33tm\240 bY\226\315\316\5\24\24\30\30ek\360"s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27"\233\36x|\364\307\0\22\13\222\360q;\22\256\310gB\2u9\0A,\263u*+\2043\340\326\300j\14\216\341A=@\324\261<\370\200*\216d/=\230@ 2\17\217\370\16\333?E\275\300\304\3r\30;\306\31\336\200\333e(8\15\320Pd'k4d\33\214\264\223\330'\20\205\362\314\203\352\17\3763\207=\20}\21\273\24\367\20<\354\1\12\222yH\177o\262\227\263$\6\207z\307\177Z\254\235\254[v\177O\343\200\360", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370 (80, 0, 0, 0, "\15"\4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$"ZV3\23\23\302X\265\310\316[\330\270ToT\356\210C\20\366\205\317\0\234\370"\300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370"K\334\33tm\240 bY\226\315\316\5\24\24\30\30ek\360"s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27"\233\36x|\364\307\0\22\13\222\360q;\22\256\310gB\2u9\0A,\263u*+\2043\340\326\300j\14\216\341A=@\324\261<\370\200*\216d/=\230@ 2\17\217\370\16\333?E\275\300\304\3r\30;\306\31\336\200\333e(8\15\320Pd'k4d\33\214\264\223\330'\20\205\362\314\203\352\17\3763\207=\20}\21\273\24\367\20<\354\1\12\222yH\177o\262\227\263$\6\207z\307\177Z\254\235\254[v\177O\343\200\360", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27 (80, 0, 0, 0, "\15"\4\224\207\10T\340\334\223\370\353\6:\7U\334n=m\3\341\367:\2u\32k\320f3i\262\222xR\207\327`\267\245\68\244\34\27\367R\35'0A\7w\6$"ZV3\23\23\302X\265\310\316[\330\270ToT\356\210C\20\366\205\317\0\234\370"\300h\371\33\212_\333* \211\13\34FH6@\307\346>\200\333FD\36\340?\2343 &\210\300Y\337\10\5Xs\148\265\353\235\211\266\21\211^dV\302GlD\37\16\06\203\244\353BF.\314\2152\30\146\1h\226\204\354\200\215\205\220\337L\37J\300K -\34V\370"K\334\33tm\240 bY\226\315\316\5\24\24\30\30ek\360"s\257\14\14u\313\245\223\14\30\2\24;u\12\10\272\326\261\203\215_\24\347\26\211g\374G\260\33\305\306\327G\252d\353\27\312p5{_\23\30\36\30g\222 d\21\304\204\354\252&DEO\26\20\256\245\257\25\213\31\26\21\206\242X7mk\235\371\310\213A\14\16\33\12|B\2\304v\326\334J\30\23\10\240P\267Q\234,\313\266k!\24\14\30\30\14s\237-\266\30-\273HP\10\15\200\10\21K\30[\367ZPU\263\304K\270y:\200\273\202\206\267\232\302\177*\354\326\216\355~I\374\5\370+b\22|\27"\233\36x|\364\307\0\22\13\222\360q;\22\256\310gB\2u9\0A,\263u*+\2043\340\326\300j\14\216\341A=@\324\261<\370\200*\216d/=\230@ 2\17\217\370\16\333?E\275\300\304\3r\30;\306\31\336\200\333e(8\15\320Pd'k4d\33\214\264\223\330'\20\205\362\314\203\352\17\3763\207=\20}\21\273\24\367\20<\354\1\12\222yH\177o\262\227\263$\6\207z\307\177Z\254\235\254[v\177O\343\200\360", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00506   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\247wd\240\37bZV\200U:\313\224\241\311\2463\233 \342k\244\20]\4\205J\20\370\36\34f\27\27~\37\254q\341\12\306c\266\16\34\236\247\306~3\276-\311\30\223$\264o \252\227\235\361\378_\377\2556d\223\306\10\177\16>_\\335\231\256:\177\302\300&q\10\252:\7HP\314\245\31\224\204\266=\345G\3\1\331\334\342\276\207d\2\334\236x\364\302\237\347\301\257o\13\21~\27\333V\10\365\317\224\304F\14\202T(\3605G)e\334\323\2311D~\33\227DpE2\327\311\362\212\36\214;\227\322\13\342\350\316\1\227\362m\336j\317o\232l\230F\226\345\354\332U\16\215jbl\361)\3\3>\354\4\217\1\315Ej'\237m\322W\331\11\231\10\372`\354\207rgK\355\364\263\23\241%\233%\267 4{\225\272\367?\336\22T\2\32\246\343]\202\337(b\23A\14\315\17V\354\21\253\217\22-\304\370\11O\331\302\342\320\311cm\276~n`E\350\354\210\217L\317\5\26\313\201\205c\24 \201\324\22\202!\34\242\200p\242\216TE\257L\1]\353;\277EM\240\257`r\367q\35\317\202+\207\311$:\211fe;-'\245\364$&\334\216`\217\10C\27\204\262b\10\265\30\267\5\274$\364\370\361X\30\220\305\220DQ+\3419\320e\267C\201\227\20d\257\27H)\0\243oN+\351$Q;\320\274\26\310\256\336\267\31\22\355V*\224[j\1m\20\307~\31L\262\303x\215Ot\22z\271\3116rh\337\32\367V\211N\27G\6\35L\0\225\276\202I@M\257V\244\216_\332\374\16\276\306\223\365\201Rl\36\311\317\356\22\13\27V _Q\207$\14\325K\27Q*%[\351\357\310\16F\215\6\16'\373\311\202Z\374\220PU\274;\351aK\275\256o\237", ) , ) == 0x0
 00507   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\271k"\240\1~\34V\236I|\313\212\275\217\246-\207f\342u\270V]\32\231\14\20\346\2Zf\11\138\37\262m\247\12\330\177\360\16\2\202\341\306`/\370-\327\4\325$\252sf\252\211\201\267\37&C\271\255(x\325\306\26cH>A@\233\231\260&9\302\336:7\10\264&AHN\320\343\31\212\230\360=\373[E\1\307\300\244\276\231xD\334\200d\262\302\201\373\207\257q\27W~\11\307\20\10\353\323\322\304X\20\304T6\354sG7y\232\323\207-\2~\5\213\2p[.\221\311\354\226X\214%\213\224\13\374\364\210\1\211\356+\336t\323)\232r\204\0\226\373\360\234U\20\221,br\355o\3\35"\252\4\221\35\213Et;\331m\314K\237\11\207\24\274`\362\2334gU\361\262\263\15\275c\233;\253f4e\211\374\367!\302TT\34\6\340\343C\236\231(|\17\7\14\323\23\20\354\17\267\311\223\330\276\11Q\305\204\342\316\325%m\240b(`[\364\252\210\221P\211\5\10\327\307\205}\10f\201\312\16\304!\2\276\306p\274\222\22E\261PG]\365'\371ES\274\351`l\3537\35\321\236m\207\3278|\211xy}-9\271\262$8\300\310`\221\24\5\27\232\256$\10\253\4\361\5\2428\262\370\357D^\220\333\214\2Q5\375\177\320{\253\5\201\211\14"\257\11To\0\275s\10+\3678\27;\316\240P\310\260\302\361\31\14\361\20*\212G,\1s\14\201~\7P\364\303f\221\11t\14f\377\311(n.\337\4\353\20\211P\13\1\6\3PF\225\240\236\17@S\263\20\244\220C\234\374\20\242\200\223\353\235\24l\0\325\211\356\14\27QV>C\27\207:\20\223K\11Ml%E\365\251\310\20Z\313\6\20;\275\311\234F\272\220NI\372;\367}\15\275\260sU7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \240\1~\34V\236I|\313\212\275\217\246-\207f\342u\270V]\32\231\14\20\346\2Zf\11\138\37\262m\247\12\330\177\360\16\2\202\341\306`/\370-\327\4\325$\252sf\252\211\201\267\37&C\271\255(x\325\306\26cH>A@\233\231\260&9\302\336:7\10\264&AHN\320\343\31\212\230\360=\373[E\1\307\300\244\276\231xD\334\200d\262\302\201\373\207\257q\27W~\11\307\20\10\353\323\322\304X\20\304T6\354sG7y\232\323\207-\2~\5\213\2p[.\221\311\354\226X\214%\213\224\13\374\364\210\1\211\356+\336t\323)\232r\204\0\226\373\360\234U\20\221,br\355o\3\35 (80, 0, 0, 0, "\271k"\240\1~\34V\236I|\313\212\275\217\246-\207f\342u\270V]\32\231\14\20\346\2Zf\11\138\37\262m\247\12\330\177\360\16\2\202\341\306`/\370-\327\4\325$\252sf\252\211\201\267\37&C\271\255(x\325\306\26cH>A@\233\231\260&9\302\336:7\10\264&AHN\320\343\31\212\230\360=\373[E\1\307\300\244\276\231xD\334\200d\262\302\201\373\207\257q\27W~\11\307\20\10\353\323\322\304X\20\304T6\354sG7y\232\323\207-\2~\5\213\2p[.\221\311\354\226X\214%\213\224\13\374\364\210\1\211\356+\336t\323)\232r\204\0\226\373\360\234U\20\221,br\355o\3\35"\252\4\221\35\213Et;\331m\314K\237\11\207\24\274`\362\2334gU\361\262\263\15\275c\233;\253f4e\211\374\367!\302TT\34\6\340\343C\236\231(|\17\7\14\323\23\20\354\17\267\311\223\330\276\11Q\305\204\342\316\325%m\240b(`[\364\252\210\221P\211\5\10\327\307\205}\10f\201\312\16\304!\2\276\306p\274\222\22E\261PG]\365'\371ES\274\351`l\3537\35\321\236m\207\3278|\211xy}-9\271\262$8\300\310`\221\24\5\27\232\256$\10\253\4\361\5\2428\262\370\357D^\220\333\214\2Q5\375\177\320{\253\5\201\211\14"\257\11To\0\275s\10+\3678\27;\316\240P\310\260\302\361\31\14\361\20*\212G,\1s\14\201~\7P\364\303f\221\11t\14f\377\311(n.\337\4\353\20\211P\13\1\6\3PF\225\240\236\17@S\263\20\244\220C\234\374\20\242\200\223\353\235\24l\0\325\211\356\14\27QV>C\27\207:\20\223K\11Ml%E\365\251\310\20Z\313\6\20;\275\311\234F\272\220NI\372;\367}\15\275\260sU7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \257\11To\0\275s\10+\3678\27;\316\240P\310\260\302\361\31\14\361\20*\212G,\1s\14\201~\7P\364\303f\221\11t\14f\377\311(n.\337\4\353\20\211P\13\1\6\3PF\225\240\236\17@S\263\20\244\220C\234\374\20\242\200\223\353\235\24l\0\325\211\356\14\27QV>C\27\207:\20\223K\11Ml%E\365\251\310\20Z\313\6\20;\275\311\234F\272\220NI\372;\367}\15\275\260sU7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00508   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\177\277\347S>S\344\324B\343\255\315\250\261\273\245%\332R:\352\226`\200\34278\4EwQ\3743i\2322\372\245\356AX,\27\371\304\255\356N\322B\25\212h\255\270\26\323\220\35\37\303\343\35\353\226\277Y\37\274\236\205\306\5`\272\365\267*\274\6\334Q\236u\350?\271\15\230\271\231Z\257\337\242~\14\367\7(]\2\356\242\352\304MK\17\37481cv\333\254\31\250Mk\365\2\333o\17\262\307\12\11=\233~\21\256K\242tW\216\362\2222\200(\253U\370TV\316\d\306\26'S\5\345j\325~\0\237l\350\217\263\2143\24\204a\375I\360\245;\350D\271\364\344\231=\30idf\351Z@\236\17\1\232\314\14HC~\23\37\6\212X\210hi\330_\252g\305\213C6\2712\364?w\334VM\33\335\203pO\334\276\20c\365\375\376\14\241\231\370\307\375\214:\222\305\272\3333\272\362\330qM+\341\307\207\233\202\205O\264Aj\25V\375E\260\234\273\360\344\231u\370\221=\3\345\243\273C:\207\314D\13\371\232\300\366\30\306\344\21zC0.\375M\276\343J'\353,\334\354\213\372\37;\10g\356i\324\2\240\304;c\20}\4\346\165'a\362\361\377\236`}\3+nc\306Z\32FOf\21\270\7\14%1\355e\7\250\366\365\3 \307\273-Fa@\243\324$\312\252\266\6\7<\346\361\356J\267\267QH\332\301\364v\317\3\226OD\303\33\22f\300_\325d\5\336G\177\310\25\326Ra\344\36\361\373g\330\367\306\237\234\12\363\11F[x\27}z\341\207\276\360\32`Y\277\20]k!\271\235\234\263\250\374Ks\354U\373l\202\255C\15\314k\266\364\301q\266#4\35C\3315\336ip\310\241>\332*\231\262\240\357\207\316u\5\245i\360zg\260\365\23iX\332", ) , ) == 0x0
 00509   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "a\243\241S O\242\324\\377\353\315\266\255\375\245;\306\24:\364\212&\200\374+~\4[k\27\374-u\3342\344\271\250AF0Q\371\332\261\250N\314^S\212v\261\376\26\315\214[\37\335\377[\353\210\243\37\37\242\202\303\306\33|\374\365\2516\372\6\302M\330u\366#\377\15\206\245\337Z\261\303\344~\22\353A(C\36\250\242\364\330\13K\21\340~1}j\235\254\7\264\13k\353\36\235o\21\256\201\12\27!\335~\17\262\15\242jK\310\362\214.\306(\265I\276TH\322\32d\330\12aS\33\371,\325`\34\331l\366\223\365\214-\10\302a\343U\266\245%\364\2\271\352\370\337=\6u"f\367F\6\236\21\35\334\314\22T\5~\15\3@\212F\224.i\306C\354g\333\227\56\247.\262?i\300\20M\5\301\305pQ\300\370\20}\351\273\376\22\275\337\370\331\341\312:\214\331\374\333-\246\264\330oQm\341\331\233\335\202\233S\362At\11\20\375[\254\332\273\356\370\337u\346\215{\3\373\277\375C$\233\212D\25\345\334\300\350\4\200\344\17f\500\341\13\276\375Va\3532\300\252\213\344\3}\10y\362/\324\34\274\202;}\14;\4\370\22s'\177\356\267\377\200|;\35r%\306D\6\0Ox\15\376\7\229w\355{\33\356\366\353\37f\307\2451\0a^\277\222$\324\266\360\6\31 \240\361\360V\361\267OT\234\301\352j\211\3\210S\2\303\5\16 \300A\311"\5\300[9\310\13\312\24a\372\2\267\373y\7v\367\330\203\332\12\355\25\0[f\13;z\377\233\370\360\4|\37\277\16A-!\247\201\332\263\266\340\15s\362I\275l\234\261\5\15\322w\360\364\337m\360#*\1\5\331+\302/p\326\275x\3324\205\364\240\361\233\210u\33\271/\360d{\366\365\15u\36\332", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) f\367F\6\236\21\35\334\314\22T\5~\15\3@\212F\224.i\306C\354g\333\227\56\247.\262?i\300\20M\5\301\305pQ\300\370\20}\351\273\376\22\275\337\370\331\341\312:\214\331\374\333-\246\264\330oQm\341\331\233\335\202\233S\362At\11\20\375[\254\332\273\356\370\337u\346\215{\3\373\277\375C$\233\212D\25\345\334\300\350\4\200\344\17f\500\341\13\276\375Va\3532\300\252\213\344\3}\10y\362/\324\34\274\202;}\14;\4\370\22s'\177\356\267\377\200|;\35r%\306D\6\0Ox\15\376\7\229w\355{\33\356\366\353\37f\307\2451\0a^\277\222$\324\266\360\6\31 \240\361\360V\361\267OT\234\301\352j\211\3\210S\2\303\5\16 \300A\311 (80, 0, 0, 0, "a\243\241S O\242\324\\377\353\315\266\255\375\245;\306\24:\364\212&\200\374+~\4[k\27\374-u\3342\344\271\250AF0Q\371\332\261\250N\314^S\212v\261\376\26\315\214[\37\335\377[\353\210\243\37\37\242\202\303\306\33|\374\365\2516\372\6\302M\330u\366#\377\15\206\245\337Z\261\303\344~\22\353A(C\36\250\242\364\330\13K\21\340~1}j\235\254\7\264\13k\353\36\235o\21\256\201\12\27!\335~\17\262\15\242jK\310\362\214.\306(\265I\276TH\322\32d\330\12aS\33\371,\325`\34\331l\366\223\365\214-\10\302a\343U\266\245%\364\2\271\352\370\337=\6u"f\367F\6\236\21\35\334\314\22T\5~\15\3@\212F\224.i\306C\354g\333\227\56\247.\262?i\300\20M\5\301\305pQ\300\370\20}\351\273\376\22\275\337\370\331\341\312:\214\331\374\333-\246\264\330oQm\341\331\233\335\202\233S\362At\11\20\375[\254\332\273\356\370\337u\346\215{\3\373\277\375C$\233\212D\25\345\334\300\350\4\200\344\17f\500\341\13\276\375Va\3532\300\252\213\344\3}\10y\362/\324\34\274\202;}\14;\4\370\22s'\177\356\267\377\200|;\35r%\306D\6\0Ox\15\376\7\229w\355{\33\356\366\353\37f\307\2451\0a^\277\222$\324\266\360\6\31 \240\361\360V\361\267OT\234\301\352j\211\3\210S\2\303\5\16 \300A\311"\5\300[9\310\13\312\24a\372\2\267\373y\7v\367\330\203\332\12\355\25\0[f\13;z\377\233\370\360\4|\37\277\16A-!\247\201\332\263\266\340\15s\362I\275l\234\261\5\15\322w\360\364\337m\360#*\1\5\331+\302/p\326\275x\3324\205\364\240\361\233\210u\33\271/\360d{\366\365\15u\36\332", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00510   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\316\7\303\320\345\227t\1\32+\274\233lp\10\3TX\23{%#-\315iBW@\256\245\353X\245\358\57\354p\330\7\244\2d\365\212L\213lJf\242\32\271t\27s\237\316\355%\323\273)\203:RD3\344A\2444\254\242O\231\210\213\254\313G\255\14\264\2224\232\344\353Tn\367JnM\7}\373k\231\365\200~\221\222\221=!\25\255@A\317\30\30\36|}\2445\307\306*\235\240<\23nF4.\3\363z.\266\304VR\344\317;F\337\351\242\11\317\376G\206\177Q}\332jU$\236%E\371\3\315G\334\222\353\275_KjI &\352&j\32\305G\373\330S.\13KN3\37f\10r\233\2\30bd\27\254\25wh\307\207d\35\226\345\354<>\16\21\32\361\246\206-A\256\356\35\331\317\365\225\1\26]v\344\10\353O\3565\217\360kup\251\254\306\3h'_w%'%\206\274\366'n\227\31R\14h\362\316\15\35002Vl\231L\307\33\22\245A\377YV\17\301\11a~\263\266\36u\271M<[\25R\177\245\241\5H\0\236\23nD\16\24\256\341P\370N\15\260\231BE\256G\35t\305\226\270\320\225\366\307\345\36\342E\14\237\336\237\334\305\10K\201\374\22\2009Z\33\275\242\2644\327\305[\227st\12\35%\316"\3228\355H\7\15\274\345\2230\12\303'=y\246\374\360\10\247\227C\377h\2\21\20\363\254\265}5\347\21S\336\232\343\353\27U\26|\220*H\271\242\224\211\260/5m\265\355\275\307\206>\253\327\346*\201\255\3Q\22\2556T\324\260+\30]\3028pg\275I\285\3\225\30}\357m\220\273\202-8\12\266\2\234\6A\34Yo\351\256\234\2067\263\3\233m\272\241\\250\237\333\273\201\371\342\2\227@n?\273\365/}\16", ) \3228\355H\7\15\274\345\2230\12\303'=y\246\374\360\10\247\227C\377h\2\21\20\363\254\265}5\347\21S\336\232\343\353\27U\26|\220*H\271\242\224\211\260/5m\265\355\275\307\206>\253\327\346*\201\255\3Q\22\2556T\324\260+\30]\3028pg\275I\285\3\225\30}\357m\220\273\202-8\12\266\2\234\6A\34Yo\351\256\234\2067\263\3\233m\272\241\\250\237\333\273\201\371\342\2\227@n?\273\365/}\16", ) == 0x0
 00511   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\320\33\205\320\373\2132\1\47\372\233rlN\3JDU{;?k\315w^\21@\260\271\255X\273\1~\5)\3606\330\31\270Dd\353\226\12\213rV \242\4\2452\27m\203\210\355;\317\375)\235&\24D-\0rA\272(\352\242Q\205\316\213\262\327\1\255\22\250\3244\204\370\255Tp\353\14nS\33;\373u\205\263\200`\215\324\221#=S\255^]\211\30\6\2:}\272)\201\3064\201\346<\15r\040\37\265z0\252\202VL\370\211;X\303\257\242\27\323\270G\230c\27}\304v\23$\2009\3\371\35\321\1\334\214\367\373_Uv\17 8\366`j\4\331\1\373\306Oh\13URu\37x\244\233\34\4$d\11\260Swv\333\301d\3\212\243\354""H\21\4\355\340\2063]\350\356\3\305\211\365\213\35P]h\370N\353Q\362s\217\356w3p\267\260\200\3v;\31w;;c\206\242\352an\211\5\24\14v\356\210\15\366,tVr\205\12\307\5\16\343A\341E\20\17\337\25'~\255\252Xu\247Qz[\13N9\245\277\31\16\0\200\17(D\20\10\350\341N\344\10\15\256\205\4E\260[[t\333\212\376\320\213\352\201\345\0\376\3\14\201\302\331\334\333\24\15\201\342\16\3069D\7\373\242\252(\221\305E\2135t\24\1c\316<\316~\355V\33K\274\373\217v\12\335;{y\270\340\266\10\271\213\5\377v\36W\20\355\260\363}+\373WS\300\206\245\353\11IP|\2166\16\271\274\210\317\2601)+\265\363\241\201\206 \267\221\3464\235\353\3O\16\3536J\310\366+\6A\2048n{\373I\34$s\3\213\4;\357s\214\375\2023$L\266\34\200@A\2E)\351\260\200\3007\255\37\335m\244\275\32\250\201\307\375\201\347\376D\227^ry\273\3533;\16", 10240, 0x0, 0, ... {status=0x0, info=10240}, )  (80, 0, 0, 0, "\320\33\205\320\373\2132\1\47\372\233rlN\3JDU{;?k\315w^\21@\260\271\255X\273\1~\5)\3606\330\31\270Dd\353\226\12\213rV \242\4\2452\27m\203\210\355;\317\375)\235&\24D-\0rA\272(\352\242Q\205\316\213\262\327\1\255\22\250\3244\204\370\255Tp\353\14nS\33;\373u\205\263\200`\215\324\221#=S\255^]\211\30\6\2:}\272)\201\3064\201\346<\15r\040\37\265z0\252\202VL\370\211;X\303\257\242\27\323\270G\230c\27}\304v\23$\2009\3\371\35\321\1\334\214\367\373_Uv\17 8\366`j\4\331\1\373\306Oh\13URu\37x\244\233\34\4$d\11\260Swv\333\301d\3\212\243\354""H\21\4\355\340\2063]\350\356\3\305\211\365\213\35P]h\370N\353Q\362s\217\356w3p\267\260\200\3v;\31w;;c\206\242\352an\211\5\24\14v\356\210\15\366,tVr\205\12\307\5\16\343A\341E\20\17\337\25'~\255\252Xu\247Qz[\13N9\245\277\31\16\0\200\17(D\20\10\350\341N\344\10\15\256\205\4E\260[[t\333\212\376\320\213\352\201\345\0\376\3\14\201\302\331\334\333\24\15\201\342\16\3069D\7\373\242\252(\221\305E\2135t\24\1c\316<\316~\355V\33K\274\373\217v\12\335;{y\270\340\266\10\271\213\5\377v\36W\20\355\260\363}+\373WS\300\206\245\353\11IP|\2166\16\271\274\210\317\2601)+\265\363\241\201\206 \267\221\3464\235\353\3O\16\3536J\310\366+\6A\2048n{\373I\34$s\3\213\4;\357s\214\375\2023$L\266\34\200@A\2E)\351\260\200\3007\255\37\335m\244\275\32\250\201\307\375\201\347\376D\227^ry\273\3533;\16", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00512   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\21\230\263\225\274P\325\344\3\210\213\216\311\217m\4\225\210\257}\206P\26\14\245\230:\21j\24\321\330}\14\326_\327C\211d"\373\205\271\17\204\3400a\272\16D0G\37\314%L\306`\272\12\243UV\34\241b\21\267\5-\21TB\4\231xA*\330\236\14\37\16J\217\340\203\310U\247`\236o\314\253\26I\37j\11C|\265!/d\36\0\371\3744e\1\4\225\340G_LK\25T/..\360ZQ3tAKn\272p\366~r\0\237=\27\25\\313\2611\270\25\261\350\210c\270x\255\257S\1\367m%\211\20\217\210Bht\311\232\0\332tB\206\352\0,h]\23S\322Z\230\331\177\321P\27\26\246\201EyZ\247"I\6\1\0,\2\303CT\2160i\27.\314b\314\214Qs\200\12\12\346|#K\31\253\34\10\337\265\20\1\245c\237n\16\310\14\4\37/\315\312\306\360\213\240\211\203e!\210\11\206\177%\3424!j1\273\31F\35\372\32692q\36U\352\360\266"\340\367\374\21Z9\335\311-\330I\221K\314\360\16L\3147\306\15\266\340\351\336\272MCz\337\215R\252\23\374\305\13\272\6Y\36\315\7\337\366E\22\31\27\215\262s\361BJ\301\31N\10\22;V,\325\256j\24\0\4Z\25\2410\215\262>8J(2\22190Tw\251R\337i\216\350_\340(m\24\364}\202G\33I\13\226\33\270\312\303p\260\326\254|\2\27\341\11\315\205x\212\373\333u\23\221\363x\267_\357\372\343\341\0\200.\206\374\354\262\313w\341\227;\14\32\7O?5\345\301\3676\3755\0bO\3\250\35ik\213\22\6+s\251I\216\1\36\235\244\200j\367\177h\263\13\276#\317h\243\204\3674\302\366)\347\374\273Z\375\16B\365\1l\366^\340\364,E\275\263\5\343\20\270\15", ) \373\205\271\17\204\3400a\272\16D0G\37\314%L\306`\272\12\243UV\34\241b\21\267\5-\21TB\4\231xA*\330\236\14\37\16J\217\340\203\310U\247`\236o\314\253\26I\37j\11C|\265!/d\36\0\371\3744e\1\4\225\340G_LK\25T/..\360ZQ3tAKn\272p\366~r\0\237=\27\25\\313\2611\270\25\261\350\210c\270x\255\257S\1\367m%\211\20\217\210Bht\311\232\0\332tB\206\352\0,h]\23S\322Z\230\331\177\321P\27\26\246\201EyZ\247 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\21\230\263\225\274P\325\344\3\210\213\216\311\217m\4\225\210\257}\206P\26\14\245\230:\21j\24\321\330}\14\326_\327C\211d"\373\205\271\17\204\3400a\272\16D0G\37\314%L\306`\272\12\243UV\34\241b\21\267\5-\21TB\4\231xA*\330\236\14\37\16J\217\340\203\310U\247`\236o\314\253\26I\37j\11C|\265!/d\36\0\371\3744e\1\4\225\340G_LK\25T/..\360ZQ3tAKn\272p\366~r\0\237=\27\25\\313\2611\270\25\261\350\210c\270x\255\257S\1\367m%\211\20\217\210Bht\311\232\0\332tB\206\352\0,h]\23S\322Z\230\331\177\321P\27\26\246\201EyZ\247"I\6\1\0,\2\303CT\2160i\27.\314b\314\214Qs\200\12\12\346|#K\31\253\34\10\337\265\20\1\245c\237n\16\310\14\4\37/\315\312\306\360\213\240\211\203e!\210\11\206\177%\3424!j1\273\31F\35\372\32692q\36U\352\360\266"\340\367\374\21Z9\335\311-\330I\221K\314\360\16L\3147\306\15\266\340\351\336\272MCz\337\215R\252\23\374\305\13\272\6Y\36\315\7\337\366E\22\31\27\215\262s\361BJ\301\31N\10\22;V,\325\256j\24\0\4Z\25\2410\215\262>8J(2\22190Tw\251R\337i\216\350_\340(m\24\364}\202G\33I\13\226\33\270\312\303p\260\326\254|\2\27\341\11\315\205x\212\373\333u\23\221\363x\267_\357\372\343\341\0\200.\206\374\354\262\313w\341\227;\14\32\7O?5\345\301\3676\3755\0bO\3\250\35ik\213\22\6+s\251I\216\1\36\235\244\200j\367\177h\263\13\276#\317h\243\204\3674\302\366)\347\374\273Z\375\16B\365\1l\366^\340\364,E\275\263\5\343\20\270\15", ) \340\367\374\21Z9\335\311-\330I\221K\314\360\16L\3147\306\15\266\340\351\336\272MCz\337\215R\252\23\374\305\13\272\6Y\36\315\7\337\366E\22\31\27\215\262s\361BJ\301\31N\10\22;V,\325\256j\24\0\4Z\25\2410\215\262>8J(2\22190Tw\251R\337i\216\350_\340(m\24\364}\202G\33I\13\226\33\270\312\303p\260\326\254|\2\27\341\11\315\205x\212\373\333u\23\221\363x\267_\357\372\343\341\0\200.\206\374\354\262\313w\341\227;\14\32\7O?5\345\301\3676\3755\0bO\3\250\35ik\213\22\6+s\251I\216\1\36\235\244\200j\367\177h\263\13\276#\317h\243\204\3674\302\366)\347\374\273Z\375\16B\365\1l\366^\340\364,E\275\263\5\343\20\270\15", ) == 0x0
 00513   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\17\204\365\225\242L\223\344\35\224\315\216\327\223+\4\213\224\351}\230LP\14\273\204|\21t\10\227\330c\20\220_\311_\317d<\347\303\271\21\230\2460\177\246HD.[Y\314;P\200`\244\26\345UH\0\347b\17\253C-\17H\4\4\207d\7*\306\202J\37\20V\311\340\235\324\23\247~\202)\314\265\12\17\37t\25\5|\253=id\0\34\277\374*yG\4\213\374\1_RWST12h\360DMut_W(\272n\3528r\36\203{\27\13@\215\261/\244S\261\366\224%\270f\261\351S\37\353+%\227\14\311\210\t2\311\204\34\234t\\232\254\02t\33\23M\316\34\230\307c\227P\11\12\340\201[e\34\247, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00514   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\7\306+\342\30\154\3561\242J\330i\261\274;\345kW\35\365\3470\357\341\37A\20\317p\344\225\36\234\236\377\24'\13\370a\214Eu\225a\372d\2\250\36\315.\264\263xq\265!A\33\24\361-\320\320\24\260\211\254\256\332\20\214\235~b_A,\25hn\31I\11\23\300\25\20\2\215A\30]\25\223\262\10\272\12\326\23\30\22\300Yp\12.}7b\366)\257^\\300\344\272\270\366h\327\357V\254\272\347Eb\30]\362\346\340\252\155\251\237\271\355v]\372\377\33\267#\320\356\31\274Y\273\6\331.\357\234\315C@R\2\202\2750\311o\7\225\37\200\236\2\366(\256\274Dx\11\4U\203b\217s\266\350\211\177\367h\0q\224\36.\0\237\241\206\260\311\15\345-\305\227^QI\362\25\364O\203\20\307\303$y\263dk]\221I\37b\377\23b\223\214\357)U+J\210\316=\234p\2770F9\316b\260\240`\204\252\14\346\24\207\37G\220r\17R\370Or\\251\2768\341o\343ar+\236\322U\275\342\242\347\343\23\203\370-\326\227^\363\273V9\304?f\31\267V\246\323\34\275\23WP\16\243\220m\202\334\27\350(\340`\346\2L\25a\236\325o\376\13\350B\17\274\345V\26\17\274j\301\340\320\276\300\2146D\273\11_^\6\226\217\264\206%\234\31\243CL\27\351\32\300\3568\16,\20\301\225\326\374\1M\201w\236\370E\36T\332Hcp{\34\364\322\14Lh\240{\13mQZ|h\360\3034\17\4"\236N\17\335\231!0m\250M\260M\111\211t\224\26\376\305\221Z\224[\34\254\5\247\33\121>\274\340\3772.C\35\236r\33j\2Z\310=\234B\267\333]\37\32\347f\361\233\23\227\204\1E\33\207Z\240E\12\206h\35\22(\212:\370V\21h_\20", ) \236N\17\335\231!0m\250M\260M\111\211t\224\26\376\305\221Z\224[\34\254\5\247\33\121>\274\340\3772.C\35\236r\33j\2Z\310=\234B\267\333]\37\32\347f\361\233\23\227\204\1E\33\207Z\240E\12\206h\35\22(\212:\370V\21h_\20", ) == 0x0
 00515   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\31\332m\342\6\21r\356/\276\14\330w\255\372;\373w\21\35\353\373v\357\377\3\7\20\321l\242\225\0\200\330\377\12;M\370\177\220\3u\213}\274d\34\264X\3150\250\365xo\251gA\5\10\267-\316\314R\260\227\260\350\332\16\220\333~|C\7,\13t(\31W\25U\300\13\14D\215_\4\33\25\215\256N\272\24\312U\30\14\334\37p\242;7|\352o\257@@\206\344\244\244\260h\311\363\20\254\244\373\3b\6A\264\346\376\266K5\267\203\377\355hA\274\377\5\253e\320\360\5\372Y\245\32\237.\361\200\213C^ND\202\243,\217o\31\211Y\200\200\36\260(\260\240\2x\27\30\23\203|\2235\26(\364\317\177\351tFq\212\2h\0\201\275\300\260\327\21\243-\333\213\30QW\356S\364Q\237V\307\3358?\263zw\33\221W\3$\377\15~\325\214\3615\23+T\224\210=\202l\3710X%\210b\256\274&\204\264\20\240\24\231\3\1\220l\23\24\370Qn\32\251\240$\247o\375}4+\200\316\23\275\374\276\241\343\15\237\276-\310\213\30\363\245J\177\304!z_\267H\272\225\34\243\17\21P\20\277\326m\234\300Q\3506\374&\346\34PSa\200\311)\376\25\364\4\17\242\371\20\26\21\240,\301\376\314\370\300\222*\2\273\27C\30\6\210\223\362\206;\200_\243]PQ\351\4\334\2508\200V\301\213\312\272\1S\2351\236\346YXT\304T%pe\0\262\322\22P.\240e\27+QD`.\360\335(I\4<\202\10\17\303\205g0s\264\13\260S\25w\211j\210P\376\333\215\34\224E\0\352\5\271\7L1 \240\246\377,2\5\35\200n]j\34F\216=\202^\361\333C\3\\347x\355\335\23\211\230GE\5\233\34\240[\26\300h\3\16n\212$\3vV\17t\31\20", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00516   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "N\314R8={\326\1\247@>\360z\305\246\222B\210EQ\32\232\324\333\235Nb#L4\16\252p4/@r\37\232\7l\336L3MdC\363_\356\264R\372TG\3p@FF\3228F\210\273\367>j\6\220N\270\216\20\2\17\212\237\356S\217&"u\216\261f\3530J6\237~\240\6^K\331\25\14)|\311\254[7\25X\25\32\242\244'TR\1vd?\31\261\230AX\364\363\34\241\263\256\261\2E\34\265\227\34\327@`\35S\371\302\272\37\20_M_\236m\307\35\22\27\25\14V#z\360\320\14&ET\4]\15\16\314@H\366\323MH42\376H\222\343BeQa9\370\23\4B|)U\265}\204Z/J_\325T(/eI2_C\240\265^R\3207a\242I\342o@\13\311=\217\315\361\17*C\23\310\26g\327t\211g\242o\306JR#\16\246\347\244\342$E\250[\247\216\326\243|\36\23\372v\21\7l|b7[L\351\1\334\260f\37:\3F\22\356\34&|\257\303\306|\36Gb\2wb\26r2\274\244\371\35I"pJ\34\356\252\234\3\235\256\11\250:\20`{\323\14\260\33^\26\212\15aENW\20\21!\33\212~\11\354L=\371#\32\244\27HB\263\16\14ZP\33\362i?C\20Wo\11\327\10Xp\27\22RK\20\326\330\332y\221\240>\307\376\0\227yE\353\34\16\210\236\231\343\21\4\25\270\215\333C9\351W\376D[c\22?v\202~4n*3%\345\32\32\307G\20O\3173\11\222\37\332\254ehC2\355\371u\304\2040= \234\256\2254\205\214D\6\34\307\332\3\22\34F\10U\206G\351\2\37\6 \334:ge\15gV7\251p\204\336\302<&\350\2\351 \311\240\247B&\210\321u\201\201w\4", ) u\216\261f\3530J6\237~\240\6^K\331\25\14)|\311\254[7\25X\25\32\242\244'TR\1vd?\31\261\230AX\364\363\34\241\263\256\261\2E\34\265\227\34\327@`\35S\371\302\272\37\20_M_\236m\307\35\22\27\25\14V#z\360\320\14&ET\4]\15\16\314@H\366\323MH42\376H\222\343BeQa9\370\23\4B|)U\265}\204Z/J_\325T(/eI2_C\240\265^R\3207a\242I\342o@\13\311=\217\315\361\17*C\23\310\26g\327t\211g\242o\306JR#\16\246\347\244\342$E\250[\247\216\326\243|\36\23\372v\21\7l|b7[L\351\1\334\260f\37:\3F\22\356\34&|\257\303\306|\36Gb\2wb\26r2\274\244\371\35I (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "N\314R8={\326\1\247@>\360z\305\246\222B\210EQ\32\232\324\333\235Nb#L4\16\252p4/@r\37\232\7l\336L3MdC\363_\356\264R\372TG\3p@FF\3228F\210\273\367>j\6\220N\270\216\20\2\17\212\237\356S\217&"u\216\261f\3530J6\237~\240\6^K\331\25\14)|\311\254[7\25X\25\32\242\244'TR\1vd?\31\261\230AX\364\363\34\241\263\256\261\2E\34\265\227\34\327@`\35S\371\302\272\37\20_M_\236m\307\35\22\27\25\14V#z\360\320\14&ET\4]\15\16\314@H\366\323MH42\376H\222\343BeQa9\370\23\4B|)U\265}\204Z/J_\325T(/eI2_C\240\265^R\3207a\242I\342o@\13\311=\217\315\361\17*C\23\310\26g\327t\211g\242o\306JR#\16\246\347\244\342$E\250[\247\216\326\243|\36\23\372v\21\7l|b7[L\351\1\334\260f\37:\3F\22\356\34&|\257\303\306|\36Gb\2wb\26r2\274\244\371\35I"pJ\34\356\252\234\3\235\256\11\250:\20`{\323\14\260\33^\26\212\15aENW\20\21!\33\212~\11\354L=\371#\32\244\27HB\263\16\14ZP\33\362i?C\20Wo\11\327\10Xp\27\22RK\20\326\330\332y\221\240>\307\376\0\227yE\353\34\16\210\236\231\343\21\4\25\270\215\333C9\351W\376D[c\22?v\202~4n*3%\345\32\32\307G\20O\3173\11\222\37\332\254ehC2\355\371u\304\2040= \234\256\2254\205\214D\6\34\307\332\3\22\34F\10U\206G\351\2\37\6 \334:ge\15gV7\251p\204\336\302<&\350\2\351 \311\240\247B&\210\321u\201\201w\4", ) , ) == 0x0
 00517   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "P\320\248#g\220\1\271\x\360d\331\340\222\\224\3Q\4\206\222\333\203R$#R(H\252n(i@l\3\334\7r\302\123Sx\5\363A\362\362R\344H\1\3n\\0F\314$\0\210\245\353xj\30\214\10\270\220\14D\17\224\203\250S\221:du\220\255 \353.Vp\237`\274@^U\305S\147`\217\254E+SX\13\6\344\2449H\24\1hxy\31\257\204\7X\352\357Z\241\255\262\367\2[\0\363\227\2\313\6`\3O\277\302\244\3V_SC\330m\331\1T\27\13\20\20#d\354\226\148Y\22\4C\21H\314^T\260\323STr2\340T\324\343\y\27a'\344U\4\`oU\10);\204D3\14_\313Hn/{Ut_]\274\363^L\314qa\274U\244o^\27\217=\221\321\267\174_U\310\10{\221t\227{\344o\330V\24#\20\272\241\244\3748\3\250E\273\310\326\275`X\23\344jW\7r`$7EP\257\1\302\254 \37$\37\0\22\360\0`|\261\337\200|\0[$\2i~Pr,\240\342\371\3UdpT\0\250\252\202\37\333\256\27\264|\20~g\225\14\256\7\30\26\224\21'EPKV\21?\7\314~\27\360\12=\347?\\244\11T\4\263\20\20\34P\5\356/?]\14\21o\27\313NXn\13TRU\14\220\330\304e\327\240 \333\270\0\211e\3\353\2\22\316\236\207\377W\4\13\244\313\333]%\257W\340X\35c\14#0\202`((*-9\243\32\4\333\1\20Q\323u\11\214\3\234\254{t\52\363\3453\304\232,{ \202\262\3234\233\220\2\6\2\333\234\3\14\0\0\10K\232\1\351\34\3@ \302&!e\23{\207\267l\302\336\334 `\350\34\365f\311\276\273\4&\17,\227u\237\2351\4", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00518   464   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\240\37:\312r\323C\20\261\214\\33\376~r{\211\236\20\6D\345u\342PKd\25\241&\16\236\20I\202+\26EF\272\214O\213_]\227k\374\2\327\254\20\35{\350\322\236\266\312\322\377~\20\223\220\237\2Qh\344\352U\304\317\224\14)P;\22\37\10+{'[b/:V\214\15\277\366Y\2\216N\2549\15b$\322)B\16.$\213\226\243\15(\15\366,\246\301.,\317/\210p\200ln\10D\374\20L\22\14\177D\350d\321\212\335\17k~\330E=\266N\2\0\327O!\30?\6\1777\305ge\24\256J\335A\30/X\274O\242m\34\252\352a\265ZH\301\222\305T\235\21\276\251\31\244y\0\321r\24p\14\256\323S\21/\246\7\142|\2660"]\213,\325BG1\233 n\202f\2735\370Lg\362%\323\10\331\21'\356F\24\257BO\347W\327 \356u\20\322\11Cp\217`\307xV\367\16Fz[c\27Bm\4W\232ll\36\212"\34\312$\343\306\27pc\361\205\12\232|M#", ) \202+\26EF\272\214O\213_]\227k\374\2\327\254\20\35{\350\322\236\266\312\322\377~\20\223\220\237\2Qh\344\352U\304\317\224\14)P;\22\37\10+{'[b/:V\214\15\277\366Y\2\216N\2549\15b$\322)B\16.$\213\226\243\15(\15\366,\246\301.,\317/\210p\200ln\10D\374\20L\22\14\177D\350d\321\212\335\17k~\330E=\266N\2\0\327O!\30?\6\1777\305ge\24\256J\335A\30/X\274O\242m\34\252\352a\265ZH\301\222\305T\235\21\276\251\31\244y\0\321r\24p\14\256\323S\21/\246\7\142|\2660 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\240\37:\312r\323C\20\261\214\\33\376~r{\211\236\20\6D\345u\342PKd\25\241&\16\236\20I\202+\26EF\272\214O\213_]\227k\374\2\327\254\20\35{\350\322\236\266\312\322\377~\20\223\220\237\2Qh\344\352U\304\317\224\14)P;\22\37\10+{'[b/:V\214\15\277\366Y\2\216N\2549\15b$\322)B\16.$\213\226\243\15(\15\366,\246\301.,\317/\210p\200ln\10D\374\20L\22\14\177D\350d\321\212\335\17k~\330E=\266N\2\0\327O!\30?\6\1777\305ge\24\256J\335A\30/X\274O\242m\34\252\352a\265ZH\301\222\305T\235\21\276\251\31\244y\0\321r\24p\14\256\323S\21/\246\7\142|\2660"]\213,\325BG1\233 n\202f\2735\370Lg\362%\323\10\331\21'\356F\24\257BO\347W\327 \356u\20\322\11Cp\217`\307xV\367\16Fz[c\27Bm\4W\232ll\36\212"\34\312$\343\306\27pc\361\205\12\232|M#", ) \34\312$\343\306\27pc\361\205\12\232|M#", ) == 0x0
 00519   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\276\3|\312l\317\5\20\257\220\32\33\340b4{\17-\330\20\30X\243u\374L\15d\13\275`\16\200\14\17\313\21\260\30\314f%2M\263\366\222M x\16\206\14\344f\11K(H\16\22\240a\240\13\20E\212\330\254\215@|d\12\11\221\233\315\2\210\333\21S\370\336a\331\11I\13\B\343\1\217w\267\14\306\217\376\213\250X\302*\30\301\260`!\20\212\23z\4\301\373\252\211:X6\13R\216\22\14\223\271\230\365\227\2\233\11n\22\210\271`.z\2669.\227,F2g\20\333\250\202Y\205t)\370\331\204euK\264\317:\6\222\15!P\12T\10\4\13\2M\6Q\26+\2b;d\2025\12\3F\244\220\11\213AA\321k\342\36\221\254\16\1=\350\314\202\360\312\314\3438\20\215\214\331\2Ot\242\352K\330\211\224\225\26;\14\3N+e;\35b1&\20\214\23\243\260Y\34\222\10\254'\21$$\3145\4\1608\315\226\275\21n\15\3500\340\30100\211/\226l\306lp\24\2\374\16PT\14aX\256d\317\226\233\17ub\236E#\252\10\2\36\313\11!\6#@\177)\331!e\12\262\14\335_\4iX\242S\344m\2\266\254a\253F\16\301\214\331\22\235\17\242\357\31\272eF\321l\106\14\260\317\25\211\272A\14,`\3600"\2\326b\343\330\136c\357\14s\12\204`\13#", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \313\21\260\30\314f%2M\263\366\222M x\16\206\14\344f\11K(H\16\22\240a\240\13\20E\212\330\254\215@|d\12\11\221\233\315\2\210\333\21S\370\336a\331\11I\13\B\343\1\217w\267\14\306\217\376\213\250X\302*\30\301\260`!\20\212\23z\4\301\373\252\211:X6\13R\216\22\14\223\271\230\365\227\2\233\11n\22\210\271`.z\2669.\227,F2g\20\333\250\202Y\205t)\370\331\204euK\264\317:\6\222\15!P\12T\10\4\13\2M\6Q\26+\2b;d\2025\12\3F\244\220\11\213AA\321k\342\36\221\254\16\1=\350\314\202\360\312\314\3438\20\215\214\331\2Ot\242\352K\330\211\224\225\26;\14\3N+e;\35b1&\20\214\23\243\260Y\34\222\10\254'\21$$\3145\4\1608\315\226\275\21n\15\3500\340\30100\211/\226l\306lp\24\2\374\16PT\14aX\256d\317\226\233\17ub\236E#\252\10\2\36\313\11!\6#@\177)\331!e\12\262\14\335_\4iX\242S\344m\2\266\254a\253F\16\301\214\331\22\235\17\242\357\31\272eF\321l\106\14\260\317\25\211\272A\14,`\3600315,\313^\11\205<(\202x\247s\370R{\264%\315\24\237\219\362\0\24\261^\11\347I\313f\356k\14\224\11]l\311`\331d\20\367\20Z<[}\13\4m\32K\334lr\2\314 (80, 0, 0, 0, "\276\3|\312l\317\5\20\257\220\32\33\340b4{\17-\330\20\30X\243u\374L\15d\13\275`\16\200\14\17\313\21\260\30\314f%2M\263\366\222M x\16\206\14\344f\11K(H\16\22\240a\240\13\20E\212\330\254\215@|d\12\11\221\233\315\2\210\333\21S\370\336a\331\11I\13\B\343\1\217w\267\14\306\217\376\213\250X\302*\30\301\260`!\20\212\23z\4\301\373\252\211:X6\13R\216\22\14\223\271\230\365\227\2\233\11n\22\210\271`.z\2669.\227,F2g\20\333\250\202Y\205t)\370\331\204euK\264\317:\6\222\15!P\12T\10\4\13\2M\6Q\26+\2b;d\2025\12\3F\244\220\11\213AA\321k\342\36\221\254\16\1=\350\314\202\360\312\314\3438\20\215\214\331\2Ot\242\352K\330\211\224\225\26;\14\3N+e;\35b1&\20\214\23\243\260Y\34\222\10\254'\21$$\3145\4\1608\315\226\275\21n\15\3500\340\30100\211/\226l\306lp\24\2\374\16PT\14aX\256d\317\226\233\17ub\236E#\252\10\2\36\313\11!\6#@\177)\331!e\12\262\14\335_\4iX\242S\344m\2\266\254a\253F\16\301\214\331\22\235\17\242\357\31\272eF\321l\106\14\260\317\25\211\272A\14,`\3600"\2\326b\343\330\136c\357\14s\12\204`\13#", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00520   464   NtReadFile  (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048},  (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\302OF\0\362OF\0\266xF\0\246xF\06oF\0&oF\0VoF\0NoF\0FoF\0~oF\0voF\0noF\0foF\0\236oF\0\226oF\0\216oF\0\372oF\0\346oF\0\2hF\0~hF\0\212hF\0\362hF\0\12iF\0JiF\0\312iF\02jF\0\326kF\0*eF\0jeF\0FfF\0\372fF\0\246`F\0\336bF\0\226\234F\0r\235F\0\22\236F\0\222\236F\0\322\236F\0\336\237F\0\376\237F\0\32\230F\0*\230F\0\206OC\0\376OC\0\311%A\0\365%A\0\34&A\0\4&A\0*&A\0P&A\0w&A\0\232&A\0\276&A\0\247&A\0\312&A\0\366&A\0\340&A\0\14'A\06'A\0_'A\0N'A\0c'A\0\210'A\0\251'A\0\317'A\0\346'A\0\5 A\0T A\0q A\0\214 A\0\337 A\0\377 A\0\32!A\0'!A\0y!A\0b!A\0\214!A\0\264!A\0\336!A\0\310!A\0\362!A\0\37"A\0\4"A\01"A\0Z"A\0@"A\0g"A\0\232"A\0\224"A\0\215"A\0\201"A\0\2\34P\0\11\34_\0\12\34^\0\13\34\\0\32\34E\0\26\34A\0\30\34C\05\34]\0\3\34X\0:\34f\06\34l\07\34g\0=\34d\0\1\34c\08\34a\0\15\34W\0\14\34J\0\16\34H\0\21\34K\0\25\34L\0\27\34j\0\36\34D\0\37\34h\03\34F\0\36\34F\0\36\34F\0\36\34F@:d6$/.\10mkx6@JR\13UZLF@:d6$/)\10m", ) A\0\4 (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\302OF\0\362OF\0\266xF\0\246xF\06oF\0&oF\0VoF\0NoF\0FoF\0~oF\0voF\0noF\0foF\0\236oF\0\226oF\0\216oF\0\372oF\0\346oF\0\2hF\0~hF\0\212hF\0\362hF\0\12iF\0JiF\0\312iF\02jF\0\326kF\0*eF\0jeF\0FfF\0\372fF\0\246`F\0\336bF\0\226\234F\0r\235F\0\22\236F\0\222\236F\0\322\236F\0\336\237F\0\376\237F\0\32\230F\0*\230F\0\206OC\0\376OC\0\311%A\0\365%A\0\34&A\0\4&A\0*&A\0P&A\0w&A\0\232&A\0\276&A\0\247&A\0\312&A\0\366&A\0\340&A\0\14'A\06'A\0_'A\0N'A\0c'A\0\210'A\0\251'A\0\317'A\0\346'A\0\5 A\0T A\0q A\0\214 A\0\337 A\0\377 A\0\32!A\0'!A\0y!A\0b!A\0\214!A\0\264!A\0\336!A\0\310!A\0\362!A\0\37"A\0\4"A\01"A\0Z"A\0@"A\0g"A\0\232"A\0\224"A\0\215"A\0\201"A\0\2\34P\0\11\34_\0\12\34^\0\13\34\\0\32\34E\0\26\34A\0\30\34C\05\34]\0\3\34X\0:\34f\06\34l\07\34g\0=\34d\0\1\34c\08\34a\0\15\34W\0\14\34J\0\16\34H\0\21\34K\0\25\34L\0\27\34j\0\36\34D\0\37\34h\03\34F\0\36\34F\0\36\34F\0\36\34F@:d6$/.\10mkx6@JR\13UZLF@:d6$/)\10m", ) A\0Z (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\302OF\0\362OF\0\266xF\0\246xF\06oF\0&oF\0VoF\0NoF\0FoF\0~oF\0voF\0noF\0foF\0\236oF\0\226oF\0\216oF\0\372oF\0\346oF\0\2hF\0~hF\0\212hF\0\362hF\0\12iF\0JiF\0\312iF\02jF\0\326kF\0*eF\0jeF\0FfF\0\372fF\0\246`F\0\336bF\0\226\234F\0r\235F\0\22\236F\0\222\236F\0\322\236F\0\336\237F\0\376\237F\0\32\230F\0*\230F\0\206OC\0\376OC\0\311%A\0\365%A\0\34&A\0\4&A\0*&A\0P&A\0w&A\0\232&A\0\276&A\0\247&A\0\312&A\0\366&A\0\340&A\0\14'A\06'A\0_'A\0N'A\0c'A\0\210'A\0\251'A\0\317'A\0\346'A\0\5 A\0T A\0q A\0\214 A\0\337 A\0\377 A\0\32!A\0'!A\0y!A\0b!A\0\214!A\0\264!A\0\336!A\0\310!A\0\362!A\0\37"A\0\4"A\01"A\0Z"A\0@"A\0g"A\0\232"A\0\224"A\0\215"A\0\201"A\0\2\34P\0\11\34_\0\12\34^\0\13\34\\0\32\34E\0\26\34A\0\30\34C\05\34]\0\3\34X\0:\34f\06\34l\07\34g\0=\34d\0\1\34c\08\34a\0\15\34W\0\14\34J\0\16\34H\0\21\34K\0\25\34L\0\27\34j\0\36\34D\0\37\34h\03\34F\0\36\34F\0\36\34F\0\36\34F@:d6$/.\10mkx6@JR\13UZLF@:d6$/)\10m", ) A\0g (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\302OF\0\362OF\0\266xF\0\246xF\06oF\0&oF\0VoF\0NoF\0FoF\0~oF\0voF\0noF\0foF\0\236oF\0\226oF\0\216oF\0\372oF\0\346oF\0\2hF\0~hF\0\212hF\0\362hF\0\12iF\0JiF\0\312iF\02jF\0\326kF\0*eF\0jeF\0FfF\0\372fF\0\246`F\0\336bF\0\226\234F\0r\235F\0\22\236F\0\222\236F\0\322\236F\0\336\237F\0\376\237F\0\32\230F\0*\230F\0\206OC\0\376OC\0\311%A\0\365%A\0\34&A\0\4&A\0*&A\0P&A\0w&A\0\232&A\0\276&A\0\247&A\0\312&A\0\366&A\0\340&A\0\14'A\06'A\0_'A\0N'A\0c'A\0\210'A\0\251'A\0\317'A\0\346'A\0\5 A\0T A\0q A\0\214 A\0\337 A\0\377 A\0\32!A\0'!A\0y!A\0b!A\0\214!A\0\264!A\0\336!A\0\310!A\0\362!A\0\37"A\0\4"A\01"A\0Z"A\0@"A\0g"A\0\232"A\0\224"A\0\215"A\0\201"A\0\2\34P\0\11\34_\0\12\34^\0\13\34\\0\32\34E\0\26\34A\0\30\34C\05\34]\0\3\34X\0:\34f\06\34l\07\34g\0=\34d\0\1\34c\08\34a\0\15\34W\0\14\34J\0\16\34H\0\21\34K\0\25\34L\0\27\34j\0\36\34D\0\37\34h\03\34F\0\36\34F\0\36\34F\0\36\34F@:d6$/.\10mkx6@JR\13UZLF@:d6$/)\10m", ) A\0\224 (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\302OF\0\362OF\0\266xF\0\246xF\06oF\0&oF\0VoF\0NoF\0FoF\0~oF\0voF\0noF\0foF\0\236oF\0\226oF\0\216oF\0\372oF\0\346oF\0\2hF\0~hF\0\212hF\0\362hF\0\12iF\0JiF\0\312iF\02jF\0\326kF\0*eF\0jeF\0FfF\0\372fF\0\246`F\0\336bF\0\226\234F\0r\235F\0\22\236F\0\222\236F\0\322\236F\0\336\237F\0\376\237F\0\32\230F\0*\230F\0\206OC\0\376OC\0\311%A\0\365%A\0\34&A\0\4&A\0*&A\0P&A\0w&A\0\232&A\0\276&A\0\247&A\0\312&A\0\366&A\0\340&A\0\14'A\06'A\0_'A\0N'A\0c'A\0\210'A\0\251'A\0\317'A\0\346'A\0\5 A\0T A\0q A\0\214 A\0\337 A\0\377 A\0\32!A\0'!A\0y!A\0b!A\0\214!A\0\264!A\0\336!A\0\310!A\0\362!A\0\37"A\0\4"A\01"A\0Z"A\0@"A\0g"A\0\232"A\0\224"A\0\215"A\0\201"A\0\2\34P\0\11\34_\0\12\34^\0\13\34\\0\32\34E\0\26\34A\0\30\34C\05\34]\0\3\34X\0:\34f\06\34l\07\34g\0=\34d\0\1\34c\08\34a\0\15\34W\0\14\34J\0\16\34H\0\21\34K\0\25\34L\0\27\34j\0\36\34D\0\37\34h\03\34F\0\36\34F\0\36\34F\0\36\34F@:d6$/.\10mkx6@JR\13UZLF@:d6$/)\10m", ) A\0\201 (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\302OF\0\362OF\0\266xF\0\246xF\06oF\0&oF\0VoF\0NoF\0FoF\0~oF\0voF\0noF\0foF\0\236oF\0\226oF\0\216oF\0\372oF\0\346oF\0\2hF\0~hF\0\212hF\0\362hF\0\12iF\0JiF\0\312iF\02jF\0\326kF\0*eF\0jeF\0FfF\0\372fF\0\246`F\0\336bF\0\226\234F\0r\235F\0\22\236F\0\222\236F\0\322\236F\0\336\237F\0\376\237F\0\32\230F\0*\230F\0\206OC\0\376OC\0\311%A\0\365%A\0\34&A\0\4&A\0*&A\0P&A\0w&A\0\232&A\0\276&A\0\247&A\0\312&A\0\366&A\0\340&A\0\14'A\06'A\0_'A\0N'A\0c'A\0\210'A\0\251'A\0\317'A\0\346'A\0\5 A\0T A\0q A\0\214 A\0\337 A\0\377 A\0\32!A\0'!A\0y!A\0b!A\0\214!A\0\264!A\0\336!A\0\310!A\0\362!A\0\37"A\0\4"A\01"A\0Z"A\0@"A\0g"A\0\232"A\0\224"A\0\215"A\0\201"A\0\2\34P\0\11\34_\0\12\34^\0\13\34\\0\32\34E\0\26\34A\0\30\34C\05\34]\0\3\34X\0:\34f\06\34l\07\34g\0=\34d\0\1\34c\08\34a\0\15\34W\0\14\34J\0\16\34H\0\21\34K\0\25\34L\0\27\34j\0\36\34D\0\37\34h\03\34F\0\36\34F\0\36\34F\0\36\34F@:d6$/.\10mkx6@JR\13UZLF@:d6$/)\10m", ) , ) == 0x0
 00521   464   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\334S\0\0\354S\0\0\250d\0\0\270d\0\0(s\0\08s\0\0Hs\0\0Ps\0\0Xs\0\0`s\0\0hs\0\0ps\0\0xs\0\0\200s\0\0\210s\0\0\220s\0\0\344s\0\0\370s\0\0\34t\0\0`t\0\0\224t\0\0\354t\0\0\24u\0\0Tu\0\0\324u\0\0,v\0\0\310w\0\04y\0\0ty\0\0Xz\0\0\344z\0\0\270|\0\0\300~\0\0\210\200\0\0l\201\0\0\14\202\0\0\214\202\0\0\314\202\0\0\300\203\0\0\340\203\0\0\4\204\0\04\204\0\0\230S\5\0\340S\5\0\3279\7\0\3539\7\0\2:\7\0\32:\7\04:\7\0N:\7\0i:\7\0\204:\7\0\240:\7\0\271:\7\0\324:\7\0\350:\7\0\376:\7\0\22;\7\0(;\7\0A;\7\0P;\7\0};\7\0\226;\7\0\267;\7\0\321;\7\0\370;\7\0\33<\7\0J<\7\0o<\7\0\222<\7\0\301<\7\0\341<\7\0\4=\7\09=\7\0g=\7\0|=\7\0\222=\7\0\252=\7\0\300=\7\0\326=\7\0\354=\7\0\1>\7\0\32>\7\0/>\7\0D>\7\0^>\7\0y>\7\0\204>\7\0\212>\7\0\223>\7\0\237>\7\0\34\0\26\0\27\0\31\0\24\0\30\0\25\0\32\0\4\0\3\0\10\0\7\0\6\0\5\0+\0\33\0\35\0\36\0$\0 \0(\0*\0)\0!\0#\0"\0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) \0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) == 0x0
 00522   464   NtClose  (80, ... ) == 0x0
 00523   464   NtClose  (68, ... ) == 0x0
 00524   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.tmp"}, 1242416, ... ) }, 1242416, ... ) == 0x0
 00525   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.tmp"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00526   464   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 80, ) == 0x0
 00527   464   NtClose  (68, ... ) == 0x0
 00528   464   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x860000), 0x0, 176128, ) == 0x0
 00529   464   NtClose  (80, ... ) == 0x0
 00530   464   NtUnmapViewOfSection  (-1, 0x860000, ... ) == 0x0
 00531   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.tmp"}, 1242732, ... ) }, 1242732, ... ) == 0x0
 00532   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.tmp"}, 1242732, ... ) }, 1242732, ... ) == 0x0
 00533   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.tmp"}, 5, 96, ... 80, {status=0x0, info=1}, ) }, 5, 96, ... 80, {status=0x0, info=1}, ) == 0x0
 00534   464   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 80, ... 68, ) == 0x0
 00535   464   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00536   464   NtClose  (80, ... ) == 0x0
 00537   464   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x860000), 0x0, 475136, ) == STATUS_IMAGE_NOT_AT_BASE
 00538   464   NtMapViewOfSection  (68, -1, (0x860000), 0, 0, 0x0, 475136, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00539   464   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00540   464   NtClose  (68, ... ) == 0x0
 00541   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 8, ) == 0x0
 00542   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 8, ... (0x8d3000), 4096, 4, ) == 0x0
 00543   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00544   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00545   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00546   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00547   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.DLL"}, ... 68, ) }, ... 68, ) == 0x0
 00548   464   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00549   464   NtClose  (68, ... ) == 0x0
 00550   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00551   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00552   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00553   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00554   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00555   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00556   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.DLL"}, ... 68, ) }, ... 68, ) == 0x0
 00557   464   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 69632, ) == 0x0
 00558   464   NtClose  (68, ... ) == 0x0
 00559   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00560   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00561   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00562   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00563   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00564   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00565   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00566   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00567   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00568   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00569   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00570   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00571   464   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00572   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WSOCK32.DLL"}, 1241948, ... ) }, 1241948, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00573   464   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WSOCK32.DLL"}, 1241948, ... ) }, 1241948, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00574   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WSOCK32.DLL"}, 1241948, ... ) }, 1241948, ... ) == 0x0
 00575   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WSOCK32.DLL"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00576   464   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 68, ... 80, ) == 0x0
 00577   464   NtQuerySection  (80, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00578   464   NtClose  (68, ... ) == 0x0
 00579   464   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0
 00580   464   NtClose  (80, ... ) == 0x0
 00581   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00582   464   NtProtectVirtualMemory  (-1, (0x8d3000), 4096, 4, ... (0x8d3000), 4096, 4, ) == 0x0
 00583   464   NtFlushInstructionCache  (-1, 9252864, 4096, ... ) == 0x0
 00584   464   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {456, 0}, ... 80, ) == 0x0
 00585   464   NtQueryInformationProcess  (80, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00586   464   NtClose  (80, ... ) == 0x0
 00587   464   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00588   464   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00589   464   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00590   464   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 80, ) }, ... 80, ) == 0x0
 00591   464   NtQueryValueKey  (80,  (80, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00592   464   NtClose  (80, ... ) == 0x0
 00593   464   NtUserSystemParametersInfo  (41, 500, 1242456, 0, ... ) == 0x1
 00594   464   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00595   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00596   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00597   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ...
 00598   464   NtAllocateVirtualMemory  (-1, 5554176, 0, 4096, 4096, 32, ... 5554176, 4096, ) == 0x0
 00597   464   NtUserRegisterClassExWOW  ... ) == 0x810cc03b
 00599   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00600   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc03d
 00601   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00602   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00603   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc03f
 00604   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00605   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00606   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc041
 00607   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00608   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00609   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc043
 00610   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00611   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc045
 00612   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00613   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00614   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc047
 00615   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00616   464   NtUserFindExistingCursorIcon  (1242244, 1242260, 1242828, ... ) == 0x10011
 00617   464   NtUserRegisterClassExWOW  (1242696, 1242776, 1242760, 1242792, 0, 384, 0, ... ) == 0x810cc049
 00618   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00619   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00620   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc04b
 00621   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00622   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00623   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc04d
 00624   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00625   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00626   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc04f
 00627   464   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00628   464   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc051
 00629   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00630   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00631   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc053
 00632   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00633   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00634   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc055
 00635   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc057
 00636   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00637   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00638   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc059
 00639   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00640   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10013
 00641   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc05b
 00642   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00643   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00644   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc05d
 00645   464   NtUserGetClassInfo  (1999896576, 1242864, 1242816, 1242892, 0, ... ) == 0x0
 00646   464   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00647   464   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc05f
 00648   464   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 80, ) == 0x0
 00649   464   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0
 00650   464   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 84, ) }, ... 84, ) == 0x0
 00651   464   NtNotifyChangeKey  (84, 68, 0, 0, 2011390432, 4, 0, 0, 0, 1, ... ) == 0x103
 00652   464   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00653   464   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 88, ) == 0x0
 00654   464   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 92, ) == 0x0
 00655   464   NtUserCallOneParam  (0, 40, ... ) == 0x4
 00656   464   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00657   464   NtQueryVirtualMemory  (-1, 0x12f670, Basic, 28, ... {BaseAddress=0x12f000,AllocationBase=0x30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 00658   464   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 00659   464   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 9371648, 1048576, ) == 0x0
 00660   464   NtAllocateVirtualMemory  (-1, 9371648, 0, 16384, 4096, 4, ... 9371648, 16384, ) == 0x0
 00661   464   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00662   464   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00663   464   NtOpenKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00664   464   NtOpenKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00665   464   NtOpenProcessToken  (-1, 0x8, ... 96, ) == 0x0
 00666   464   NtQueryInformationToken  (96, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00667   464   NtClose  (96, ... ) == 0x0
 00668   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00669   464   NtReleaseMutant  (16, ...
 00670   464   NtContinue  (-135987064, 0, ...
 00669   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00671   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.ENU"}, 1241180, ... ) }, 1241180, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00672   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.ENU"}, 1240820, ... ) }, 1240820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00673   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.ENU.DLL"}, 1240820, ... ) }, 1240820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00674   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.EN"}, 1241180, ... ) }, 1241180, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00675   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.EN"}, 1240820, ... ) }, 1240820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00676   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\gka1.EN.DLL"}, 1240820, ... ) }, 1240820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00677   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00678   464   NtReleaseMutant  (16, ...
 00679   464   NtContinue  (-135987064, 0, ...
 00678   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00680   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00681   464   NtReleaseMutant  (16, ...
 00682   464   NtContinue  (-135987064, 0, ...
 00681   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00683   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00684   464   NtReleaseMutant  (16, ...
 00685   464   NtContinue  (-135987064, 0, ...
 00684   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00686   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00687   464   NtReleaseMutant  (16, ...
 00688   464   NtContinue  (-135987064, 0, ...
 00687   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00689   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00690   464   NtReleaseMutant  (16, ...
 00691   464   NtContinue  (-135987064, 0, ...
 00690   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00692   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00693   464   NtReleaseMutant  (16, ...
 00694   464   NtContinue  (-135987064, 0, ...
 00693   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00695   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00696   464   NtReleaseMutant  (16, ...
 00697   464   NtContinue  (-135987064, 0, ...
 00696   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00698   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00699   464   NtReleaseMutant  (16, ...
 00700   464   NtContinue  (-135987064, 0, ...
 00699   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00701   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00702   464   NtReleaseMutant  (16, ...
 00703   464   NtContinue  (-135987064, 0, ...
 00702   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00704   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00705   464   NtReleaseMutant  (16, ...
 00706   464   NtContinue  (-135987064, 0, ...
 00705   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00707   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00708   464   NtReleaseMutant  (16, ...
 00709   464   NtContinue  (-135987064, 0, ...
 00708   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00710   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00711   464   NtReleaseMutant  (16, ...
 00712   464   NtContinue  (-135987064, 0, ...
 00711   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00713   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00714   464   NtReleaseMutant  (16, ...
 00715   464   NtContinue  (-135987064, 0, ...
 00714   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00716   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00717   464   NtReleaseMutant  (16, ...
 00718   464   NtContinue  (-135987064, 0, ...
 00717   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00719   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00720   464   NtReleaseMutant  (16, ...
 00721   464   NtContinue  (-135987064, 0, ...
 00720   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00722   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00723   464   NtReleaseMutant  (16, ...
 00724   464   NtContinue  (-135987064, 0, ...
 00723   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00725   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00726   464   NtReleaseMutant  (16, ...
 00727   464   NtContinue  (-135987064, 0, ...
 00726   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00728   464   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00729   464   NtReleaseMutant  (16, ...
 00730   464   NtContinue  (-135987064, 0, ...
 00729   464   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00731   464   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 96, ) == 0x0
 00732   464   NtUserGetDC  (0, ... ) == 0x1010052
 00733   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00734   464   NtUserGetDC  (0, ... ) == 0x1010052
 00735   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00736   464   NtGdiCreatePaletteInternal  (1241868, 16, ... ) == 0x608045d
 00737   464   NtGdiGetStockObject  (7, ... ) == 0x1b00017
 00738   464   NtGdiGetStockObject  (5, ... ) == 0x1900015
 00739   464   NtUserFindExistingCursorIcon  (1242264, 1242280, 1242848, ... ) == 0x10003
 00740   464   NtAddAtom  ( ("D\0e\0l\0p\0h\0i\00\00\00\00\00\01\0C\08\0", 28, 1242800, ... ) , 28, 1242800, ... ) == 0x0
 00741   464   NtAddAtom  ( ("C\0o\0n\0t\0r\0o\0l\0O\0f\0s\00\00\08\06\00\00\00\00\00\00\00\00\00\01\0D\00\0", 52, 1242800, ... ) , 52, 1242800, ... ) == 0x0
 00742   464   NtUserSystemParametersInfo  (104, 0, 9376892, 0, ... ) == 0x1
 00743   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10011
 00744   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10023
 00745   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x0
 00746   464   NtUserGetDC  (0, ... ) == 0x1010052
 00747   464   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x105045f
 00748   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00749   464   NtGdiSelectBitmap  (251724881, 17106015, ... ) == 0x185000f
 00750   464   NtGdiGetDCforBitmap  (17106015, ... ) == 0xf010451
 00751   464   NtGdiSaveDC  (251724881, ... ) == 0x1
 00752   464   NtGdiSelectBitmap  (251724881, 17106015, ... ) == 0x105045f
 00753   464   NtGdiGetDCObject  (251724881, 524288, ... ) == 0x188000b
 00754   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00755   464   NtGdiSetDIBitsToDeviceInternal  (251724881, 0, 0, 32, 64, 0, 0, 0, 64, 9192972, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00756   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00757   464   NtGdiSelectBitmap  (251724881, 17106015, ... ) == 0x105045f
 00758   464   NtGdiRestoreDC  (251724881, -1, ... ) == 0x1
 00759   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x105045f
 00760   464   NtGdiCreateCompatibleDC  (251724881, ... ) == 0x2010460
 00761   464   NtGdiExtGetObjectW  (17106015, 24, 1241320, ... ) == 0x18
 00762   464   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x2050461
 00763   464   NtGdiSelectBitmap  (251724881, 17106015, ... ) == 0x185000f
 00764   464   NtGdiSelectBitmap  (33621088, 33883233, ... ) == 0x185000f
 00765   464   NtGdiBitBlt  (33621088, 0, 0, 32, 64, 251724881, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00766   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x105045f
 00767   464   NtGdiSelectBitmap  (33621088, 25493519, ... ) == 0x2050461
 00768   464   NtGdiDeleteObjectApp  (17106015, ... ) == 0x1
 00769   464   NtGdiDeleteObjectApp  (33621088, ... ) == 0x1
 00770   464   NtUserCallOneParam  (0, 33, ... ) == 0xb0095
 00771   464   NtUserSetCursorIconData  (721045, 1241428, 1241444, 1242024, ... ) == 0x1
 00772   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10029
 00773   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10027
 00774   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10025
 00775   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x0
 00776   464   NtUserGetDC  (0, ... ) == 0x1010052
 00777   464   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x705045e
 00778   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00779   464   NtGdiSelectBitmap  (251724881, 117769310, ... ) == 0x185000f
 00780   464   NtGdiGetDCforBitmap  (117769310, ... ) == 0xf010451
 00781   464   NtGdiSaveDC  (251724881, ... ) == 0x1
 00782   464   NtGdiSelectBitmap  (251724881, 117769310, ... ) == 0x705045e
 00783   464   NtGdiGetDCObject  (251724881, 524288, ... ) == 0x188000b
 00784   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00785   464   NtGdiSetDIBitsToDeviceInternal  (251724881, 0, 0, 32, 64, 0, 0, 0, 64, 9193280, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00786   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00787   464   NtGdiSelectBitmap  (251724881, 117769310, ... ) == 0x705045e
 00788   464   NtGdiRestoreDC  (251724881, -1, ... ) == 0x1
 00789   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x705045e
 00790   464   NtGdiCreateCompatibleDC  (251724881, ... ) == 0x301045f
 00791   464   NtGdiExtGetObjectW  (117769310, 24, 1241320, ... ) == 0x18
 00792   464   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050462
 00793   464   NtGdiSelectBitmap  (251724881, 117769310, ... ) == 0x185000f
 00794   464   NtGdiSelectBitmap  (50398303, 50660450, ... ) == 0x185000f
 00795   464   NtGdiBitBlt  (50398303, 0, 0, 32, 64, 251724881, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00796   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x705045e
 00797   464   NtGdiSelectBitmap  (50398303, 25493519, ... ) == 0x3050462
 00798   464   NtGdiDeleteObjectApp  (117769310, ... ) == 0x1
 00799   464   NtGdiDeleteObjectApp  (50398303, ... ) == 0x1
 00800   464   NtUserCallOneParam  (0, 33, ... ) == 0x100b7
 00801   464   NtUserSetCursorIconData  (65719, 1241428, 1241444, 1242024, ... ) == 0x1
 00802   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x0
 00803   464   NtUserGetDC  (0, ... ) == 0x1010052
 00804   464   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x4050460
 00805   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00806   464   NtGdiSelectBitmap  (251724881, 67437664, ... ) == 0x185000f
 00807   464   NtGdiGetDCforBitmap  (67437664, ... ) == 0xf010451
 00808   464   NtGdiSaveDC  (251724881, ... ) == 0x1
 00809   464   NtGdiSelectBitmap  (251724881, 67437664, ... ) == 0x4050460
 00810   464   NtGdiGetDCObject  (251724881, 524288, ... ) == 0x188000b
 00811   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00812   464   NtGdiSetDIBitsToDeviceInternal  (251724881, 0, 0, 32, 64, 0, 0, 0, 64, 9193588, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00813   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00814   464   NtGdiSelectBitmap  (251724881, 67437664, ... ) == 0x4050460
 00815   464   NtGdiRestoreDC  (251724881, -1, ... ) == 0x1
 00816   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x4050460
 00817   464   NtGdiCreateCompatibleDC  (251724881, ... ) == 0x901045e
 00818   464   NtGdiExtGetObjectW  (67437664, 24, 1241320, ... ) == 0x18
 00819   464   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050463
 00820   464   NtGdiSelectBitmap  (251724881, 67437664, ... ) == 0x185000f
 00821   464   NtGdiSelectBitmap  (151061598, 50660451, ... ) == 0x185000f
 00822   464   NtGdiBitBlt  (151061598, 0, 0, 32, 64, 251724881, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00823   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x4050460
 00824   464   NtGdiSelectBitmap  (151061598, 25493519, ... ) == 0x3050463
 00825   464   NtGdiDeleteObjectApp  (67437664, ... ) == 0x1
 00826   464   NtGdiDeleteObjectApp  (151061598, ... ) == 0x1
 00827   464   NtUserCallOneParam  (0, 33, ... ) == 0x100b9
 00828   464   NtUserSetCursorIconData  (65721, 1241428, 1241444, 1242024, ... ) == 0x1
 00829   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x0
 00830   464   NtUserGetDC  (0, ... ) == 0x1010052
 00831   464   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x505045f
 00832   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00833   464   NtGdiSelectBitmap  (251724881, 84214879, ... ) == 0x185000f
 00834   464   NtGdiGetDCforBitmap  (84214879, ... ) == 0xf010451
 00835   464   NtGdiSaveDC  (251724881, ... ) == 0x1
 00836   464   NtGdiSelectBitmap  (251724881, 84214879, ... ) == 0x505045f
 00837   464   NtGdiGetDCObject  (251724881, 524288, ... ) == 0x188000b
 00838   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00839   464   NtGdiSetDIBitsToDeviceInternal  (251724881, 0, 0, 32, 64, 0, 0, 0, 64, 9193896, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00840   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00841   464   NtGdiSelectBitmap  (251724881, 84214879, ... ) == 0x505045f
 00842   464   NtGdiRestoreDC  (251724881, -1, ... ) == 0x1
 00843   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x505045f
 00844   464   NtGdiCreateCompatibleDC  (251724881, ... ) == 0x6010460
 00845   464   NtGdiExtGetObjectW  (84214879, 24, 1241320, ... ) == 0x18
 00846   464   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050464
 00847   464   NtGdiSelectBitmap  (251724881, 84214879, ... ) == 0x185000f
 00848   464   NtGdiSelectBitmap  (100729952, 50660452, ... ) == 0x185000f
 00849   464   NtGdiBitBlt  (100729952, 0, 0, 32, 64, 251724881, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00850   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x505045f
 00851   464   NtGdiSelectBitmap  (100729952, 25493519, ... ) == 0x3050464
 00852   464   NtGdiDeleteObjectApp  (84214879, ... ) == 0x1
 00853   464   NtGdiDeleteObjectApp  (100729952, ... ) == 0x1
 00854   464   NtUserCallOneParam  (0, 33, ... ) == 0x100bb
 00855   464   NtUserSetCursorIconData  (65723, 1241428, 1241444, 1242024, ... ) == 0x1
 00856   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x0
 00857   464   NtUserGetDC  (0, ... ) == 0x1010052
 00858   464   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0xb05045e
 00859   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00860   464   NtGdiSelectBitmap  (251724881, 184878174, ... ) == 0x185000f
 00861   464   NtGdiGetDCforBitmap  (184878174, ... ) == 0xf010451
 00862   464   NtGdiSaveDC  (251724881, ... ) == 0x1
 00863   464   NtGdiSelectBitmap  (251724881, 184878174, ... ) == 0xb05045e
 00864   464   NtGdiGetDCObject  (251724881, 524288, ... ) == 0x188000b
 00865   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00866   464   NtGdiSetDIBitsToDeviceInternal  (251724881, 0, 0, 32, 64, 0, 0, 0, 64, 9194204, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00867   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00868   464   NtGdiSelectBitmap  (251724881, 184878174, ... ) == 0xb05045e
 00869   464   NtGdiRestoreDC  (251724881, -1, ... ) == 0x1
 00870   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0xb05045e
 00871   464   NtGdiCreateCompatibleDC  (251724881, ... ) == 0x701045f
 00872   464   NtGdiExtGetObjectW  (184878174, 24, 1241320, ... ) == 0x18
 00873   464   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050465
 00874   464   NtGdiSelectBitmap  (251724881, 184878174, ... ) == 0x185000f
 00875   464   NtGdiSelectBitmap  (117507167, 50660453, ... ) == 0x185000f
 00876   464   NtGdiBitBlt  (117507167, 0, 0, 32, 64, 251724881, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00877   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0xb05045e
 00878   464   NtGdiSelectBitmap  (117507167, 25493519, ... ) == 0x3050465
 00879   464   NtGdiDeleteObjectApp  (184878174, ... ) == 0x1
 00880   464   NtGdiDeleteObjectApp  (117507167, ... ) == 0x1
 00881   464   NtUserCallOneParam  (0, 33, ... ) == 0x100bd
 00882   464   NtUserSetCursorIconData  (65725, 1241428, 1241444, 1242024, ... ) == 0x1
 00883   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x0
 00884   464   NtUserGetDC  (0, ... ) == 0x1010052
 00885   464   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x8050460
 00886   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00887   464   NtGdiSelectBitmap  (251724881, 134546528, ... ) == 0x185000f
 00888   464   NtGdiGetDCforBitmap  (134546528, ... ) == 0xf010451
 00889   464   NtGdiSaveDC  (251724881, ... ) == 0x1
 00890   464   NtGdiSelectBitmap  (251724881, 134546528, ... ) == 0x8050460
 00891   464   NtGdiGetDCObject  (251724881, 524288, ... ) == 0x188000b
 00892   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00893   464   NtGdiSetDIBitsToDeviceInternal  (251724881, 0, 0, 32, 64, 0, 0, 0, 64, 9194820, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00894   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00895   464   NtGdiSelectBitmap  (251724881, 134546528, ... ) == 0x8050460
 00896   464   NtGdiRestoreDC  (251724881, -1, ... ) == 0x1
 00897   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x8050460
 00898   464   NtGdiCreateCompatibleDC  (251724881, ... ) == 0xd01045e
 00899   464   NtGdiExtGetObjectW  (134546528, 24, 1241320, ... ) == 0x18
 00900   464   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050466
 00901   464   NtGdiSelectBitmap  (251724881, 134546528, ... ) == 0x185000f
 00902   464   NtGdiSelectBitmap  (218170462, 50660454, ... ) == 0x185000f
 00903   464   NtGdiBitBlt  (218170462, 0, 0, 32, 64, 251724881, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00904   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x8050460
 00905   464   NtGdiSelectBitmap  (218170462, 25493519, ... ) == 0x3050466
 00906   464   NtGdiDeleteObjectApp  (134546528, ... ) == 0x1
 00907   464   NtGdiDeleteObjectApp  (218170462, ... ) == 0x1
 00908   464   NtUserCallOneParam  (0, 33, ... ) == 0x100bf
 00909   464   NtUserSetCursorIconData  (65727, 1241428, 1241444, 1242024, ... ) == 0x1
 00910   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x0
 00911   464   NtUserGetDC  (0, ... ) == 0x1010052
 00912   464   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x905045f
 00913   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00914   464   NtGdiSelectBitmap  (251724881, 151323743, ... ) == 0x185000f
 00915   464   NtGdiGetDCforBitmap  (151323743, ... ) == 0xf010451
 00916   464   NtGdiSaveDC  (251724881, ... ) == 0x1
 00917   464   NtGdiSelectBitmap  (251724881, 151323743, ... ) == 0x905045f
 00918   464   NtGdiGetDCObject  (251724881, 524288, ... ) == 0x188000b
 00919   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00920   464   NtGdiSetDIBitsToDeviceInternal  (251724881, 0, 0, 32, 64, 0, 0, 0, 64, 9194512, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00921   464   NtUserSelectPalette  (251724881, 25690123, 0, ... ) == 0x188000b
 00922   464   NtGdiSelectBitmap  (251724881, 151323743, ... ) == 0x905045f
 00923   464   NtGdiRestoreDC  (251724881, -1, ... ) == 0x1
 00924   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x905045f
 00925   464   NtGdiCreateCompatibleDC  (251724881, ... ) == 0xa010460
 00926   464   NtGdiExtGetObjectW  (151323743, 24, 1241320, ... ) == 0x18
 00927   464   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050467
 00928   464   NtGdiSelectBitmap  (251724881, 151323743, ... ) == 0x185000f
 00929   464   NtGdiSelectBitmap  (167838816, 50660455, ... ) == 0x185000f
 00930   464   NtGdiBitBlt  (167838816, 0, 0, 32, 64, 251724881, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00931   464   NtGdiSelectBitmap  (251724881, 25493519, ... ) == 0x905045f
 00932   464   NtGdiSelectBitmap  (167838816, 25493519, ... ) == 0x3050467
 00933   464   NtGdiDeleteObjectApp  (151323743, ... ) == 0x1
 00934   464   NtGdiDeleteObjectApp  (167838816, ... ) == 0x1
 00935   464   NtUserCallOneParam  (0, 33, ... ) == 0x100c1
 00936   464   NtUserSetCursorIconData  (65729, 1241428, 1241444, 1242024, ... ) == 0x1
 00937   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10015
 00938   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10019
 00939   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x1001f
 00940   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x1001b
 00941   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10021
 00942   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x1001d
 00943   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10013
 00944   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10017
 00945   464   NtUserFindExistingCursorIcon  (1242148, 1242164, 1242732, ... ) == 0x10011
 00946   464   NtUserCallOneParam  (0, 39, ... ) == 0x4090409
 00947   464   NtUserGetDC  (0, ... ) == 0x1010052
 00948   464   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00949   464   NtUserEnumDisplayMonitors  (0, 0, 8915880, 9377472, ... ) == 0x1
 00950   464   NtUserSystemParametersInfo  (31, 60, 1241584, 0, ... ) == 0x1
 00951   464   NtGdiHfontCreate  (1241980, 356, 0, 0, 1344496, ... ) == 0xb0a0460
 00952   464   NtGdiExtGetObjectW  (185205856, 420, 1241804, ... ) == 0x164
 00953   464   NtUserSystemParametersInfo  (41, 0, 1241784, 0, ... ) == 0x1
 00954   464   NtGdiHfontCreate  (1241980, 356, 0, 0, 1344488, ... ) == 0xf0a045e
 00955   464   NtGdiExtGetObjectW  (252314718, 420, 1241804, ... ) == 0x164
 00956   464   NtGdiHfontCreate  (1241980, 356, 0, 0, 1344480, ... ) == 0xa0a045f
 00957   464   NtGdiExtGetObjectW  (168428639, 420, 1241804, ... ) == 0x164
 00958   464   NtUserFindExistingCursorIcon  (1241892, 1241908, 1242476, ... ) == 0x0
 00959   464   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 8650752, 4096, ) == 0x0
 00960   464   NtUserGetKeyboardLayoutList  (64, 1242464, ... ) == 0x1
 00961   464   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 00962   464   NtUserRegisterWindowMessage  ( ("Delphi Picture", ... ) , ... ) == 0xc0d6
 00963   464   NtUserRegisterWindowMessage  ( ("Delphi Component", ... ) , ... ) == 0xc0d7
 00964   464   NtOpenMutant  (0x1f0001, {24, 52, 0x0, 0, 0,  (0x1f0001, {24, 52, 0x0, 0, 0, "Residented"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00965   464   NtUserSetWindowsHookEx  (8781824, 1243792, 0, 4, 8789524, 2, ... ) == 0x100c3
 00966   464   NtOpenFile  (0x10080, {24, 12, 0x40, 0, 0,  (0x10080, {24, 12, 0x40, 0, 0, "ftpupd.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00967   464   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "uterm19"}, 1, ... 100, ) }, 1, ... 100, ) == 0x0
 00968   464   NtOpenProcessToken  (-1, 0x20, ... 104, ) == 0x0
 00969   464   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00970   464   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00971   464   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 108, ) }, ... 108, ) == 0x0
 00972   464   NtQueryValueKey  (108,  (108, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00973   464   NtClose  (108, ... ) == 0x0
 00974   464   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00975   464   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 108, ) == 0x0
 00976   464   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 112, ) == 0x0
 00977   464   NtQuerySystemTime  (... {789760964, 29878816}, ) == 0x0
 00978   464   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 116, ) == 0x0
 00979   464   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00980   464   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00981   464   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00982   464   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00983   464   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 120, ) == 0x0
 00984   464   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 124, ) == 0x0
 00985   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 128, ) }, ... 128, ) == 0x0
 00986   464   NtOpenKey  (0x20019, {24, 128, 0x40, 0, 0,  (0x20019, {24, 128, 0x40, 0, 0, "ActiveComputerName"}, ... 132, ) }, ... 132, ) == 0x0
 00987   464   NtQueryValueKey  (132,  (132, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (132, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (132, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00988   464   NtClose  (132, ... ) == 0x0
 00989   464   NtClose  (128, ... ) == 0x0
 00990   464   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 128, ) == 0x0
 00991   464   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 132, ) == 0x0
 00992   464   NtDuplicateObject  (-1, 128, -1, 0x0, 0, 2, ... 136, ) == 0x0
 00993   464   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 00994   464   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00995   464   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 140, ) == 0x0
 00996   464   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00997   464   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00998   464   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243244,  (0xc0100080, {24, 0, 0x40, 0, 1243244, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 144, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 144, {status=0x0, info=1}, ) == 0x0
 00999   464   NtSetInformationFile  (144, 1243300, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01000   464   NtSetInformationFile  (144, 1243292, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01001   464   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01002   464   NtWriteFile  (144, 121, 0, 0,  (144, 121, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01003   464   NtReadFile  (144, 121, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (144, 121, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20x\37\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01004   464   NtFsControlFile  (144, 121, 0x0, 0x0, 0x11c017,  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20x\37\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20x\37\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01005   464   NtFsControlFile  (144, 121, 0x0, 0x0, 0x11c017,  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\315\317\1h\23V\334\21\261\310\0\14)\371\246\305 \0"\0 \320\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\315\317\1h\23V\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \0 \320\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\315\317\1h\23V\334\21\261\310\0\14)\371\246\305 \0"\0 \320\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\315\317\1h\23V\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\315\317\1h\23V\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) == 0x103
 01006   464   NtFsControlFile  (144, 121, 0x0, 0x0, 0x11c017,  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\315\317\1h\23V\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\315\317\1h\23V\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01007   464   NtClose  (140, ... ) == 0x0
 01008   464   NtClose  (144, ... ) == 0x0
 01009   464   NtAdjustPrivilegesToken  (104, 0, 1245080, 16, 0, 0, ... ) == 0x0
 01010   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01011   464   NtQueryValueKey  (144,  (144, "Windows Security Manager", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01012   464   NtClose  (144, ... ) == 0x0
 01013   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01014   464   NtQueryValueKey  (144,  (144, "Disk Defragmenter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01015   464   NtClose  (144, ... ) == 0x0
 01016   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01017   464   NtQueryValueKey  (144,  (144, "System Restore Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01018   464   NtClose  (144, ... ) == 0x0
 01019   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01020   464   NtQueryValueKey  (144,  (144, "Bot Loader", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01021   464   NtClose  (144, ... ) == 0x0
 01022   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01023   464   NtQueryValueKey  (144,  (144, "SysTray", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01024   464   NtClose  (144, ... ) == 0x0
 01025   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01026   464   NtQueryValueKey  (144,  (144, "WinUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01027   464   NtClose  (144, ... ) == 0x0
 01028   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01029   464   NtQueryValueKey  (144,  (144, "Windows Update Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01030   464   NtClose  (144, ... ) == 0x0
 01031   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01032   464   NtQueryValueKey  (144,  (144, "avserve.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01033   464   NtClose  (144, ... ) == 0x0
 01034   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01035   464   NtQueryValueKey  (144,  (144, "avserve2.exeUpdate Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01036   464   NtClose  (144, ... ) == 0x0
 01037   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01038   464   NtQueryValueKey  (144,  (144, "MS Config v13", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01039   464   NtClose  (144, ... ) == 0x0
 01040   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01041   464   NtQueryValueKey  (144,  (144, "Windows Update", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01042   464   NtClose  (144, ... ) == 0x0
 01043   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Microsoft\Wireless"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01044   464   NtCreateKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01045   464   NtSetInformationFile  (-2147482808, -135986140, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01046   464   NtSetInformationFile  (-2147482808, -135986612, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01044   464   NtCreateKey  ... 144, 1, ) == 0x0
 01047   464   NtSetValueKey  (144,  (144, "ID", 0, 1, "d\0u\0s\0t\0r\0b\0b\0q\0w\0b\0g\0u\0i\0y\0d\0u\0a\0\0\0", 36, ... ) , 0, 1,  (144, "ID", 0, 1, "d\0u\0s\0t\0r\0b\0b\0q\0w\0b\0g\0u\0i\0y\0d\0u\0a\0\0\0", 36, ... ) , 36, ... ) == 0x0
 01048   464   NtClose  (144, ... ) == 0x0
 01049   464   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01050   464   NtQueryValueKey  (144,  (144, "Cryptographic Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01051   464   NtClose  (144, ... ) == 0x0
 01052   464   NtCreateKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... 144, 2, ) }, 0, 0x0, 0, ... 144, 2, ) == 0x0
 01053   464   NtSetValueKey  (144,  (144, "Client", 0, 1, "1\0\0\0", 4, ... ) , 0, 1,  (144, "Client", 0, 1, "1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 01054   464   NtClose  (144, ... ) == 0x0
 01055   464   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1243516,  (0x80100080, {24, 0, 0x40, 0, 1243516, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 144, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 144, {status=0x0, info=1}, ) == 0x0
 01056   464   NtQueryInformationFile  (144, 1244452, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01057   464   NtQueryInformationFile  (144, 1244424, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01058   464   NtQueryInformationFile  (144, 1244376, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01059   464   NtAllocateVirtualMemory  (-1, 1372160, 0, 8192, 4096, 4, ... 1372160, 8192, ) == 0x0
 01060   464   NtQueryInformationFile  (144, 1371664, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01061   464   NtQueryInformationFile  (144, 1242920, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01062   464   NtQueryInformationFile  (144, 1242764, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01063   464   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1242772,  (0x40110080, {24, 0, 0x40, 0, 1242772, "\??\C:\WINDOWS\System32\wpeapid.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01064   464   NtClose  (-2147482020, ... ) == 0x0
 01063   464   NtCreateFile  ... 140, {status=0x0, info=2}, ) == 0x0
 01065   464   NtQueryVolumeInformationFile  (140, 1242144, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01066   464   NtQueryInformationFile  (140, 1242104, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01067   464   NtQueryVolumeInformationFile  (144, 1242144, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01068   464   NtQueryVolumeInformationFile  (144, 1241828, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01069   464   NtSetInformationFile  (140, 1241932, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01070   464   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 144, ... 148, ) == 0x0
 01071   464   NtMapViewOfSection  (148, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x9f0000), {0, 0}, 188416, ) == 0x0
 01072   464   NtClose  (148, ... ) == 0x0
 01073   464   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01074   464   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "| (\302H.\333\221l\6=\350|"\15n\264\260\304%{\20= \3\315\232\211\2723\30\374V\274\234t\352EOY\31R\225-\206P(\264\235\207/\225\244\213\325\343WdF\311\79\234\211m\5\246\367\230Bb\336\261\256\241G\372\203!\226\333\250@h*j^ B\177s\30\306\323\230\230<\270\227\32&T\302\354\313V\32\244vL\247\36^\15\313+\344B\327\0\313F\223\325\250\267\14\34\367!@\26\200\3\366;9[\346\2[\22]#A\4\33\225Y\203\335\21\230\267\266sU+\330!\272;b\307\3175O\32\306\255\303\6\315\37\327\0Qa%\244#k\31\31J\11\335s\221o\361\303\304\31\13\212\317P\33\277A\325JL\23\2642\24\34264\260\304%{\20= \3\315\232\211\2723\30\374V\274\234t\352EOY\31R\225-\206P(\264\235\207/\225\244\213\325\343WdF\311\79\234\211m\5\246\367\230Bb\336\261\256\241G\372\203!\226\333\250@h*j^ B\177s\30\306\323\230\230<\270\227\32&T\302\354\313V\32\244vL\247\36^\15\313+\344B\327\0\313F\223\325\250\267\14\34\367!@\26\200\3\366;9[\346\2[\22]#A\4\33\225Y\203\335\21\230\267\266sU+\330!\272;b\307\3175O\32\306\255\303\6\315\37\327\0Qa%\244#k\31\31J\11\335s\221o\361\303\304\31\13\212\317P\33\277A\325JL\23\2642\24\34216\350\337M\267\15~\277\266t\274\352a\243\3021h\367\306\7\206\3\2056\346!\276\246\263;K\243 \263\360\3002\37\23\15d.<\270.k\310\3326\12\11\332\276\34C*~x2{\344\362\324\254C\17\21\322thX\353\300\261_\310\7\177c\177R\334\344~\23\337\346\\344\374M\360\373\10\226\333\226\0\253E\253\24A\7\2478\200\14\267\376\310\360\201\345\204\356\311\306\311\231~\17\330a\212\3r\215,x\353\200\4*?\233[\313\234\215\1\27\24B\1V/\224\214\26\36V\20\23\275\314\2551\16\316\331%\34\222\16\34\0=S\2429\221v\240\36jq\25\23\271CT\275\13\262\27\321t%\250\260F\16\234\310#\325\324P\10\17\30T\2,\256\312,\37\24D\20<@\324\357\32\234\16 \36%g\257\22\373\212\26:tD\25U\310C\323Y\15\340`\22F\251\256\22\216A\6\362\320[!\276\177F\7\365\36Q\30\36\7\222\362\351\336\6\204}\356\372\364\366\267V4\32z'\257'\36", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01075   464   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "@\31z\214*mps_d\216]\26QLx\326A\30O\22U\216]@\31HK\36A\30\5"YDG@\31z\214\32]@C\306t\216]\6A\341\347Z\220\37\377\250a\321\0\250h\32\303\212\224\2\13>\6\25HZ8\264\276\375i\240A-(\26ER\37\11\214\23\11p\327H\12{\10%h#\335b\312\12}{S\36\201Fc\360\343W\320~\37\260o\351\203\3135\11\356C\35\32\6\352\11x\234\20A\227z\14\301\35\234\375\242(z\3x\255\23BE\5\33L!\26\13\345\200t\33u\33s\333\316"B\177?4\361\274\30\12\276\36\366b}o\0D\3724\17\211_\314\330\35\34L\272\1417\362/\30\311[\12\22\310\241\335\2451\31\12\25H#ir\27\5DpD\26\320\31\25\265\252\236\7M\200\326\225N\336\26bKDto\15\357v\256T\03GIc\234\276\260\331\311\363"\16\274\310\374h-8k\260\17\26\267[]\\311i\201o\26a}w\340"\30\a\321\341o-\212z\24E8\16;\6v$wM\336$\366\1_\376\y\23\225Z\10AP\201\252\34 \311\26\324b\305\376\242\236\345R\305\227\26{\271\243\226\13\213c\31w\11\14b\23\267\275zT\211\364\244IG\236WS\250\276\207\207\364\26\32\6\233&\347\263e\332oW[\227\225M-\202&0\337\12\2615Bf\354\306\215\252U\352\300\247X\317\377\21E\265\244\365?\313u\371\23\360\31T\300+\20>hB\4i\25\22j\227Q\2265\362\36\365m\12\34<\373\33\277\266g\225\333m\213EB\31.\303*\357\343\17\222E\360\357\177\360_\364]\217\254\24!E\260.R\205\207\370\331\250\2\2243k\252\335p\260\377)\244\15M\372\364}M\22cY\203\347\341:\32\25\325", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) YDG@\31z\214\32]@C\306t\216]\6A\341\347Z\220\37\377\250a\321\0\250h\32\303\212\224\2\13>\6\25HZ8\264\276\375i\240A-(\26ER\37\11\214\23\11p\327H\12{\10%h#\335b\312\12}{S\36\201Fc\360\343W\320~\37\260o\351\203\3135\11\356C\35\32\6\352\11x\234\20A\227z\14\301\35\234\375\242(z\3x\255\23BE\5\33L!\26\13\345\200t\33u\33s\333\316 (140, 0, 0, 0, "@\31z\214*mps_d\216]\26QLx\326A\30O\22U\216]@\31HK\36A\30\5"YDG@\31z\214\32]@C\306t\216]\6A\341\347Z\220\37\377\250a\321\0\250h\32\303\212\224\2\13>\6\25HZ8\264\276\375i\240A-(\26ER\37\11\214\23\11p\327H\12{\10%h#\335b\312\12}{S\36\201Fc\360\343W\320~\37\260o\351\203\3135\11\356C\35\32\6\352\11x\234\20A\227z\14\301\35\234\375\242(z\3x\255\23BE\5\33L!\26\13\345\200t\33u\33s\333\316"B\177?4\361\274\30\12\276\36\366b}o\0D\3724\17\211_\314\330\35\34L\272\1417\362/\30\311[\12\22\310\241\335\2451\31\12\25H#ir\27\5DpD\26\320\31\25\265\252\236\7M\200\326\225N\336\26bKDto\15\357v\256T\03GIc\234\276\260\331\311\363"\16\274\310\374h-8k\260\17\26\267[]\\311i\201o\26a}w\340"\30\a\321\341o-\212z\24E8\16;\6v$wM\336$\366\1_\376\y\23\225Z\10AP\201\252\34 \311\26\324b\305\376\242\236\345R\305\227\26{\271\243\226\13\213c\31w\11\14b\23\267\275zT\211\364\244IG\236WS\250\276\207\207\364\26\32\6\233&\347\263e\332oW[\227\225M-\202&0\337\12\2615Bf\354\306\215\252U\352\300\247X\317\377\21E\265\244\365?\313u\371\23\360\31T\300+\20>hB\4i\25\22j\227Q\2265\362\36\365m\12\34<\373\33\277\266g\225\333m\213EB\31.\303*\357\343\17\222E\360\357\177\360_\364]\217\254\24!E\260.R\205\207\370\331\250\2\2243k\252\335p\260\377)\244\15M\372\364}M\22cY\203\347\341:\32\25\325", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \16\274\310\374h-8k\260\17\26\267[]\\311i\201o\26a}w\340 (140, 0, 0, 0, "@\31z\214*mps_d\216]\26QLx\326A\30O\22U\216]@\31HK\36A\30\5"YDG@\31z\214\32]@C\306t\216]\6A\341\347Z\220\37\377\250a\321\0\250h\32\303\212\224\2\13>\6\25HZ8\264\276\375i\240A-(\26ER\37\11\214\23\11p\327H\12{\10%h#\335b\312\12}{S\36\201Fc\360\343W\320~\37\260o\351\203\3135\11\356C\35\32\6\352\11x\234\20A\227z\14\301\35\234\375\242(z\3x\255\23BE\5\33L!\26\13\345\200t\33u\33s\333\316"B\177?4\361\274\30\12\276\36\366b}o\0D\3724\17\211_\314\330\35\34L\272\1417\362/\30\311[\12\22\310\241\335\2451\31\12\25H#ir\27\5DpD\26\320\31\25\265\252\236\7M\200\326\225N\336\26bKDto\15\357v\256T\03GIc\234\276\260\331\311\363"\16\274\310\374h-8k\260\17\26\267[]\\311i\201o\26a}w\340"\30\a\321\341o-\212z\24E8\16;\6v$wM\336$\366\1_\376\y\23\225Z\10AP\201\252\34 \311\26\324b\305\376\242\236\345R\305\227\26{\271\243\226\13\213c\31w\11\14b\23\267\275zT\211\364\244IG\236WS\250\276\207\207\364\26\32\6\233&\347\263e\332oW[\227\225M-\202&0\337\12\2615Bf\354\306\215\252U\352\300\247X\317\377\21E\265\244\365?\313u\371\23\360\31T\300+\20>hB\4i\25\22j\227Q\2265\362\36\365m\12\34<\373\33\277\266g\225\333m\213EB\31.\303*\357\343\17\222E\360\357\177\360_\364]\217\254\24!E\260.R\205\207\370\331\250\2\2243k\252\335p\260\377)\244\15M\372\364}M\22cY\203\347\341:\32\25\325", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01076   464   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "G\0\36\34F\0\26\37F\0\342D@\0\16\30F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0.\37F\0\22A@\0>\35F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0F\37F\02B@\0\236\37F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0\236\37F\0\262}@\0\312\37F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0\266\37F\0\236y@\0\302\37F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0\316\37F\0Bu@\0\326\36F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\34\34F\0\256\31F\200\36\30F\200\240\31F\2006\30F\200\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0\6\30F\0:p@\0\16\34F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0^\30F\0*p@\0u\35F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\36\34A\0\347cF\0\206\30F\200\344cF\0\336\30F\200\345cF\0\366\30F\200\342cF\0\16\31F\200\343cF\0&\31F\200\340cF\0~\31F\200\341cF\0\226\31F\200\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0\256\30F\0\276q@\0\12\34F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34F\0\36\34G\0\36\34F\0\306\30F\0\252q@\0\12\34F\0\36\34F\0\36\34F\0\36\34F\0x\247i+\36\34", 3330, 0x0, 0, ... {status=0x0, info=3330}, ) , 3330, 0x0, 0, ... {status=0x0, info=3330}, ) == 0x0
 01077   464   NtUnmapViewOfSection  (-1, 0x9f0000, ... ) == 0x0
 01078   464   NtSetInformationFile  (140, 1244376, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01079   464   NtClose  (144, ... ) == 0x0
 01080   464   NtClose  (140, ... ) == 0x0
 01081   464   NtCreateKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 140, 2, ) }, 0, 0x0, 0, ... 140, 2, ) == 0x0
 01082   464   NtSetValueKey  (140,  (140, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0p\0e\0a\0p\0i\0d\0.\0e\0x\0e\0\0\0", 64, ... , 0, 1,  (140, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0p\0e\0a\0p\0i\0d\0.\0e\0x\0e\0\0\0", 64, ... , 64, ...
 01083   464   NtSetInformationFile  (-2147482808, -135985356, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01084   464   NtSetInformationFile  (-2147482808, -135985448, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01082   464   NtSetValueKey  ... ) == 0x0
 01085   464   NtClose  (140, ... ) == 0x0
 01086   464   NtClose  (100, ... ) == 0x0
 01087   464   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 01088   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wpeapid.exe"}, 1241008, ... ) }, 1241008, ... ) == 0x0
 01089   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wpeapid.exe"}, 1241700, ... ) }, 1241700, ... ) == 0x0
 01090   464   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wpeapid.exe"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 01091   464   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 100, ... 140, ) == 0x0
 01092   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01093   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 144, ) }, ... 144, ) == 0x0
 01094   464   NtQueryValueKey  (144,  (144, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01095   464   NtClose  (144, ... ) == 0x0
 01096   464   NtQueryVolumeInformationFile  (100, 1241008, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01097   464   NtOpenMutant  (0x120001, {24, 52, 0x0, 0, 0,  (0x120001, {24, 52, 0x0, 0, 0, "ShimCacheMutex"}, ... 144, ) }, ... 144, ) == 0x0
 01098   464   NtWaitForSingleObject  (144, 0, {-1000000, -1}, ... ) == 0x0
 01099   464   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "ShimSharedMemory"}, ... 148, ) }, ... 148, ) == 0x0
 01100   464   NtMapViewOfSection  (148, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x9f0000), {0, 0}, 57344, ) == 0x0
 01101   464   NtReleaseMutant  (144, ... 0x0, ) == 0x0
 01102   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1238992, ... ) }, 1238992, ... ) == 0x0
 01103   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 01104   464   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 152, ... 156, ) == 0x0
 01105   464   NtClose  (152, ... ) == 0x0
 01106   464   NtMapViewOfSection  (156, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa00000), 0x0, 106496, ) == 0x0
 01107   464   NtClose  (156, ... ) == 0x0
 01108   464   NtUnmapViewOfSection  (-1, 0xa00000, ... ) == 0x0
 01109   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1239308, ... ) }, 1239308, ... ) == 0x0
 01110   464   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 156, {status=0x0, info=1}, ) }, 5, 96, ... 156, {status=0x0, info=1}, ) == 0x0
 01111   464   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 156, ... 152, ) == 0x0
 01112   464   NtQuerySection  (152, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01113   464   NtClose  (156, ... ) == 0x0
 01114   464   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75f40000), 0x0, 118784, ) == 0x0
 01115   464   NtClose  (152, ... ) == 0x0
 01116   464   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 152, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 152, {status=0x0, info=1}, ) == 0x0
 01117   464   NtQueryInformationFile  (152, 1239596, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01118   464   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 152, ... 156, ) == 0x0
 01119   464   NtMapViewOfSection  (156, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xa00000), 0x0, 1028096, ) == 0x0
 01120   464   NtQueryInformationFile  (152, 1239692, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01121   464   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01122   464   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01123   464   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 01124   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01125   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1237256, 616, BothDirectory, 1,  (160, 0, 0, 0, 1237256, 616, BothDirectory, 1, "wpeapid.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01126   464   NtClose  (160, ... ) == 0x0
 01127   464   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01128   464   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01129   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wpeapid.exe"}, 1236644, ... ) }, 1236644, ... ) == 0x0
 01130   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01131   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01132   464   NtClose  (160, ... ) == 0x0
 01133   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01134   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01135   464   NtClose  (160, ... ) == 0x0
 01136   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01137   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1, "wpeapid.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01138   464   NtClose  (160, ... ) == 0x0
 01139   464   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01140   464   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01141   464   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01142   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01143   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 160, ) == 0x0
 01144   464   NtQueryInformationToken  (160, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01145   464   NtClose  (160, ... ) == 0x0
 01146   464   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01147   464   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\wpeapid.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01148   464   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01149   464   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01150   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wpeapid.exe"}, 1238924, ... ) }, 1238924, ... ) == 0x0
 01151   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01152   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1,  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01153   464   NtClose  (160, ... ) == 0x0
 01154   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01155   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1,  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01156   464   NtClose  (160, ... ) == 0x0
 01157   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01158   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1,  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1, "wpeapid.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01159   464   NtClose  (160, ... ) == 0x0
 01160   464   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01161   464   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01162   464   NtWaitForSingleObject  (144, 0, {-1000000, -1}, ... ) == 0x0
 01163   464   NtQueryVolumeInformationFile  (100, 1239568, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01164   464   NtQueryInformationFile  (100, 1239548, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01165   464   NtQueryInformationFile  (100, 1239588, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01166   464   NtReleaseMutant  (144, ... 0x0, ) == 0x0
 01167   464   NtUnmapViewOfSection  (-1, 0xa00000, ... ) == 0x0
 01168   464   NtClose  (156, ... ) == 0x0
 01169   464   NtClose  (152, ... ) == 0x0
 01170   464   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01171   464   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpeapid.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01172   464   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 01173   464   NtOpenProcessToken  (-1, 0xa, ... 152, ) == 0x0
 01174   464   NtQueryInformationToken  (152, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 01175   464   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01176   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01177   464   NtQueryValueKey  (156,  (156, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (156, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01178   464   NtQueryValueKey  (156,  (156, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (156, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01179   464   NtClose  (156, ... ) == 0x0
 01180   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01181   464   NtQueryValueKey  (156,  (156, "ExecutableTypes", Partial, 0, ... ) , Partial, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 01182   464   NtQueryValueKey  (156,  (156, "ExecutableTypes", Partial, 260, ... TitleIdx=0, Type=7, Data="A\0D\0E\0\0\0A\0D\0P\0\0\0B\0A\0S\0\0\0B\0A\0T\0\0\0C\0H\0M\0\0\0C\0M\0D\0\0\0C\0O\0M\0\0\0C\0P\0L\0\0\0C\0R\0T\0\0\0E\0X\0E\0\0\0H\0L\0P\0\0\0H\0T\0A\0\0\0I\0N\0F\0\0\0I\0N\0S\0\0\0I\0S\0P\0\0\0L\0N\0K\0\0\0M\0D\0B\0\0\0M\0D\0E\0\0\0M\0S\0C\0\0\0M\0S\0I\0\0\0M\0S\0P\0\0\0M\0S\0T\0\0\0O\0C\0X\0\0\0P\0C\0D\0\0\0P\0I\0F\0\0\0R\0E\0G\0\0\0S\0C\0R\0\0\0S\0H\0S\0\0\0U\0R\0L\0\0\0V\0B\0\0\0W\0S\0C\0\0\0\0\0"}, 260, ) , Partial, 260, ... TitleIdx=0, Type=7, Data= (156, "ExecutableTypes", Partial, 260, ... TitleIdx=0, Type=7, Data="A\0D\0E\0\0\0A\0D\0P\0\0\0B\0A\0S\0\0\0B\0A\0T\0\0\0C\0H\0M\0\0\0C\0M\0D\0\0\0C\0O\0M\0\0\0C\0P\0L\0\0\0C\0R\0T\0\0\0E\0X\0E\0\0\0H\0L\0P\0\0\0H\0T\0A\0\0\0I\0N\0F\0\0\0I\0N\0S\0\0\0I\0S\0P\0\0\0L\0N\0K\0\0\0M\0D\0B\0\0\0M\0D\0E\0\0\0M\0S\0C\0\0\0M\0S\0I\0\0\0M\0S\0P\0\0\0M\0S\0T\0\0\0O\0C\0X\0\0\0P\0C\0D\0\0\0P\0I\0F\0\0\0R\0E\0G\0\0\0S\0C\0R\0\0\0S\0H\0S\0\0\0U\0R\0L\0\0\0V\0B\0\0\0W\0S\0C\0\0\0\0\0"}, 260, ) }, 260, ) == 0x0
 01183   464   NtClose  (156, ... ) == 0x0
 01184   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01185   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01186   464   NtQueryValueKey  (156,  (156, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01187   464   NtClose  (156, ... ) == 0x0
 01188   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01189   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01190   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01191   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01192   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01193   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01194   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01195   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01196   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01197   464   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01198   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 156, ) }, ... 156, ) == 0x0
 01199   464   NtEnumerateKey  (156, 0, Basic, 280, ... {LastWrite={0x6f7a111e,0x1c73999}, TitleIdx=0, Name= (156, 0, Basic, 280, ... {LastWrite={0x6f7a111e,0x1c73999}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 01200   464   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 160, ) }, ... 160, ) == 0x0
 01201   464   NtQueryValueKey  (160,  (160, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (160, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 01202   464   NtQueryValueKey  (160,  (160, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (160, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01203   464   NtClose  (160, ... ) == 0x0
 01204   464   NtEnumerateKey  (156, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01205   464   NtClose  (156, ... ) == 0x0
 01206   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01207   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01208   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01209   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01210   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01211   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01213   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01214   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01215   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01216   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01217   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01219   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01220   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01221   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01222   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01223   464   NtClose  (156, ... ) == 0x0
 01224   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01225   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01226   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01227   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01228   464   NtClose  (156, ... ) == 0x0
 01229   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01230   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01231   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01232   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01233   464   NtClose  (156, ... ) == 0x0
 01234   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01235   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01236   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01237   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01238   464   NtClose  (156, ... ) == 0x0
 01239   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01240   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01241   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01242   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01243   464   NtClose  (156, ... ) == 0x0
 01244   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01245   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01246   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01247   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01248   464   NtClose  (156, ... ) == 0x0
 01249   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01250   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01251   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01252   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01253   464   NtClose  (156, ... ) == 0x0
 01254   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01255   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01256   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01257   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01258   464   NtClose  (156, ... ) == 0x0
 01259   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01260   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01261   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01262   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01263   464   NtClose  (156, ... ) == 0x0
 01264   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01265   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01266   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01267   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01268   464   NtClose  (156, ... ) == 0x0
 01269   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01270   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01271   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01272   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01273   464   NtClose  (156, ... ) == 0x0
 01274   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01275   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01276   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01277   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01278   464   NtClose  (156, ... ) == 0x0
 01279   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01280   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01281   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01282   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01283   464   NtClose  (156, ... ) == 0x0
 01284   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01285   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01286   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01287   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01288   464   NtClose  (156, ... ) == 0x0
 01289   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01290   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01291   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01292   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01293   464   NtClose  (156, ... ) == 0x0
 01294   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01295   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01296   464   NtQueryValueKey  (156,  (156, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (156, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (156, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 01297   464   NtClose  (156, ... ) == 0x0
 01298   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01299   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01300   464   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01301   464   NtClose  (156, ... ) == 0x0
 01302   464   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01303   464   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 01304   464   NtOpenProcessToken  (-1, 0xa, ... 156, ) == 0x0
 01305   464   NtDuplicateToken  (156, 0xc, {24, 0, 0x0, 0, 1240900, 0x0}, 0, 2, ... 160, ) == 0x0
 01306   464   NtClose  (156, ... ) == 0x0
 01307   464   NtAccessCheck  (1378928, 160, 0x1, 1241028, 1240972, 56, 1241056, ... (0x1), ) == 0x0
 01308   464   NtClose  (160, ... ) == 0x0
 01309   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 160, ) }, ... 160, ) == 0x0
 01310   464   NtQueryValueKey  (160,  (160, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (160, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01311   464   NtClose  (160, ... ) == 0x0
 01312   464   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 160, ) }, ... 160, ) == 0x0
 01313   464   NtQuerySymbolicLinkObject  (160, ...  (160, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 01314   464   NtClose  (160, ... ) == 0x0
 01315   464   NtQueryInformationFile  (100, 1239360, 528, Name, ... {status=0x0, info=62}, ) == 0x0
 01316   464   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01317   464   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01318   464   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wpeapid.exe"}, 1238040, ... ) }, 1238040, ... ) == 0x0
 01319   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01320   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1,  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01321   464   NtClose  (160, ... ) == 0x0
 01322   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01323   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1,  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01324   464   NtClose  (160, ... ) == 0x0
 01325   464   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01326   464   NtQueryDirectoryFile  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1,  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1, "wpeapid.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01327   464   NtClose  (160, ... ) == 0x0
 01328   464   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01329   464   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01330   464   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01331   464   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 160, ) == 0x0
 01332   464   NtQueryInformationToken  (160, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01333   464   NtClose  (160, ... ) == 0x0
 01334   464   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 160, ) }, ... 160, ) == 0x0
 01335   464   NtOpenKey  (0x20019, {24, 160, 0x40, 0, 0,  (0x20019, {24, 160, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 156, ) }, ... 156, ) == 0x0
 01336   464   NtClose  (160, ... ) == 0x0
 01337   464   NtQueryValueKey  (156,  (156, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01338   464   NtQueryValueKey  (156,  (156, "Cache", Partial, 162, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=1, Data= (156, "Cache", Partial, 162, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 162, ) }, 162, ) == 0x0
 01339   464   NtClose  (156, ... ) == 0x0
 01340   464   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 10485760, 4096, ) == 0x0
 01341   464   NtAllocateVirtualMemory  (-1, 10485760, 0, 4096, 4096, 4, ... 10485760, 4096, ) == 0x0
 01342   464   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01343   464   NtQueryValueKey  (156,  (156, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01344   464   NtClose  (156, ... ) == 0x0
 01345   464   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01346   464   NtQueryInformationToken  (152, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 01347   464   NtQueryInformationToken  (152, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 01348   464   NtClose  (152, ... ) == 0x0
 01349   464   NtCreateProcessEx  (1243636, 2035711, 0, -1, 0, 140, 0, 0, 0, ... ) == 0x0
 01350   464   NtQueryInformationProcess  (152, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=872,ParentPid=456,}, 0x0, ) == 0x0
 01351   464   NtReadVirtualMemory  (152, 0x7ffdf008, 4, ...  (152, 0x7ffdf008, 4, ... "\0\0B1", 0x0, ) , 0x0, ) == 0x0
 01352   464   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wpeapid.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01353   464   NtAllocateVirtualMemory  (-1, 1380352, 0, 8192, 4096, 4, ... 1380352, 8192, ) == 0x0
 01354   464   NtReadVirtualMemory  (152, 0x31420000, 4096, ...  (152, 0x31420000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 01355   464   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01356   464   NtQueryInformationProcess  (152, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=872,ParentPid=456,}, 0x0, ) == 0x0
 01357   464   NtAllocateVirtualMemory  (-1, 0, 0, 1660, 4096, 4, ... 10551296, 4096, ) == 0x0
 01358   464   NtAllocateVirtualMemory  (152, 0, 0, 1910, 4096, 4, ... 65536, 4096, ) == 0x0
 01359   464   NtWriteVirtualMemory  (152, 0x10000,  (152, 0x10000, "=\0:\0:\0=\0:\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0p\0o\0l\0y\0u\0n\0p\0a\0c\0k\0\0\0=\0E\0x\0i\0t\0C\0o\0d\0e\0=\00\00\00\00\00\00\00\02\0\0\0=\0U\0:\0=\0U\0:\0\\0s\0t\0a\0r\0t\0u\0p\0s\0c\0r\0i\0p\0t\0s\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0C\0L\0I\0E\0N\0T\0N\0A\0M\0E\0=\0C\0o\0n\0s\0o\0l\0e\0\0\0C\0o\0m\0m\0o\0n\0P\0r\0o\0g\0r\0a\0m\0F\0i\0l\0e\0s\0=\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0C\0O\0M\0", 1910, ... 0x0, ) , 1910, ... 0x0, ) == 0x0
 01360   464   NtAllocateVirtualMemory  (152, 0, 0, 1660, 4096, 4, ... 131072, 4096, ) == 0x0
 01361   464   NtWriteVirtualMemory  (152, 0x20000,  (152, 0x20000, "\0\20\0\0|\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0$\0\10\2\220\2\0\0\0\0\0\0\374\0\376\0\230\4\0\0>\0@\0\230\5\0\0>\0@\0\330\5\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0>\0@\0\30\6\0\0\36\0 \0X\6\0\0\0\0\2\0x\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1660, ... 0x0, ) , 1660, ... 0x0, ) == 0x0
 01362   464   NtWriteVirtualMemory  (152, 0x7ffdf010,  (152, 0x7ffdf010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01363   464   NtWriteVirtualMemory  (152, 0x7ffdf1e8,  (152, 0x7ffdf1e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01364   464   NtFreeVirtualMemory  (-1, (0xa10000), 0, 32768, ... (0xa10000), 4096, ) == 0x0
 01365   464   NtAllocateVirtualMemory  (152, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 01366   464   NtAllocateVirtualMemory  (152, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 01367   464   NtProtectVirtualMemory  (152, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 01368   464   NtCreateThread  (0x1f03ff, 0x0, 152, 1241900, 1242620, 1, ... 156, {872, 876}, ) == 0x0
 01369   464   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 1312824, 1310720, 1368240, 1243720}  (24, {168, 196, new_msg, 0, 1312824, 1310720, 1368240, 1243720} "\0\0\0\0\0\0\1\0\2$\370w U\367w\233\0\0\0\234\0\0\0h\3\0\0l\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\0\0\0\0" ... {168, 196, reply, 0, 456, 464, 1570, 0} "\0\0\0\0\0\0\1\0\0\0\0\0 U\367w\230\0\0\0\234\0\0\0h\3\0\0l\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\0\0\0\0" )  ... {168, 196, reply, 0, 456, 464, 1570, 0}  (24, {168, 196, new_msg, 0, 1312824, 1310720, 1368240, 1243720} "\0\0\0\0\0\0\1\0\2$\370w U\367w\233\0\0\0\234\0\0\0h\3\0\0l\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\0\0\0\0" ... {168, 196, reply, 0, 456, 464, 1570, 0} "\0\0\0\0\0\0\1\0\0\0\0\0 U\367w\230\0\0\0\234\0\0\0h\3\0\0l\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\0\0\0\0" )  ) == 0x0
 01370   464   NtResumeThread  (156, ... 1, ) == 0x0
 01371   464   NtClose  (100, ... ) == 0x0
 01372   464   NtClose  (140, ... ) == 0x0
 01373   464   NtQueryInformationProcess  (152, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=872,ParentPid=456,}, 0x0, ) == 0x0
 01374   464   NtUserWaitForInputIdle  (872, 30000, 0, ...
 01375   464   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 140, ) == 0x0
 01376   464   NtClose  (140, ... ) == 0x0
 01374   464   NtUserWaitForInputIdle  ... ) == 0x0
 01377   464   NtClose  (152, ... ) == 0x0
 01378   464   NtClose  (156, ... ) == 0x0
 01379   464   NtDelayExecution  (0, {-5000000, -1}, ... ) == 0x0
 01380   464   NtTerminateProcess  (0, 0, ... ) == 0x0
 01381   464   NtQueryVirtualMemory  (-1, 0x897664, Basic, 28, ... {BaseAddress=0x897000,AllocationBase=0x860000,AllocationProtect=0x80,RegionSize=0x12000,State=0x1000,Protect=0x4,Type=0x1000000,}, 28, ) == 0x0
 01382   464   NtQueryVirtualMemory  (-1, 0x897f70, Basic, 28, ... {BaseAddress=0x897000,AllocationBase=0x860000,AllocationProtect=0x80,RegionSize=0x12000,State=0x1000,Protect=0x4,Type=0x1000000,}, 28, ) == 0x0
 01383   464   NtQueryVirtualMemory  (-1, 0x86d838, Basic, 28, ... {BaseAddress=0x86d000,AllocationBase=0x860000,AllocationProtect=0x80,RegionSize=0x3c000,State=0x1000,Protect=0x4,Type=0x1000000,}, 28, ) == 0x0
 01384   464   NtGdiDeleteObjectApp  (252314718, ... ) == 0x1
 01385   464   NtGdiDeleteObjectApp  (168428639, ... ) == 0x1
 01386   464   NtGdiDeleteObjectApp  (185205856, ... ) == 0x1
 01387   464   NtUserDestroyCursor  (65729, 1, ... ) == 0x1
 01388   464   NtUserDestroyCursor  (65727, 1, ... ) == 0x1
 01389   464   NtUserDestroyCursor  (65725, 1, ... ) == 0x1
 01390   464   NtUserDestroyCursor  (65723, 1, ... ) == 0x1
 01391   464   NtUserDestroyCursor  (65721, 1, ... ) == 0x1
 01392   464   NtUserDestroyCursor  (65719, 1, ... ) == 0x1
 01393   464   NtUserDestroyCursor  (721045, 1, ... ) == 0x1
 01394   464   NtUserFindExistingCursorIcon  (1243472, 1243488, 1244056, ... ) == 0x10011
 01395   464   NtDeleteAtom  (49180, ... ) == 0x0
 01396   464   NtDeleteAtom  (49181, ... ) == 0x0
 01397   464   NtGdiDeleteObjectApp  (101188701, ... ) == 0x1
 01398   464   NtClose  (96, ... ) == 0x0
 01399   464   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 01400   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc03b
 01401   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01402   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc03d
 01403   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01404   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc03f
 01405   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01406   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc041
 01407   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01408   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc043
 01409   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01410   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc045
 01411   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01412   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc047
 01413   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01414   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc049
 01415   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01416   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc04b
 01417   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01418   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc04d
 01419   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01420   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc04f
 01421   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01422   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc051
 01423   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01424   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc053
 01425   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01426   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc057
 01427   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01428   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc059
 01429   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01430   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc05b
 01431   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01432   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc05d
 01433   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01434   464   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc05f
 01435   464   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01436   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc03b
 01437   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01438   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc03d
 01439   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01440   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc03f
 01441   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01442   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc041
 01443   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01444   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc043
 01445   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01446   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc045
 01447   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01448   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc047
 01449   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01450   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc049
 01451   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01452   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc04b
 01453   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01454   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc04d
 01455   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01456   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc04f
 01457   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01458   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc051
 01459   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01460   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc053
 01461   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01462   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc057
 01463   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01464   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc059
 01465   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01466   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc05b
 01467   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01468   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc05d
 01469   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01470   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc05f
 01471   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01472   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc017
 01473   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01474   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc019
 01475   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01476   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc018
 01477   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01478   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc01a
 01479   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01480   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc01c
 01481   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01482   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc01e
 01483   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01484   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc01b
 01485   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01486   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc068
 01487   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01488   464   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc06a
 01489   464   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01490   464   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 01491   464   NtClose  (76, ... ) == 0x0
 01492   464   NtClose  (64, ... ) == 0x0
 01493   464   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0
 01494   464   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x1,}, 4, ... ) == 0x0
 01495   464   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 01496   464   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 01497   464   NtFreeVirtualMemory  (-1, (0xa00000), 4096, 32768, ... (0xa00000), 4096, ) == 0x0
 01498   464   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 0, 0, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0@U\367w\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 456, 464, 3390, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 456, 464, 3390, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0@U\367w\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 456, 464, 3390, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01499   464   NtTerminateProcess  (-1, 0, ...
 01500   464   NtClose  (44, ... ) == 0x0