Summary:

NtAddAtom(>) 1 NtQueryInstallUILanguage(>) 1 NtAccessCheck(>) 3 NtQueryInformationToken(>) 11
NtCallbackReturn(>) 1 NtQueryObject(>) 1 NtFreeVirtualMemory(>) 3 NtUserSystemParametersInfo(>) 11
NtContinue(>) 1 NtQuerySymbolicLinkObject(>) 1 NtGdiCreateCompatibleDC(>) 3 NtOpenFile(>) 18
NtCreateEvent(>) 1 NtQueryVolumeInformationFile(>) 1 NtQuerySection(>) 3 NtOpenSection(>) 18
NtCreateFile(>) 1 NtRegisterThreadTerminatePort(>) 1 NtUserRegisterWindowMessage(>) 3 NtQuerySystemInformation(>) 22
NtCreateKey(>) 1 NtSecureConnectPort(>) 1 NtQueryDefaultLocale(>) 4 NtAllocateVirtualMemory(>) 25
NtCreateSemaphore(>) 1 NtSetInformationProcess(>) 1 NtGdiGetStockObject(>) 5 NtMapViewOfSection(>) 27
NtDuplicateObject(>) 1 NtSetValueKey(>) 1 NtOpenProcessToken(>) 5 NtQueryValueKey(>) 27
NtEnumerateValueKey(>) 1 NtTestAlert(>) 1 NtQueryVirtualMemory(>) 5 NtUserGetAtomName(>) 47
NtFsControlFile(>) 1 NtUserCallNoParam(>) 1 NtQueryInformationProcess(>) 7 NtUserUnregisterClass(>) 47
NtGdiCreateBitmap(>) 1 NtUserCallOneParam(>) 1 NtSetInformationThread(>) 7 NtUserFindExistingCursorIcon(>) 50
NtGdiInit(>) 1 NtUserGetDC(>) 1 NtOpenProcessTokenEx(>) 8 NtOpenKey(>) 59
NtGdiQueryFontAssocInfo(>) 1 NtUserGetThreadDesktop(>) 1 NtOpenThreadTokenEx(>) 8 NtUserRegisterClassExWOW(>) 61
NtGdiSelectBitmap(>) 1 NtDeviceIoControlFile(>) 2 NtQueryDefaultUILanguage(>) 8 NtFlushInstructionCache(>) 62
NtOpenEvent(>) 1 NtGdiCreateSolidBrush(>) 2 NtRequestWaitReplyPort(>) 8 NtClose(>) 86
NtOpenKeyedEvent(>) 1 NtOpenDirectoryObject(>) 2 NtQueryDebugFilterState(>) 9 NtProtectVirtualMemory(>) 124
NtOpenProcess(>) 1 NtSetInformationObject(>) 2 NtQueryAttributesFile(>) 10
NtOpenSymbolicLinkObject(>) 1 NtTerminateProcess(>) 2 NtUnmapViewOfSection(>) 10
NtQueryInformationFile(>) 1

Trace:

00001 1736 NtOpenFile (0x80100000, {24, 0, 0x240, 0, 0, (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00002 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00003 1736 NtOpenKeyedEvent (0x2000000, {24, 0, 0x0, 0, 0, (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0 00004 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00005 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0 00006 1736 NtAllocateVirtualMemory (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0 00007 1736 NtAllocateVirtualMemory (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0 00008 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00009 1736 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0 00010 1736 NtAllocateVirtualMemory (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0 00011 1736 NtOpenDirectoryObject (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0 00012 1736 NtOpenSymbolicLinkObject (0x1, {24, 8, 0x40, 0, 0, (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0 00013 1736 NtQuerySymbolicLinkObject (12, ... (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0 00014 1736 NtClose (12, ... ) == 0x0 00015 1736 NtOpenFile (0x100020, {24, 0, 0x42, 0, 0, (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0 00016 1736 NtQueryVolumeInformationFile (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00017 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00018 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00019 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0 00020 1736 NtClose (16, ... ) == 0x0 00021 1736 NtProtectVirtualMemory (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0 00022 1736 NtProtectVirtualMemory (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0 00023 1736 NtFlushInstructionCache (-1, 2088767488, 1568, ... ) == 0x0 00024 1736 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00025 1736 NtQuerySystemInformation (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0 00026 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00027 1736 NtCreateSection (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0 00028 1736 NtSecureConnectPort ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 19136512}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 19136512}, {0, 0, 0}, 200, 44, ) == 0x0 00029 1736 NtClose (16, ... ) == 0x0 00030 1736 NtQueryObject (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0 00031 1736 NtSetInformationObject (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0 00032 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00033 1736 NtQueryVirtualMemory (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0 00034 1736 NtAllocateVirtualMemory (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0 00035 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6$\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75481, 0} "\330<\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75481, 0} (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6$\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75481, 0} "\330<\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" ) ) == 0x0 00036 1736 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00037 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00038 1736 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00039 1736 NtClose (16, ... ) == 0x0 00040 1736 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0 00041 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0 00042 1736 NtClose (16, ... ) == 0x0 00043 1736 NtQueryDefaultLocale (0, 2089305000, ... ) == 0x0 00044 1736 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0 00045 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0 00046 1736 NtClose (16, ... ) == 0x0 00047 1736 NtOpenSection (0x5, {24, 0, 0x40, 0, 0, (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0 00048 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0 00049 1736 NtQuerySection (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0 00050 1736 NtClose (16, ... ) == 0x0 00051 1736 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0 00052 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0 00053 1736 NtClose (16, ... ) == 0x0 00054 1736 NtQueryVirtualMemory (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00055 1736 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00056 1736 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00057 1736 NtAllocateVirtualMemory (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0 00058 1736 NtRequestWaitReplyPort (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6$\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" ... {24, 52, reply, 0, 1636, 1736, 75482, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" ) ... {24, 52, reply, 0, 1636, 1736, 75482, 0} (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6$\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" ... {24, 52, reply, 0, 1636, 1736, 75482, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" ) ) == 0x0 00059 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6$\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75483, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75483, 0} (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6$\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75483, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" ) ) == 0x0 00060 1736 NtProtectVirtualMemory (-1, (0x407000), 1514, 4, ... (0x407000), 4096, 8, ) == 0x0 00061 1736 NtProtectVirtualMemory (-1, (0x407000), 4096, 8, ... (0x407000), 4096, 4, ) == 0x0 00062 1736 NtFlushInstructionCache (-1, 4222976, 1514, ... ) == 0x0 00063 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00064 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0 00065 1736 NtClose (16, ... ) == 0x0 00066 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00067 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0 00068 1736 NtClose (16, ... ) == 0x0 00069 1736 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00070 1736 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00071 1736 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00072 1736 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00073 1736 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00074 1736 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00075 1736 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00076 1736 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00077 1736 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00078 1736 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00079 1736 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00080 1736 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00081 1736 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00082 1736 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00083 1736 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00084 1736 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00085 1736 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00086 1736 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00087 1736 NtProtectVirtualMemory (-1, (0x407000), 1514, 4, ... (0x407000), 4096, 4, ) == 0x0 00088 1736 NtProtectVirtualMemory (-1, (0x407000), 4096, 4, ... (0x407000), 4096, 4, ) == 0x0 00089 1736 NtFlushInstructionCache (-1, 4222976, 1514, ... ) == 0x0 00090 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00091 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0 00092 1736 NtClose (16, ... ) == 0x0 00093 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00094 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0 00095 1736 NtClose (16, ... ) == 0x0 00096 1736 NtProtectVirtualMemory (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0 00097 1736 NtProtectVirtualMemory (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0 00098 1736 NtFlushInstructionCache (-1, 2010976256, 1700, ... ) == 0x0 00099 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0 00100 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0 00101 1736 NtClose (16, ... ) == 0x0 00102 1736 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00103 1736 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00104 1736 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00105 1736 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00106 1736 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00107 1736 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00108 1736 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00109 1736 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00110 1736 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00111 1736 NtProtectVirtualMemory (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0 00112 1736 NtProtectVirtualMemory (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0 00113 1736 NtFlushInstructionCache (-1, 2010976256, 1700, ... ) == 0x0 00114 1736 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00115 1736 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00116 1736 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00117 1736 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00118 1736 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00119 1736 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00120 1736 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00121 1736 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00122 1736 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00123 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 16, ) }, ... 16, ) == 0x0 00124 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0 00125 1736 NtClose (16, ... ) == 0x0 00126 1736 NtProtectVirtualMemory (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0 00127 1736 NtProtectVirtualMemory (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0 00128 1736 NtFlushInstructionCache (-1, 2009141248, 632, ... ) == 0x0 00129 1736 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00130 1736 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00131 1736 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00132 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00133 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0 00134 1736 NtClose (16, ... ) == 0x0 00135 1736 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00136 1736 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00137 1736 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00138 1736 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00139 1736 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00140 1736 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00141 1736 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00142 1736 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00143 1736 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00144 1736 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00145 1736 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00146 1736 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00147 1736 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00148 1736 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00149 1736 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00150 1736 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00151 1736 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00152 1736 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00153 1736 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00154 1736 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00155 1736 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00156 1736 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00157 1736 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00158 1736 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00159 1736 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00160 1736 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00161 1736 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00162 1736 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00163 1736 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00164 1736 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00165 1736 NtProtectVirtualMemory (-1, (0x407000), 1514, 4, ... (0x407000), 4096, 4, ) == 0x0 00166 1736 NtProtectVirtualMemory (-1, (0x407000), 4096, 4, ... (0x407000), 4096, 4, ) == 0x0 00167 1736 NtFlushInstructionCache (-1, 4222976, 1514, ... ) == 0x0 00168 1736 NtProtectVirtualMemory (-1, (0x407000), 1514, 4, ... (0x407000), 4096, 4, ) == 0x0 00169 1736 NtProtectVirtualMemory (-1, (0x407000), 4096, 4, ... (0x407000), 4096, 4, ) == 0x0 00170 1736 NtFlushInstructionCache (-1, 4222976, 1514, ... ) == 0x0 00171 1736 NtProtectVirtualMemory (-1, (0x407000), 1514, 4, ... (0x407000), 4096, 4, ) == 0x0 00172 1736 NtProtectVirtualMemory (-1, (0x407000), 4096, 4, ... (0x407000), 4096, 4, ) == 0x0 00173 1736 NtFlushInstructionCache (-1, 4222976, 1514, ... ) == 0x0 00174 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00175 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c9c0000), 0x0, 8482816, ) == 0x0 00176 1736 NtClose (16, ... ) == 0x0 00177 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0 00178 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0 00179 1736 NtFlushInstructionCache (-1, 2090602496, 4476, ... ) == 0x0 00180 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0 00181 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0 00182 1736 NtFlushInstructionCache (-1, 2090602496, 4476, ... ) == 0x0 00183 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0 00184 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0 00185 1736 NtFlushInstructionCache (-1, 2090602496, 4476, ... ) == 0x0 00186 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0 00187 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0 00188 1736 NtFlushInstructionCache (-1, 2090602496, 4476, ... ) == 0x0 00189 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0 00190 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0 00191 1736 NtFlushInstructionCache (-1, 2090602496, 4476, ... ) == 0x0 00192 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0 00193 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0 00194 1736 NtFlushInstructionCache (-1, 2090602496, 4476, ... ) == 0x0 00195 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 16, ) }, ... 16, ) == 0x0 00196 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0 00197 1736 NtClose (16, ... ) == 0x0 00198 1736 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 00199 1736 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 00200 1736 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 00201 1736 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 00202 1736 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 00203 1736 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 00204 1736 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 00205 1736 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 00206 1736 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 00207 1736 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 00208 1736 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 00209 1736 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 00210 1736 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 00211 1736 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 00212 1736 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 00213 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0 00214 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0 00215 1736 NtFlushInstructionCache (-1, 2090602496, 4476, ... ) == 0x0 00216 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0 00217 1736 NtProtectVirtualMemory (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0 00218 1736 NtFlushInstructionCache (-1, 2090602496, 4476, ... ) == 0x0 00219 1736 NtProtectVirtualMemory (-1, (0x407000), 1514, 4, ... (0x407000), 4096, 4, ) == 0x0 00220 1736 NtProtectVirtualMemory (-1, (0x407000), 4096, 4, ... (0x407000), 4096, 4, ) == 0x0 00221 1736 NtFlushInstructionCache (-1, 4222976, 1514, ... ) == 0x0 00222 1736 NtProtectVirtualMemory (-1, (0x407000), 1514, 4, ... (0x407000), 4096, 4, ) == 0x0 00223 1736 NtProtectVirtualMemory (-1, (0x407000), 4096, 4, ... (0x407000), 4096, 4, ) == 0x0 00224 1736 NtFlushInstructionCache (-1, 4222976, 1514, ... ) == 0x0 00225 1736 NtQueryInformationProcess (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0 00226 1736 NtSetInformationProcess (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0 00227 1736 NtOpenProcessToken (-1, 0x8, ... 16, ) == 0x0 00228 1736 NtQueryInformationToken (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00229 1736 NtClose (16, ... ) == 0x0 00230 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00231 1736 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00232 1736 NtClose (16, ... ) == 0x0 00233 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00234 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00235 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00236 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242028} (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242028} "\210\6$\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6$\1$\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75484, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6$\1$\1\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75484, 0} (24, {28, 56, new_msg, 0, 1242016, 2090320424, 1242052, 1242028} "\210\6$\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6$\1$\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75484, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6$\1$\1\0\0" ) ) == 0x0 00237 1736 NtFsControlFile (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0 00238 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0 00239 1736 NtQueryValueKey (16, (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00240 1736 NtClose (16, ... ) == 0x0 00241 1736 NtAllocateVirtualMemory (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0 00242 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0 00243 1736 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0 00244 1736 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 16, ... 28, ) == 0x0 00245 1736 NtClose (16, ... ) == 0x0 00246 1736 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x440000), 0x0, 110592, ) == 0x0 00247 1736 NtClose (28, ... ) == 0x0 00248 1736 NtUnmapViewOfSection (-1, 0x440000, ... ) == 0x0 00249 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0 00250 1736 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00251 1736 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 28, ... 16, ) == 0x0 00252 1736 NtClose (28, ... ) == 0x0 00253 1736 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x440000), 0x0, 110592, ) == 0x0 00254 1736 NtClose (16, ... ) == 0x0 00255 1736 NtUnmapViewOfSection (-1, 0x440000, ... ) == 0x0 00256 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0 00257 1736 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0 00258 1736 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0 00259 1736 NtQuerySection (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00260 1736 NtOpenProcessToken (-1, 0x8, ... 32, ) == 0x0 00261 1736 NtQueryInformationToken (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 00262 1736 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00263 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0 00264 1736 NtQueryValueKey (36, (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00265 1736 NtClose (36, ... ) == 0x0 00266 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00267 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 36, ) == 0x0 00268 1736 NtQueryInformationToken (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00269 1736 NtClose (36, ... ) == 0x0 00270 1736 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00271 1736 NtClose (32, ... ) == 0x0 00272 1736 NtClose (16, ... ) == 0x0 00273 1736 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0 00274 1736 NtClose (28, ... ) == 0x0 00275 1736 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00276 1736 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00277 1736 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00278 1736 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00279 1736 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00280 1736 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00281 1736 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00282 1736 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00283 1736 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00284 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00285 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00286 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0 00287 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00288 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00289 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00290 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00291 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00292 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00293 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oleaut32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00294 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00295 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shell32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00296 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0 00297 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00298 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 28, ) }, ... 28, ) == 0x0 00299 1736 NtQueryValueKey (28, (28, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00300 1736 NtClose (28, ... ) == 0x0 00301 1736 NtMapViewOfSection (-2147481380, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x440000), 0x0, 1060864, ) == 0x0 00302 1736 NtClose (-2147481380, ... ) == 0x0 00303 1736 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 28, ) == 0x0 00304 1736 NtOpenThreadTokenEx (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN 00305 1736 NtOpenProcessTokenEx (-1, 0x8, 512, ... -2147481380, ) == 0x0 00306 1736 NtQueryInformationToken (-2147481380, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL 00307 1736 NtQueryInformationToken (-2147481380, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00308 1736 NtClose (-2147481380, ... ) == 0x0 00309 1736 NtAllocateVirtualMemory (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0 00310 1736 NtFreeVirtualMemory (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0 00311 1736 NtDuplicateObject (-1, 16, -1, 0x0, 0, 2, ... 36, ) == 0x0 00312 1736 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0 00313 1736 NtQueryValueKey (-2147481380, (-2147481380, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00314 1736 NtClose (-2147481380, ... ) == 0x0 00315 1736 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0 00316 1736 NtQueryValueKey (-2147481380, (-2147481380, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00317 1736 NtClose (-2147481380, ... ) == 0x0 00318 1736 NtQueryDefaultLocale (0, -139347636, ... ) == 0x0 00319 1736 NtGdiQueryFontAssocInfo (0, ... ) == 0x0 00320 1736 NtUserCallNoParam (24, ... ) == 0x0 00321 1736 NtGdiCreateCompatibleDC (0, ... 00322 1736 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0 00321 1736 NtGdiCreateCompatibleDC ... ) == 0xf2010663 00323 1736 NtGdiGetStockObject (0, ... ) == 0x1900010 00324 1736 NtGdiGetStockObject (4, ... ) == 0x1900011 00325 1736 NtGdiCreateBitmap (8, 8, 1, 1, 2118200212, ... ) == 0xfd0505f7 00326 1736 NtGdiCreateSolidBrush (0, 0, ... 00327 1736 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 8716288, 4096, ) == 0x0 00326 1736 NtGdiCreateSolidBrush ... ) == 0x4210057d 00328 1736 NtGdiGetStockObject (13, ... ) == 0x18a0021 00329 1736 NtGdiCreateCompatibleDC (0, ... ) == 0x69010363 00330 1736 NtGdiSelectBitmap (1761674083, -50002441, ... ) == 0x185000f 00331 1736 NtUserGetThreadDesktop (1736, 0, ... ) == 0x20 00332 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 40, ) }, ... 40, ) == 0x0 00333 1736 NtQueryValueKey (40, (40, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (40, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 00334 1736 NtClose (40, ... ) == 0x0 00335 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00336 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x8173c017 00337 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00338 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x8173c01c 00339 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00340 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x8173c01e 00341 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00342 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x81738002 00343 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10013 00344 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x8173c018 00345 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00346 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x8173c01a 00347 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00348 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x8173c01d 00349 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00350 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x8173c026 00351 1736 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00352 1736 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x8173c019 00353 1736 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8173c020 00354 1736 NtUserRegisterClassExWOW (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8173c022 00355 1736 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8173c023 00356 1736 NtUserRegisterClassExWOW (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8173c024 00357 1736 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8173c025 00358 1736 NtCallbackReturn (0, 0, 0, ... 00359 1736 NtGdiInit (... ) == 0x1 00360 1736 NtGdiGetStockObject (18, ... ) == 0x290001c 00361 1736 NtGdiGetStockObject (19, ... ) == 0x1b00019 00362 1736 NtAllocateVirtualMemory (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0 00363 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 40, ) }, ... 40, ) == 0x0 00364 1736 NtQueryValueKey (40, (40, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (40, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00365 1736 NtQueryValueKey (40, (40, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (40, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00366 1736 NtClose (40, ... ) == 0x0 00367 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 40, ) }, ... 40, ) == 0x0 00368 1736 NtQueryValueKey (40, (40, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00369 1736 NtClose (40, ... ) == 0x0 00370 1736 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 40, ) }, ... 40, ) == 0x0 00371 1736 NtSetInformationObject (40, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0 00372 1736 NtOpenKey (0x20019, {24, 40, 0x40, 0, 0, (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00373 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00374 1736 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 8781824, 65536, ) == 0x0 00375 1736 NtAllocateVirtualMemory (-1, 8781824, 0, 4096, 4096, 4, ... 8781824, 4096, ) == 0x0 00376 1736 NtAllocateVirtualMemory (-1, 8785920, 0, 8192, 4096, 4, ... 8785920, 8192, ) == 0x0 00377 1736 NtAllocateVirtualMemory (-1, 8794112, 0, 4096, 4096, 4, ... 8794112, 4096, ) == 0x0 00378 1736 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0 00379 1736 NtMapViewOfSection (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x870000), 0x0, 12288, ) == 0x0 00380 1736 NtClose (44, ... ) == 0x0 00381 1736 NtAllocateVirtualMemory (-1, 8798208, 0, 4096, 4096, 4, ... 8798208, 4096, ) == 0x0 00382 1736 NtQueryVirtualMemory (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 00383 1736 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00384 1736 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00385 1736 NtQueryVirtualMemory (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0 00386 1736 NtAllocateVirtualMemory (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0 00387 1736 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 44, {status=0x0, info=0}, ) }, 7, 16, ... 44, {status=0x0, info=0}, ) == 0x0 00388 1736 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\374Q\221w\312e\230C\215\210\224\206\23\265\302n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 00389 1736 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 00390 1736 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 00391 1736 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 00392 1736 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 00393 1736 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 00394 1736 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 00395 1736 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 00396 1736 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481380, 2, ) }, 0, 0x0, 0, ... -2147481380, 2, ) == 0x0 00397 1736 NtSetValueKey (-2147481380, (-2147481380, "Seed", 0, 3, "I\353{\243\370\375\232\322f}\266\357\2659\334\355\336\217.\255iC:_T\202\3351\15\241*\23L\217@\230\264\2\352ls\305_^\313\322I\233\304\32\375\230\260\33a\23Q\371\242\227\246i\314@\271\267\243\273\306\26\374n,\36\220\13\357O=", 80, ... ) , 0, 3, (-2147481380, "Seed", 0, 3, "I\353{\243\370\375\232\322f}\266\357\2659\334\355\336\217.\255iC:_T\202\3351\15\241*\23L\217@\230\264\2\352ls\305_^\313\322I\233\304\32\375\230\260\33a\23Q\371\242\227\246i\314@\271\267\243\273\306\26\374n,\36\220\13\357O=", 80, ... ) , 80, ... ) == 0x0 00398 1736 NtClose (-2147481380, ... ) == 0x0 00388 1736 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "7\336\21\207\350\317\331\3647o;\212RnC\361\265\6\236\3\\17\361\377\372\35\350\267A\367vqj\35\353\201G\376\366C\274\35N\12T_5?\300\272\6\356*\5\204.\215\300\332\265\251\246\210\221y\306\211\334\0\20\7\21\332\312\353\256\313\33\247", ) , ) == 0x0 00399 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00400 1736 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00401 1736 NtOpenKey (0x20019, {24, 40, 0x40, 0, 0, (0x20019, {24, 40, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 48, ) }, ... 48, ) == 0x0 00402 1736 NtQueryValueKey (48, (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0 00403 1736 NtClose (48, ... ) == 0x0 00404 1736 NtOpenKey (0x20019, {24, 40, 0x40, 0, 0, (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 48, ) }, ... 48, ) == 0x0 00405 1736 NtQueryValueKey (48, (48, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00406 1736 NtClose (48, ... ) == 0x0 00407 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00408 1736 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00409 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00410 1736 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00411 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 48, ) }, ... 48, ) == 0x0 00412 1736 NtQueryValueKey (48, (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00413 1736 NtQueryValueKey (48, (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00414 1736 NtQueryValueKey (48, (48, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00415 1736 NtClose (48, ... ) == 0x0 00416 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 48, ) }, ... 48, ) == 0x0 00417 1736 NtQueryValueKey (48, (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00418 1736 NtQueryValueKey (48, (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00419 1736 NtClose (48, ... ) == 0x0 00420 1736 NtOpenDirectoryObject (0x2000f, {24, 0, 0x40, 0, 0, (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 48, ) }, ... 48, ) == 0x0 00421 1736 NtOpenEvent (0x1f0003, {24, 48, 0x0, 0, 0, (0x1f0003, {24, 48, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00422 1736 NtUserRegisterWindowMessage ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077 00423 1736 NtOpenKey (0x1, {24, 40, 0x40, 0, 0, (0x1, {24, 40, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00424 1736 NtOpenKey (0x9, {24, 40, 0x40, 0, 0, (0x9, {24, 40, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00425 1736 NtOpenKey (0x1, {24, 40, 0x40, 0, 0, (0x1, {24, 40, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00426 1736 NtOpenKey (0x2000000, {24, 40, 0x40, 0, 0, (0x2000000, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00427 1736 NtCreateSemaphore (0x1f0003, {24, 48, 0x80, 1333768, 0, (0x1f0003, {24, 48, 0x80, 1333768, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 52, ) }, 0, 2147483647, ... 52, ) == STATUS_OBJECT_NAME_EXISTS 00428 1736 NtOpenKey (0x1, {24, 40, 0x40, 0, 0, (0x1, {24, 40, 0x40, 0, 0, "SYSTEM\Setup"}, ... 56, ) }, ... 56, ) == 0x0 00429 1736 NtQueryValueKey (56, (56, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (56, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00430 1736 NtClose (56, ... ) == 0x0 00431 1736 NtQueryDefaultUILanguage (1241692, ... 00432 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00433 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147481380, ) == 0x0 00434 1736 NtQueryInformationToken (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00435 1736 NtClose (-2147481380, ... ) == 0x0 00436 1736 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0 00437 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x240, 0, 0, (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00438 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x640, 0, 0, (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0 00439 1736 NtQueryValueKey (-2147481388, (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00440 1736 NtClose (-2147481388, ... ) == 0x0 00441 1736 NtClose (-2147481380, ... ) == 0x0 00431 1736 NtQueryDefaultUILanguage ... ) == 0x0 00442 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 56, {status=0x0, info=1}, ) }, 1, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00443 1736 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 56, ... 60, ) == 0x0 00444 1736 NtMapViewOfSection (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x880000), 0x0, 8462336, ) == 0x0 00445 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00446 1736 NtQueryDefaultUILanguage (2090319928, ... 00447 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00448 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147481380, ) == 0x0 00449 1736 NtQueryInformationToken (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00450 1736 NtClose (-2147481380, ... ) == 0x0 00451 1736 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0 00452 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x240, 0, 0, (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00453 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x640, 0, 0, (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0 00454 1736 NtQueryValueKey (-2147481388, (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00455 1736 NtClose (-2147481388, ... ) == 0x0 00456 1736 NtClose (-2147481380, ... ) == 0x0 00446 1736 NtQueryDefaultUILanguage ... ) == 0x0 00457 1736 NtQueryInstallUILanguage (2090319930, ... ) == 0x0 00458 1736 NtQueryDefaultLocale (1, 1239788, ... ) == 0x0 00459 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00460 1736 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 2088850039, 1240824, 1179817, 1240548} (24, {128, 156, new_msg, 0, 2088850039, 1240824, 1179817, 1240548} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6$\18\0\0\0\377\377\377\377\0\0\0\0@ \253\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6$\1\0\0\0\0\0\0\0\0\354\362\22\0\0\0\0\0" ... {128, 156, reply, 0, 1636, 1736, 75494, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6$\18\0\0\0\377\377\377\377\0\0\0\0@ \253\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6$\1\0\0\0\0\0\0\0\0\354\362\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 1636, 1736, 75494, 0} (24, {128, 156, new_msg, 0, 2088850039, 1240824, 1179817, 1240548} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6$\18\0\0\0\377\377\377\377\0\0\0\0@ \253\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6$\1\0\0\0\0\0\0\0\0\354\362\22\0\0\0\0\0" ... {128, 156, reply, 0, 1636, 1736, 75494, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6$\18\0\0\0\377\377\377\377\0\0\0\0@ \253\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6$\1\0\0\0\0\0\0\0\0\354\362\22\0\0\0\0\0" ) ) == 0x0 00461 1736 NtClose (56, ... ) == 0x0 00462 1736 NtClose (60, ... ) == 0x0 00463 1736 NtUnmapViewOfSection (-1, 0x880000, ... ) == 0x0 00464 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00465 1736 NtAllocateVirtualMemory (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0 00466 1736 NtOpenKey (0x8, {24, 0, 0x40, 0, 0, (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00467 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00468 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00469 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238980, ... ) }, 1238980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00470 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00471 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00472 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00473 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1239044, ... ) }, 1239044, ... ) == 0x0 00474 1736 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 60, {status=0x0, info=1}, ) }, 3, 33, ... 60, {status=0x0, info=1}, ) == 0x0 00475 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00476 1736 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00477 1736 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 56, ... 64, ) == 0x0 00478 1736 NtClose (56, ... ) == 0x0 00479 1736 NtMapViewOfSection (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x880000), 0x0, 1056768, ) == 0x0 00480 1736 NtClose (64, ... ) == 0x0 00481 1736 NtUnmapViewOfSection (-1, 0x880000, ... ) == 0x0 00482 1736 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0 00483 1736 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 64, ... 56, ) == 0x0 00484 1736 NtQuerySection (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00485 1736 NtClose (64, ... ) == 0x0 00486 1736 NtMapViewOfSection (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0 00487 1736 NtClose (56, ... ) == 0x0 00488 1736 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0 00489 1736 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0 00490 1736 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0 00491 1736 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0 00492 1736 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0 00493 1736 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0 00494 1736 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0 00495 1736 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0 00496 1736 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0 00497 1736 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0 00498 1736 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0 00499 1736 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0 00500 1736 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0 00501 1736 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0 00502 1736 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0 00503 1736 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0 00504 1736 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0 00505 1736 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0 00506 1736 NtProtectVirtualMemory (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0 00507 1736 NtProtectVirtualMemory (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0 00508 1736 NtFlushInstructionCache (-1, 2000490496, 1924, ... ) == 0x0 00509 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00510 1736 NtAddAtom ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240524, ... ) , 42, 1240524, ... ) == 0x0 00511 1736 NtQueryDefaultUILanguage (1239208, ... 00512 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00513 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147481380, ) == 0x0 00514 1736 NtQueryInformationToken (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00515 1736 NtClose (-2147481380, ... ) == 0x0 00516 1736 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0 00517 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x240, 0, 0, (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00518 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x640, 0, 0, (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0 00519 1736 NtQueryValueKey (-2147481388, (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00520 1736 NtClose (-2147481388, ... ) == 0x0 00521 1736 NtClose (-2147481380, ... ) == 0x0 00511 1736 NtQueryDefaultUILanguage ... ) == 0x0 00522 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238048, ... ) }, 1238048, ... ) == 0x0 00523 1736 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00524 1736 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 56, ... 64, ) == 0x0 00525 1736 NtClose (56, ... ) == 0x0 00526 1736 NtMapViewOfSection (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x880000), 0x0, 4096, ) == 0x0 00527 1736 NtClose (64, ... ) == 0x0 00528 1736 NtUnmapViewOfSection (-1, 0x880000, ... ) == 0x0 00529 1736 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237644, ... ) }, 1237644, ... ) == 0x0 00530 1736 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238388, (0x80100080, {24, 0, 0x40, 0, 1238388, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 64, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 64, {status=0x0, info=1}, ) == 0x0 00531 1736 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 64, ... 56, ) == 0x0 00532 1736 NtClose (64, ... ) == 0x0 00533 1736 NtMapViewOfSection (56, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x880000), {0, 0}, 4096, ) == 0x0 00534 1736 NtClose (56, ... ) == 0x0 00535 1736 NtUnmapViewOfSection (-1, 0x880000, ... ) == 0x0 00536 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 56, {status=0x0, info=1}, ) }, 1, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00537 1736 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 56, ... 64, ) == 0x0 00538 1736 NtMapViewOfSection (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x880000), 0x0, 4096, ) == 0x0 00539 1736 NtQueryInformationFile (56, 1238040, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 00540 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00541 1736 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064} (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6$\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6$\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 1636, 1736, 75495, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6$\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6$\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 1636, 1736, 75495, 0} (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6$\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6$\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 1636, 1736, 75495, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6$\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6$\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" ) ) == 0x0 00542 1736 NtClose (56, ... ) == 0x0 00543 1736 NtClose (64, ... ) == 0x0 00544 1736 NtUnmapViewOfSection (-1, 0x880000, ... ) == 0x0 00545 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00546 1736 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a 00547 1736 NtUserSystemParametersInfo (104, 0, 2001084812, 0, ... ) == 0x1 00548 1736 NtUserGetDC (0, ... ) == 0x1010054 00549 1736 NtUserCallOneParam (16842836, 57, ... ) == 0x1 00550 1736 NtUserSystemParametersInfo (38, 4, 2001086940, 0, ... ) == 0x1 00551 1736 NtUserSystemParametersInfo (66, 12, 1240040, 0, ... ) == 0x1 00552 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00553 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 64, ) == 0x0 00554 1736 NtQueryInformationToken (64, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00555 1736 NtClose (64, ... ) == 0x0 00556 1736 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 64, ) }, ... 64, ) == 0x0 00557 1736 NtOpenProcessToken (-1, 0x8, ... 56, ) == 0x0 00558 1736 NtAccessCheck (1332888, 56, 0x1, 1239872, 1239924, 56, 1239904, ... ) == STATUS_NO_IMPERSONATION_TOKEN 00559 1736 NtClose (56, ... ) == 0x0 00560 1736 NtOpenKey (0x20019, {24, 64, 0x40, 0, 0, (0x20019, {24, 64, 0x40, 0, 0, "Control Panel\Desktop"}, ... 56, ) }, ... 56, ) == 0x0 00561 1736 NtQueryValueKey (56, (56, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00562 1736 NtClose (56, ... ) == 0x0 00563 1736 NtUserSystemParametersInfo (41, 500, 1240068, 0, ... ) == 0x1 00564 1736 NtOpenProcessToken (-1, 0x8, ... 56, ) == 0x0 00565 1736 NtAccessCheck (1332888, 56, 0x1, 1239872, 1239924, 56, 1239904, ... ) == STATUS_NO_IMPERSONATION_TOKEN 00566 1736 NtClose (56, ... ) == 0x0 00567 1736 NtOpenKey (0x20019, {24, 64, 0x40, 0, 0, (0x20019, {24, 64, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 56, ) }, ... 56, ) == 0x0 00568 1736 NtQueryValueKey (56, (56, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00569 1736 NtClose (56, ... ) == 0x0 00570 1736 NtUserSystemParametersInfo (27, 0, 2001085788, 0, ... ) == 0x1 00571 1736 NtUserSystemParametersInfo (102, 0, 2001086828, 0, ... ) == 0x1 00572 1736 NtClose (64, ... ) == 0x0 00573 1736 NtUserSystemParametersInfo (4130, 0, 1240572, 0, ... ) == 0x1 00574 1736 NtOpenKey (0x1, {24, 40, 0x40, 0, 0, (0x1, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 64, ) }, ... 64, ) == 0x0 00575 1736 NtEnumerateValueKey (64, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES 00576 1736 NtClose (64, ... ) == 0x0 00577 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00578 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c03b 00579 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c03d 00580 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00581 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c03f 00582 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00583 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c041 00584 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00585 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c043 00586 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c045 00587 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00588 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c047 00589 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00590 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c049 00591 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00592 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c04b 00593 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00594 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c04d 00595 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00596 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c04f 00597 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c051 00598 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00599 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c053 00600 1736 NtUserFindExistingCursorIcon (1239816, 1239832, 1239880, ... ) == 0x10011 00601 1736 NtUserRegisterClassExWOW (1239760, 1239828, 1239844, 1239860, 0, 384, 0, ... ) == 0x8173c055 00602 1736 NtUserFindExistingCursorIcon (1239816, 1239832, 1239880, ... ) == 0x10011 00603 1736 NtUserRegisterClassExWOW (1239760, 1239828, 1239844, 1239860, 0, 384, 0, ... ) == 0x8173c057 00604 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00605 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c059 00606 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10013 00607 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c05b 00608 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00609 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c05d 00610 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00611 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c05f 00612 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00613 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c017 00614 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00615 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c019 00616 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10013 00617 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c018 00618 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00619 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c01a 00620 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00621 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c01c 00622 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00623 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c01e 00624 1736 NtUserFindExistingCursorIcon (1239812, 1239828, 1239876, ... ) == 0x10011 00625 1736 NtUserRegisterClassExWOW (1239812, 1239880, 1239896, 1239912, 0, 384, 0, ... ) == 0x8173c01b 00626 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00627 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c068 00628 1736 NtUserFindExistingCursorIcon (1239820, 1239836, 1239884, ... ) == 0x10011 00629 1736 NtUserRegisterClassExWOW (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x8173c06a 00630 1736 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 64, ) }, ... 64, ) == 0x0 00631 1736 NtMapViewOfSection (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0 00632 1736 NtClose (64, ... ) == 0x0 00633 1736 NtProtectVirtualMemory (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0 00634 1736 NtProtectVirtualMemory (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0 00635 1736 NtFlushInstructionCache (-1, 1560875008, 1656, ... ) == 0x0 00636 1736 NtProtectVirtualMemory (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0 00637 1736 NtProtectVirtualMemory (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0 00638 1736 NtFlushInstructionCache (-1, 1560875008, 1656, ... ) == 0x0 00639 1736 NtProtectVirtualMemory (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0 00640 1736 NtProtectVirtualMemory (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0 00641 1736 NtFlushInstructionCache (-1, 1560875008, 1656, ... ) == 0x0 00642 1736 NtProtectVirtualMemory (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0 00643 1736 NtProtectVirtualMemory (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0 00644 1736 NtFlushInstructionCache (-1, 1560875008, 1656, ... ) == 0x0 00645 1736 NtProtectVirtualMemory (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0 00646 1736 NtProtectVirtualMemory (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0 00647 1736 NtFlushInstructionCache (-1, 1560875008, 1656, ... ) == 0x0 00648 1736 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00649 1736 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00650 1736 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 8912896, 65536, ) == 0x0 00651 1736 NtAllocateVirtualMemory (-1, 8912896, 0, 4096, 4096, 4, ... 8912896, 4096, ) == 0x0 00652 1736 NtAllocateVirtualMemory (-1, 8916992, 0, 8192, 4096, 4, ... 8916992, 8192, ) == 0x0 00653 1736 NtAllocateVirtualMemory (-1, 8925184, 0, 4096, 4096, 4, ... 8925184, 4096, ) == 0x0 00654 1736 NtAllocateVirtualMemory (-1, 8929280, 0, 4096, 4096, 4, ... 8929280, 4096, ) == 0x0 00655 1736 NtQueryDefaultUILanguage (1239820, ... 00656 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00657 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147481380, ) == 0x0 00658 1736 NtQueryInformationToken (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00659 1736 NtClose (-2147481380, ... ) == 0x0 00660 1736 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0 00661 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x240, 0, 0, (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00662 1736 NtOpenKey (0x80000000, {24, -2147481380, 0x640, 0, 0, (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0 00663 1736 NtQueryValueKey (-2147481388, (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00664 1736 NtClose (-2147481388, ... ) == 0x0 00665 1736 NtClose (-2147481380, ... ) == 0x0 00655 1736 NtQueryDefaultUILanguage ... ) == 0x0 00666 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll"}, 1, 96, ... 64, {status=0x0, info=1}, ) }, 1, 96, ... 64, {status=0x0, info=1}, ) == 0x0 00667 1736 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 64, ... 56, ) == 0x0 00668 1736 NtMapViewOfSection (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8a0000), 0x0, 618496, ) == 0x0 00669 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00670 1736 NtQueryDefaultLocale (1, 1237916, ... ) == 0x0 00671 1736 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00672 1736 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 2088850039, 1238952, 1179817, 1238676} (24, {128, 156, new_msg, 0, 2088850039, 1238952, 1179817, 1238676} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6$\1@\0\0\0\377\377\377\377\0\0\0\0\340q\221\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6$\1\0\0\0\0\0\0\0\0\234\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1636, 1736, 75496, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6$\1@\0\0\0\377\377\377\377\0\0\0\0\340q\221\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6$\1\0\0\0\0\0\0\0\0\234\353\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 1636, 1736, 75496, 0} (24, {128, 156, new_msg, 0, 2088850039, 1238952, 1179817, 1238676} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6$\1@\0\0\0\377\377\377\377\0\0\0\0\340q\221\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6$\1\0\0\0\0\0\0\0\0\234\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1636, 1736, 75496, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6$\1@\0\0\0\377\377\377\377\0\0\0\0\340q\221\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6$\1\0\0\0\0\0\0\0\0\234\353\22\0\0\0\0\0" ) ) == 0x0 00673 1736 NtClose (64, ... ) == 0x0 00674 1736 NtClose (56, ... ) == 0x0 00675 1736 NtUnmapViewOfSection (-1, 0x8a0000, ... ) == 0x0 00676 1736 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00677 1736 NtOpenProcess (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1636, 0}, ... 56, ) == 0x0 00678 1736 NtQueryInformationProcess (56, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0 00679 1736 NtClose (56, ... ) == 0x0 00680 1736 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a 00681 1736 NtUserSystemParametersInfo (104, 0, 1561338260, 0, ... ) == 0x1 00682 1736 NtUserSystemParametersInfo (38, 4, 1561337988, 0, ... ) == 0x1 00683 1736 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00684 1736 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00685 1736 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00686 1736 NtClose (56, ... ) == 0x0 00687 1736 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 56, ) }, ... 56, ) == 0x0 00688 1736 NtOpenProcessToken (-1, 0x8, ... 64, ) == 0x0 00689 1736 NtAccessCheck (1332888, 64, 0x1, 1241012, 1241064, 56, 1241044, ... ) == STATUS_NO_IMPERSONATION_TOKEN 00690 1736 NtClose (64, ... ) == 0x0 00691 1736 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "Control Panel\Desktop"}, ... 64, ) }, ... 64, ) == 0x0 00692 1736 NtQueryValueKey (64, (64, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00693 1736 NtClose (64, ... ) == 0x0 00694 1736 NtUserSystemParametersInfo (41, 500, 1241192, 0, ... ) == 0x1 00695 1736 NtUserSystemParametersInfo (102, 0, 1561338280, 0, ... ) == 0x1 00696 1736 NtClose (56, ... ) == 0x0 00697 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00698 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c03b 00699 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c03d 00700 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00701 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c03f 00702 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00703 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c041 00704 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00705 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c043 00706 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c045 00707 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00708 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c047 00709 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00710 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c049 00711 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00712 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c04b 00713 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00714 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c04d 00715 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00716 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c04f 00717 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c051 00718 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00719 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c053 00720 1736 NtUserFindExistingCursorIcon (1240940, 1240956, 1241004, ... ) == 0x10011 00721 1736 NtUserRegisterClassExWOW (1240884, 1240952, 1240968, 1240984, 0, 384, 0, ... ) == 0x8173c055 00722 1736 NtUserFindExistingCursorIcon (1240940, 1240956, 1241004, ... ) == 0x10011 00723 1736 NtUserRegisterClassExWOW (1240884, 1240952, 1240968, 1240984, 0, 384, 0, ... ) == 0x8173c057 00724 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00725 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c059 00726 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10013 00727 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c05b 00728 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00729 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c05d 00730 1736 NtUserFindExistingCursorIcon (1240944, 1240960, 1241008, ... ) == 0x10011 00731 1736 NtUserRegisterClassExWOW (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x8173c05f 00732 1736 NtTestAlert (... ) == 0x0 00733 1736 NtContinue (1244464, 1, ... 00734 1736 NtSetInformationThread (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x403fcc,}, 4, ... ) == 0x0 00735 1736 NtAllocateVirtualMemory (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0 00736 1736 NtTerminateProcess (0, 0, ... ) == 0x0 00737 1736 NtUserGetAtomName (49211, 1243812, ... ) == 0xf 00738 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00739 1736 NtUserGetAtomName (49213, 1243812, ... ) == 0xd 00740 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00741 1736 NtUserGetAtomName (49215, 1243812, ... ) == 0x10 00742 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00743 1736 NtUserGetAtomName (49217, 1243812, ... ) == 0x12 00744 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00745 1736 NtUserGetAtomName (49219, 1243812, ... ) == 0xd 00746 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00747 1736 NtUserGetAtomName (49221, 1243812, ... ) == 0xb 00748 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00749 1736 NtUserGetAtomName (49223, 1243812, ... ) == 0xf 00750 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00751 1736 NtUserGetAtomName (49225, 1243812, ... ) == 0xd 00752 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00753 1736 NtUserGetAtomName (49227, 1243812, ... ) == 0x11 00754 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00755 1736 NtUserGetAtomName (49229, 1243812, ... ) == 0xf 00756 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00757 1736 NtUserGetAtomName (49231, 1243812, ... ) == 0x11 00758 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00759 1736 NtUserGetAtomName (49233, 1243812, ... ) == 0xf 00760 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00761 1736 NtUserGetAtomName (49235, 1243812, ... ) == 0xc 00762 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00763 1736 NtUserGetAtomName (49237, 1243804, ... ) == 0xd 00764 1736 NtUserUnregisterClass (1243864, 1560870912, 1243852, ... ) == 0x1 00765 1736 NtUserGetAtomName (49239, 1243804, ... ) == 0x11 00766 1736 NtUserUnregisterClass (1243864, 1560870912, 1243852, ... ) == 0x1 00767 1736 NtUserGetAtomName (49241, 1243812, ... ) == 0xc 00768 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00769 1736 NtUserGetAtomName (49243, 1243812, ... ) == 0xe 00770 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00771 1736 NtUserGetAtomName (49245, 1243812, ... ) == 0x8 00772 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00773 1736 NtUserGetAtomName (49247, 1243812, ... ) == 0xd 00774 1736 NtUserUnregisterClass (1243872, 1560870912, 1243860, ... ) == 0x1 00775 1736 NtUnmapViewOfSection (-1, 0x940000, ... ) == 0x0 00776 1736 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x6,}, 4, ... ) == 0x0 00777 1736 NtFreeVirtualMemory (-1, (0x880000), 0, 32768, ... (0x880000), 65536, ) == 0x0 00778 1736 NtUserGetAtomName (49211, 1243844, ... ) == 0xf 00779 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00780 1736 NtUserGetAtomName (49213, 1243844, ... ) == 0xd 00781 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00782 1736 NtUserGetAtomName (49215, 1243844, ... ) == 0x10 00783 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00784 1736 NtUserGetAtomName (49217, 1243844, ... ) == 0x12 00785 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00786 1736 NtUserGetAtomName (49219, 1243844, ... ) == 0xd 00787 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00788 1736 NtUserGetAtomName (49221, 1243844, ... ) == 0xb 00789 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00790 1736 NtUserGetAtomName (49223, 1243844, ... ) == 0xf 00791 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00792 1736 NtUserGetAtomName (49225, 1243844, ... ) == 0xd 00793 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00794 1736 NtUserGetAtomName (49227, 1243844, ... ) == 0x11 00795 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00796 1736 NtUserGetAtomName (49229, 1243844, ... ) == 0xf 00797 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00798 1736 NtUserGetAtomName (49231, 1243844, ... ) == 0x11 00799 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00800 1736 NtUserGetAtomName (49233, 1243844, ... ) == 0xf 00801 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00802 1736 NtUserGetAtomName (49235, 1243844, ... ) == 0xc 00803 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00804 1736 NtUserGetAtomName (49237, 1243836, ... ) == 0xd 00805 1736 NtUserUnregisterClass (1243896, 2000486400, 1243884, ... ) == 0x1 00806 1736 NtUserGetAtomName (49239, 1243836, ... ) == 0x11 00807 1736 NtUserUnregisterClass (1243896, 2000486400, 1243884, ... ) == 0x1 00808 1736 NtUserGetAtomName (49241, 1243844, ... ) == 0xc 00809 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00810 1736 NtUserGetAtomName (49243, 1243844, ... ) == 0xe 00811 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00812 1736 NtUserGetAtomName (49245, 1243844, ... ) == 0x8 00813 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00814 1736 NtUserGetAtomName (49247, 1243844, ... ) == 0xd 00815 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00816 1736 NtUserGetAtomName (49175, 1243844, ... ) == 0x6 00817 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00818 1736 NtUserGetAtomName (49177, 1243844, ... ) == 0x6 00819 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00820 1736 NtUserGetAtomName (49176, 1243844, ... ) == 0x4 00821 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00822 1736 NtUserGetAtomName (49178, 1243844, ... ) == 0x7 00823 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00824 1736 NtUserGetAtomName (49180, 1243844, ... ) == 0x8 00825 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00826 1736 NtUserGetAtomName (49182, 1243844, ... ) == 0x9 00827 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00828 1736 NtUserGetAtomName (49179, 1243836, ... ) == 0x9 00829 1736 NtUserUnregisterClass (1243896, 2000486400, 1243884, ... ) == 0x1 00830 1736 NtUserGetAtomName (49256, 1243844, ... ) == 0x7 00831 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00832 1736 NtUserGetAtomName (49258, 1243844, ... ) == 0xd 00833 1736 NtUserUnregisterClass (1243904, 2000486400, 1243892, ... ) == 0x1 00834 1736 NtUnmapViewOfSection (-1, 0x890000, ... ) == 0x0 00835 1736 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0 00836 1736 NtUserQueryWindow (65670, 0, ... ) == 0x6b8 00837 1736 NtUserQueryWindow (65670, 1, ... ) == 0x6bc 00838 1736 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0 00839 1736 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0 00840 1736 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0 00841 1736 NtClose (52, ... ) == 0x0 00842 1736 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0 00843 1736 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00844 1736 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00845 1736 NtQueryVirtualMemory (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 00846 1736 NtClose (44, ... ) == 0x0 00847 1736 NtFreeVirtualMemory (-1, (0x0), 0, 32768, ... ) == STATUS_MEMORY_NOT_ALLOCATED 00848 1736 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 44, ) }, ... 44, ) == 0x0 00849 1736 NtQueryValueKey (44, (44, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00850 1736 NtClose (44, ... ) == 0x0 00851 1736 NtRequestWaitReplyPort (24, {20, 48, new_msg, 0, 0, 2089879603, 4222412, 4220152} (24, {20, 48, new_msg, 0, 0, 2089879603, 4222412, 4220152} "\0\0\0\0\3\0\1\0P\376\22\0\370d@\0\0\0\0\0" ... {20, 48, reply, 0, 1636, 1736, 75497, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\370d@\0\0\0\0\0" ) ... {20, 48, reply, 0, 1636, 1736, 75497, 0} (24, {20, 48, new_msg, 0, 0, 2089879603, 4222412, 4220152} "\0\0\0\0\3\0\1\0P\376\22\0\370d@\0\0\0\0\0" ... {20, 48, reply, 0, 1636, 1736, 75497, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\370d@\0\0\0\0\0" ) ) == 0x0 00852 1736 NtTerminateProcess (-1, 0, ...