Summary:


NtAccessCheck(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtFlushInstructionCache(>) 
 10 
NtFsControlFile(>) 
 45 

NtAddAtom(>) 
 1 
NtGdiHfontCreate(>) 
 2 
NtUserGetWindowDC(>) 
 10 
NtOpenSection(>) 
 45 

NtCallbackReturn(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtClearEvent(>) 
 11 
NtOpenThreadToken(>) 
 45 

NtCreateThread(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtQueryVolumeInformationFile(>) 
 11 
NtSetValueKey(>) 
 45 

NtGdiCreateBitmap(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 2 
NtUserCallOneParam(>) 
 11 
NtQueryInformationToken(>) 
 48 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtTestAlert(>) 
 2 
NtUserSystemParametersInfo(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 48 

NtGdiInit(>) 
 1 
NtUserCreateWindowEx(>) 
 2 
NtCreateSemaphore(>) 
 12 
NtSetInformationProcess(>) 
 51 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserGetObjectInformation(>) 
 2 
NtEnumerateKey(>) 
 12 
NtQueryInformationProcess(>) 
 54 

NtGdiSelectBitmap(>) 
 1 
NtUserMessageCall(>) 
 2 
NtOpenProcessToken(>) 
 12 
NtRequestWaitReplyPort(>) 
 54 

NtOpenKeyedEvent(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtQueryDefaultUILanguage(>) 
 12 
NtAllocateVirtualMemory(>) 
 56 

NtOpenProcess(>) 
 1 
NtQuerySystemTime(>) 
 3 
NtSetEvent(>) 
 12 
NtReleaseMutant(>) 
 57 

NtOpenSymbolicLinkObject(>) 
 1 
NtUserGetMessage(>) 
 3 
NtOpenProcessTokenEx(>) 
 16 
NtSetInformationFile(>) 
 59 

NtQueryEvent(>) 
 1 
NtUserRegisterWindowMessage(>) 
 4 
NtOpenThreadTokenEx(>) 
 16 
NtUserRegisterClassExWOW(>) 
 64 

NtQueryInformationThread(>) 
 1 
NtDuplicateToken(>) 
 5 
NtWriteFile(>) 
 16 
NtMapViewOfSection(>) 
 65 

NtQueryObject(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtConnectPort(>) 
 18 
NtCreateEvent(>) 
 66 

NtQuerySymbolicLinkObject(>) 
 1 
NtNotifyChangeKey(>) 
 5 
NtQuerySection(>) 
 19 
NtCreateKey(>) 
 79 

NtQueryTimerResolution(>) 
 1 
NtQuerySecurityObject(>) 
 5 
NtReadFile(>) 
 19 
NtQueryDefaultLocale(>) 
 99 

NtResumeThread(>) 
 1 
NtSetInformationObject(>) 
 5 
NtUnmapViewOfSection(>) 
 21 
NtOpenFile(>) 
 108 

NtSecureConnectPort(>) 
 1 
NtCreateMutant(>) 
 6 
NtProtectVirtualMemory(>) 
 25 
NtQueryAttributesFile(>) 
 134 

NtUserGetDC(>) 
 1 
NtDuplicateObject(>) 
 6 
NtQuerySystemInformation(>) 
 25 
NtQueryVirtualMemory(>) 
 147 

NtUserGetGUIThreadInfo(>) 
 1 
NtFreeVirtualMemory(>) 
 6 
NtQueryDirectoryFile(>) 
 28 
NtEnumerateValueKey(>) 
 231 

NtUserGetProcessWindowStation(>) 
 1 
NtOpenEvent(>) 
 7 
NtQueryDebugFilterState(>) 
 29 
NtOpenKey(>) 
 326 

NtUserGetThreadDesktop(>) 
 1 
NtReleaseSemaphore(>) 
 7 
NtSetInformationThread(>) 
 29 
NtQueryValueKey(>) 
 525 

NtUserSetProp(>) 
 1 
NtUserCallNoParam(>) 
 7 
NtCreateSection(>) 
 34 
NtWaitForSingleObject(>) 
 527 

NtUserSetTimer(>) 
 1 
NtQueryKey(>) 
 8 
NtUserGetClassInfo(>) 
 37 
NtClose(>) 
 567 

NtContinue(>) 
 2 
NtDeleteValueKey(>) 
 9 
NtCreateFile(>) 
 42 
NtDeviceIoControlFile(>) 
 763 

NtCreateIoCompletion(>) 
 2 
NtOpenMutant(>) 
 9 
NtQueryInformationFile(>) 
 44 

Trace:
 00001   312   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   312   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   312   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   312   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   312   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   312   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   312   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   312   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   312   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   312   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   312   NtClose  (12, ... ) == 0x0
 00014   312   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   312   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   312   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   312   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   312   NtClose  (16, ... ) == 0x0
 00021   312   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   312   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   312   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   312   NtClose  (16, ... ) == 0x0
 00026   312   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   312   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   312   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   312   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   312   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 304, 312, 1462, 0} "h\246\30\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 304, 312, 1462, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 304, 312, 1462, 0} "h\246\30\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   312   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   312   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   312   NtClose  (16, ... ) == 0x0
 00036   312   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   312   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   312   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   312   NtClose  (28, ... ) == 0x0
 00041   312   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   312   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   312   NtClose  (28, ... ) == 0x0
 00045   312   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   312   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   312   NtClose  (28, ... ) == 0x0
 00049   312   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   312   NtClose  (28, ... ) == 0x0
 00052   312   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   312   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   312   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   312   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 304, 312, 1468, 0} "\10\300\27\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 304, 312, 1468, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 304, 312, 1468, 0} "\10\300\27\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00057   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0
 00058   312   NtClose  (28, ... ) == 0x0
 00059   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 00061   312   NtClose  (28, ... ) == 0x0
 00062   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   312   NtClose  (28, ... ) == 0x0
 00065   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00067   312   NtClose  (28, ... ) == 0x0
 00068   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00070   312   NtClose  (28, ... ) == 0x0
 00071   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00072   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00073   312   NtClose  (28, ... ) == 0x0
 00074   312   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00075   312   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00076   312   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00077   312   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00078   312   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00079   312   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00080   312   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00081   312   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00082   312   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00083   312   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00084   312   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00085   312   NtClose  (28, ... ) == 0x0
 00086   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00087   312   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00088   312   NtClose  (28, ... ) == 0x0
 00089   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00090   312   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00091   312   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00092   312   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00093   312   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00094   312   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 28, ) }, ... 28, ) == 0x0
 00095   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00096   312   NtClose  (28, ... ) == 0x0
 00097   312   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00098   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00099   312   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\31\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 304, 312, 1475, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 304, 312, 1475, 0}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\31\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 304, 312, 1475, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00100   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00101   312   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4e0000), 0x0, 1060864, ) == 0x0
 00102   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00103   312   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00104   312   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482028, ) == 0x0
 00105   312   NtQueryInformationToken  (-2147482028, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00106   312   NtQueryInformationToken  (-2147482028, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00107   312   NtClose  (-2147482028, ... ) == 0x0
 00108   312   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00109   312   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00110   312   NtDuplicateObject  (-1, 36, -1, 0x0, 0, 2, ... 44, ) == 0x0
 00111   312   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0
 00112   312   NtQueryValueKey  (-2147482024,  (-2147482024, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00113   312   NtClose  (-2147482024, ... ) == 0x0
 00114   312   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0
 00115   312   NtQueryValueKey  (-2147482024,  (-2147482024, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00116   312   NtClose  (-2147482024, ... ) == 0x0
 00117   312   NtQueryDefaultLocale  (0, -136312308, ... ) == 0x0
 00118   312   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00119   312   NtUserCallNoParam  (24, ... ) == 0x0
 00120   312   NtGdiCreateCompatibleDC  (0, ...
 00121   312   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00120   312   NtGdiCreateCompatibleDC  ... ) == 0xc0103ec
 00122   312   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00123   312   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00124   312   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0xa0503e8
 00125   312   NtGdiCreateSolidBrush  (0, 0, ...
 00126   312   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00125   312   NtGdiCreateSolidBrush  ... ) == 0xa1003e6
 00127   312   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00128   312   NtGdiCreateCompatibleDC  (0, ... ) == 0x60103e9
 00129   312   NtGdiSelectBitmap  (100729833, 168100840, ... ) == 0x185000f
 00130   312   NtUserGetThreadDesktop  (312, 0, ... ) == 0x28
 00131   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 48, ) }, ... 48, ) == 0x0
 00132   312   NtQueryValueKey  (48,  (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00133   312   NtClose  (48, ... ) == 0x0
 00134   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00135   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810ec017
 00136   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00137   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810ec01c
 00138   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00139   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810ec01e
 00140   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00141   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810e8002
 00142   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00143   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810ec018
 00144   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00145   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810ec01a
 00146   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00147   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810ec01d
 00148   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00149   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... ) == 0x810ec026
 00150   312   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00151   312   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810ec019
 00152   312   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ...
 00153   312   NtAllocateVirtualMemory  (-1, 6320128, 0, 4096, 4096, 32, ... 6320128, 4096, ) == 0x0
 00152   312   NtUserRegisterClassExWOW  ... ) == 0x810ec020
 00154   312   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810ec022
 00155   312   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810ec023
 00156   312   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810ec024
 00157   312   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810ec025
 00158   312   NtCallbackReturn  (0, 0, 0, ...
 00159   312   NtGdiInit  (... ) == 0x1
 00160   312   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00161   312   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00162   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 48, ) }, ... 48, ) == 0x0
 00163   312   NtQueryValueKey  (48,  (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00164   312   NtQueryValueKey  (48,  (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00165   312   NtClose  (48, ... ) == 0x0
 00166   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 48, ) }, ... 48, ) == 0x0
 00167   312   NtQueryValueKey  (48,  (48, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00168   312   NtClose  (48, ... ) == 0x0
 00169   312   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 48, ) }, ... 48, ) == 0x0
 00170   312   NtSetInformationObject  (48, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00171   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00172   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00173   312   NtTestAlert  (... ) == 0x0
 00174   312   NtContinue  (1244464, 1, ...
 00175   312   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401440,}, 4, ... ) == 0x0
 00176   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244716,  (0x80100080, {24, 0, 0x40, 0, 1244716, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 96, 0, 0, ... 52, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 52, {status=0x0, info=1}, ) == 0x0
 00177   312   NtClose  (52, ... ) == 0x0
 00178   312   NtProtectVirtualMemory  (-1, (0x402000), 19456, 64, ... (0x402000), 20480, 32, ) == 0x0
 00179   312   NtProtectVirtualMemory  (-1, (0x402000), 19456, 32, ... (0x402000), 20480, 64, ) == 0x0
 00180   312   NtProtectVirtualMemory  (-1, (0x408000), 25088, 64, ... (0x408000), 28672, 8, ) == 0x0
 00181   312   NtProtectVirtualMemory  (-1, (0x408000), 25088, 8, ... (0x408000), 28672, 64, ) == 0x0
 00182   312   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00183   312   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00184   312   NtClose  (52, ... ) == 0x0
 00185   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00186   312   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0
 00187   312   NtClose  (52, ... ) == 0x0
 00188   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00189   312   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0
 00190   312   NtClose  (52, ... ) == 0x0
 00191   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00192   312   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0
 00193   312   NtClose  (52, ... ) == 0x0
 00194   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00195   312   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00196   312   NtClose  (52, ... ) == 0x0
 00197   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 52, ) }, ... 52, ) == 0x0
 00198   312   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 00199   312   NtClose  (52, ... ) == 0x0
 00200   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00201   312   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00202   312   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00203   312   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00204   312   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00205   312   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00206   312   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1240840, 0,  (0x1f0003, {24, 52, 0x80, 1240840, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 00207   312   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 56, ) }, ... 56, ) == 0x0
 00208   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00209   312   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00210   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 60, ) }, ... 60, ) == 0x0
 00211   312   NtQueryValueKey  (60,  (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00212   312   NtClose  (60, ... ) == 0x0
 00213   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00214   312   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00215   312   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00216   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00217   312   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00218   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 60, ) }, ... 60, ) == 0x0
 00219   312   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00220   312   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00221   312   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00222   312   NtClose  (60, ... ) == 0x0
 00223   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 60, ) }, ... 60, ) == 0x0
 00224   312   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00225   312   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00226   312   NtClose  (60, ... ) == 0x0
 00227   312   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00228   312   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 00229   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00230   312   NtOpenKey  (0x9, {24, 48, 0x40, 0, 0,  (0x9, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00231   312   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00232   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00233   312   NtAllocateVirtualMemory  (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0
 00234   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00235   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 60, ) == 0x0
 00236   312   NtQueryInformationToken  (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00237   312   NtClose  (60, ... ) == 0x0
 00238   312   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 60, ) }, ... 60, ) == 0x0
 00239   312   NtSetInformationObject  (60, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00240   312   NtCreateKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 64, 2, ) }, 0, 0x0, 0, ... 64, 2, ) == 0x0
 00241   312   NtQueryDefaultUILanguage  (1239076, ...
 00242   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00243   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482036, ) == 0x0
 00244   312   NtQueryInformationToken  (-2147482036, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00245   312   NtClose  (-2147482036, ... ) == 0x0
 00246   312   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482036, ) }, ... -2147482036, ) == 0x0
 00247   312   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00248   312   NtOpenKey  (0x80000000, {24, -2147482036, 0x640, 0, 0,  (0x80000000, {24, -2147482036, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00249   312   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00250   312   NtClose  (-2147482032, ... ) == 0x0
 00251   312   NtClose  (-2147482036, ... ) == 0x0
 00241   312   NtQueryDefaultUILanguage  ... ) == 0x0
 00252   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00253   312   NtQueryInstallUILanguage  (2012047340, ... ) == 0x0
 00254   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00255   312   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 72, ) == 0x0
 00256   312   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x360000), 0x0, 593920, ) == 0x0
 00257   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00258   312   NtQueryDefaultUILanguage  (2013024600, ...
 00259   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00260   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482036, ) == 0x0
 00261   312   NtQueryInformationToken  (-2147482036, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00262   312   NtClose  (-2147482036, ... ) == 0x0
 00263   312   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482036, ) }, ... -2147482036, ) == 0x0
 00264   312   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   312   NtOpenKey  (0x80000000, {24, -2147482036, 0x640, 0, 0,  (0x80000000, {24, -2147482036, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00266   312   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00267   312   NtClose  (-2147482032, ... ) == 0x0
 00268   312   NtClose  (-2147482036, ... ) == 0x0
 00258   312   NtQueryDefaultUILanguage  ... ) == 0x0
 00269   312   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 00270   312   NtQueryDefaultLocale  (1, 1237112, ... ) == 0x0
 00271   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00272   312   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1497, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 304, 312, 1497, 0}  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1497, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" )  ) == 0x0
 00273   312   NtClose  (68, ... ) == 0x0
 00274   312   NtClose  (72, ... ) == 0x0
 00275   312   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00276   312   NtUnmapViewOfSection  (-1, 0x12ead0, ... ) == STATUS_NOT_MAPPED_VIEW
 00277   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00278   312   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00279   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00280   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00281   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1235652, ... ) }, 1235652, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00282   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00283   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00284   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00285   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236244, ... ) }, 1236244, ... ) == 0x0
 00286   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 72, {status=0x0, info=1}, ) }, 3, 33, ... 72, {status=0x0, info=1}, ) == 0x0
 00287   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00288   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00289   312   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00290   312   NtClose  (68, ... ) == 0x0
 00291   312   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x900000), 0x0, 921600, ) == 0x0
 00292   312   NtClose  (76, ... ) == 0x0
 00293   312   NtUnmapViewOfSection  (-1, 0x900000, ... ) == 0x0
 00294   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 76, {status=0x0, info=1}, ) }, 5, 96, ... 76, {status=0x0, info=1}, ) == 0x0
 00295   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 76, ... 68, ) == 0x0
 00296   312   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00297   312   NtOpenProcessToken  (-1, 0x8, ... 80, ) == 0x0
 00298   312   NtQueryInformationToken  (80, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00299   312   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00300   312   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 84, ) }, ... 84, ) == 0x0
 00301   312   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00302   312   NtClose  (84, ... ) == 0x0
 00303   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00304   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00305   312   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00306   312   NtClose  (84, ... ) == 0x0
 00307   312   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00308   312   NtClose  (80, ... ) == 0x0
 00309   312   NtClose  (76, ... ) == 0x0
 00310   312   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0
 00311   312   NtClose  (68, ... ) == 0x0
 00312   312   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00313   312   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00314   312   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00315   312   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00316   312   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00317   312   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00318   312   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00319   312   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00320   312   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00321   312   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00322   312   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00323   312   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00324   312   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00325   312   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00326   312   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00327   312   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00328   312   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00329   312   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00330   312   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00331   312   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00332   312   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00333   312   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1237428, ... ) , 42, 1237428, ... ) == 0x0
 00334   312   NtQueryDefaultUILanguage  (1236144, ...
 00335   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00336   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482036, ) == 0x0
 00337   312   NtQueryInformationToken  (-2147482036, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00338   312   NtClose  (-2147482036, ... ) == 0x0
 00339   312   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482036, ) }, ... -2147482036, ) == 0x0
 00340   312   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00341   312   NtOpenKey  (0x80000000, {24, -2147482036, 0x640, 0, 0,  (0x80000000, {24, -2147482036, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00342   312   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00343   312   NtClose  (-2147482032, ... ) == 0x0
 00344   312   NtClose  (-2147482036, ... ) == 0x0
 00334   312   NtQueryDefaultUILanguage  ... ) == 0x0
 00345   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00346   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1234996, ... ) }, 1234996, ... ) == 0x0
 00347   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00348   312   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00349   312   NtClose  (68, ... ) == 0x0
 00350   312   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x360000), 0x0, 4096, ) == 0x0
 00351   312   NtClose  (76, ... ) == 0x0
 00352   312   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00353   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1234636, ... ) }, 1234636, ... ) == 0x0
 00354   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1235336,  (0x80100080, {24, 0, 0x40, 0, 1235336, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) == 0x0
 00355   312   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 76, ... 68, ) == 0x0
 00356   312   NtClose  (76, ... ) == 0x0
 00357   312   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x360000), {0, 0}, 4096, ) == 0x0
 00358   312   NtClose  (68, ... ) == 0x0
 00359   312   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00360   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00361   312   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 76, ) == 0x0
 00362   312   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x360000), 0x0, 4096, ) == 0x0
 00363   312   NtQueryInformationFile  (68, 1234956, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 00364   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00365   312   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1498, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 304, 312, 1498, 0}  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1498, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" )  ) == 0x0
 00366   312   NtClose  (68, ... ) == 0x0
 00367   312   NtClose  (76, ... ) == 0x0
 00368   312   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00369   312   NtUnmapViewOfSection  (-1, 0x12df5c, ... ) == STATUS_NOT_MAPPED_VIEW
 00370   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00371   312   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00372   312   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 00373   312   NtUserGetDC  (0, ... ) == 0x1010050
 00374   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00375   312   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 00376   312   NtUserSystemParametersInfo  (66, 12, 1237448, 0, ... ) == 0x1
 00377   312   NtOpenProcessToken  (-1, 0x8, ... 76, ) == 0x0
 00378   312   NtAccessCheck  (1343968, 76, 0x1, 1236852, 1236796, 56, 1236880, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00379   312   NtClose  (76, ... ) == 0x0
 00380   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 76, ) }, ... 76, ) == 0x0
 00381   312   NtQueryValueKey  (76,  (76, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   312   NtClose  (76, ... ) == 0x0
 00383   312   NtUserSystemParametersInfo  (41, 500, 1236948, 0, ... ) == 0x1
 00384   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 76, ) }, ... 76, ) == 0x0
 00385   312   NtQueryValueKey  (76,  (76, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00386   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 68, ) }, ... 68, ) == 0x0
 00387   312   NtQueryValueKey  (68,  (68, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00388   312   NtClose  (68, ... ) == 0x0
 00389   312   NtClose  (76, ... ) == 0x0
 00390   312   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 00391   312   NtUserSystemParametersInfo  (4130, 0, 1237472, 0, ... ) == 0x1
 00392   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 76, ) }, ... 76, ) == 0x0
 00393   312   NtEnumerateValueKey  (76, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00394   312   NtClose  (76, ... ) == 0x0
 00395   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00396   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec03b
 00397   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec03d
 00398   312   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00399   312   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810ec03f
 00400   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00401   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec041
 00402   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00403   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec043
 00404   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec045
 00405   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00406   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec047
 00407   312   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00408   312   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810ec049
 00409   312   NtUserGetClassInfo  (1905590272, 1237368, 1237320, 1237396, 0, ... ) == 0xc049
 00410   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00411   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec04b
 00412   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00413   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec04d
 00414   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00415   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec04f
 00416   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec051
 00417   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00418   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec053
 00419   312   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00420   312   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810ec055
 00421   312   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810ec057
 00422   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00423   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec059
 00424   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10013
 00425   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec05b
 00426   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00427   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec05d
 00428   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00429   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec05f
 00430   312   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00431   312   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810ec017
 00432   312   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00433   312   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810ec019
 00434   312   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10013
 00435   312   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810ec018
 00436   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00437   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec01a
 00438   312   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00439   312   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810ec01c
 00440   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00441   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ...
 00442   312   NtAllocateVirtualMemory  (-1, 6324224, 0, 4096, 4096, 32, ... 6324224, 4096, ) == 0x0
 00441   312   NtUserRegisterClassExWOW  ... ) == 0x810ec01e
 00443   312   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00444   312   NtUserRegisterClassExWOW  (1237264, 1237344, 1237328, 1237360, 0, 384, 0, ... ) == 0x810ec01b
 00445   312   NtUserFindExistingCursorIcon  (1236748, 1236764, 1237332, ... ) == 0x10011
 00446   312   NtUserRegisterClassExWOW  (1237260, 1237340, 1237324, 1237356, 0, 384, 0, ... ) == 0x810ec068
 00447   312   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00448   312   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810ec06a
 00449   312   NtCreateKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 76, 2, ) }, 0, 0x0, 0, ... 76, 2, ) == 0x0
 00450   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "mpr.dll"}, ... 68, ) }, ... 68, ) == 0x0
 00451   312   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 69632, ) == 0x0
 00452   312   NtClose  (68, ... ) == 0x0
 00453   312   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 68, ) == 0x0
 00454   312   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 80, ) == 0x0
 00455   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 84, ) }, ... 84, ) == 0x0
 00456   312   NtNotifyChangeKey  (84, 80, 0, 0, 2011390432, 4, 0, 0, 0, 1, ... ) == 0x103
 00457   312   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00458   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 88, ) == 0x0
 00459   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 92, ) == 0x0
 00460   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00461   312   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 8339456, ) == 0x0
 00462   312   NtClose  (96, ... ) == 0x0
 00463   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SYSTEM\Setup"}, ... 96, ) }, ... 96, ) == 0x0
 00464   312   NtQueryValueKey  (96,  (96, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00465   312   NtClose  (96, ... ) == 0x0
 00466   312   NtQueryDefaultUILanguage  (1239064, ...
 00467   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00468   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482036, ) == 0x0
 00469   312   NtQueryInformationToken  (-2147482036, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00470   312   NtClose  (-2147482036, ... ) == 0x0
 00471   312   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482036, ) }, ... -2147482036, ) == 0x0
 00472   312   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00473   312   NtOpenKey  (0x80000000, {24, -2147482036, 0x640, 0, 0,  (0x80000000, {24, -2147482036, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00474   312   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00475   312   NtClose  (-2147482032, ... ) == 0x0
 00476   312   NtClose  (-2147482036, ... ) == 0x0
 00466   312   NtQueryDefaultUILanguage  ... ) == 0x0
 00477   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00478   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 96, {status=0x0, info=1}, ) }, 1, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00479   312   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 96, ... 100, ) == 0x0
 00480   312   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x900000), 0x0, 8323072, ) == 0x0
 00481   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00482   312   NtQueryDefaultLocale  (1, 1237100, ... ) == 0x0
 00483   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00484   312   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1499, 0} " S\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 304, 312, 1499, 0}  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1499, 0} " S\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" )  ) == 0x0
 00485   312   NtClose  (96, ... ) == 0x0
 00486   312   NtClose  (100, ... ) == 0x0
 00487   312   NtUnmapViewOfSection  (-1, 0x900000, ... ) == 0x0
 00488   312   NtUnmapViewOfSection  (-1, 0x12eac4, ... ) == STATUS_NOT_MAPPED_VIEW
 00489   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00490   312   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00491   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00492   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00493   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236184, ... ) }, 1236184, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00495   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00496   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00497   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236776, ... ) }, 1236776, ... ) == 0x0
 00498   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 100, {status=0x0, info=1}, ) }, 3, 33, ... 100, {status=0x0, info=1}, ) == 0x0
 00499   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00500   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00501   312   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00502   312   NtClose  (96, ... ) == 0x0
 00503   312   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {304, 0}, ... 96, ) == 0x0
 00504   312   NtQueryInformationProcess  (96, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00505   312   NtClose  (96, ... ) == 0x0
 00506   312   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00507   312   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00508   312   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00509   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 96, ) }, ... 96, ) == 0x0
 00510   312   NtQueryValueKey  (96,  (96, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00511   312   NtClose  (96, ... ) == 0x0
 00512   312   NtUserSystemParametersInfo  (41, 500, 1238640, 0, ... ) == 0x1
 00513   312   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00514   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00515   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00516   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec03b
 00517   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00518   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec03d
 00519   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00520   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00521   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec03f
 00522   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00523   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00524   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec041
 00525   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00526   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00527   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec043
 00528   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00529   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec045
 00530   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00531   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00532   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec047
 00533   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00534   312   NtUserFindExistingCursorIcon  (1238428, 1238444, 1239012, ... ) == 0x10011
 00535   312   NtUserRegisterClassExWOW  (1238880, 1238960, 1238944, 1238976, 0, 384, 0, ... ) == 0x810ec049
 00536   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00537   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00538   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec04b
 00539   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00540   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00541   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec04d
 00542   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00543   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00544   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec04f
 00545   312   NtUserGetClassInfo  (1999896576, 1239052, 1239004, 1239080, 0, ... ) == 0x0
 00546   312   NtUserRegisterClassExWOW  (1238888, 1238968, 1238952, 1238984, 0, 384, 0, ... ) == 0x810ec051
 00547   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00548   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00549   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec053
 00550   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00551   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00552   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec055
 00553   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec057
 00554   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00555   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00556   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec059
 00557   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00558   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10013
 00559   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec05b
 00560   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00561   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00562   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec05d
 00563   312   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00564   312   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00565   312   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810ec05f
 00566   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03b
 00567   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03d
 00568   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03f
 00569   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc041
 00570   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc043
 00571   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc045
 00572   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc047
 00573   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc049
 00574   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04b
 00575   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04d
 00576   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04f
 00577   312   NtUserGetClassInfo  (1999896576, 1240804, 1240756, 1240832, 0, ... ) == 0xc051
 00578   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc053
 00579   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc055
 00580   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc059
 00581   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05b
 00582   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05d
 00583   312   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05f
 00584   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00585   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00586   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00587   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == 0x0
 00588   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 5, 96, ... 96, {status=0x0, info=1}, ) }, 5, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00589   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 96, ... 104, ) == 0x0
 00590   312   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00591   312   NtClose  (96, ... ) == 0x0
 00592   312   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0
 00593   312   NtClose  (104, ... ) == 0x0
 00594   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00595   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00596   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00597   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == 0x0
 00598   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00599   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 104, ... 96, ) == 0x0
 00600   312   NtQuerySection  (96, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00601   312   NtClose  (104, ... ) == 0x0
 00602   312   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00603   312   NtClose  (96, ... ) == 0x0
 00604   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00605   312   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00606   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 96, ) }, ... 96, ) == 0x0
 00607   312   NtQueryValueKey  (96,  (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00608   312   NtQueryValueKey  (96,  (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00609   312   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 104, ) == 0x0
 00610   312   NtOpenKey  (0x2000000, {24, 96, 0x40, 0, 0,  (0x2000000, {24, 96, 0x40, 0, 0, "Protocol_Catalog9"}, ... 108, ) }, ... 108, ) == 0x0
 00611   312   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 00612   312   NtNotifyChangeKey  (108, 104, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 00613   312   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 00614   312   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "00000019"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00615   312   NtQueryValueKey  (108,  (108, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) }, 16, ) == 0x0
 00616   312   NtQueryValueKey  (108,  (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 00617   312   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "Catalog_Entries"}, ... 112, ) }, ... 112, ) == 0x0
 00618   312   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00619   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000001"}, ... 116, ) }, ... 116, ) == 0x0
 00620   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00621   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00622   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00623   312   NtClose  (116, ... ) == 0x0
 00624   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000002"}, ... 116, ) }, ... 116, ) == 0x0
 00625   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00626   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00627   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00628   312   NtClose  (116, ... ) == 0x0
 00629   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000003"}, ... 116, ) }, ... 116, ) == 0x0
 00630   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00631   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00632   312   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 00633   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00634   312   NtClose  (116, ... ) == 0x0
 00635   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000004"}, ... 116, ) }, ... 116, ) == 0x0
 00636   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00637   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00638   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00639   312   NtClose  (116, ... ) == 0x0
 00640   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000005"}, ... 116, ) }, ... 116, ) == 0x0
 00641   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00642   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00643   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00644   312   NtClose  (116, ... ) == 0x0
 00645   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000006"}, ... 116, ) }, ... 116, ) == 0x0
 00646   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00647   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00648   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00649   312   NtClose  (116, ... ) == 0x0
 00650   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000007"}, ... 116, ) }, ... 116, ) == 0x0
 00651   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00652   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00653   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00654   312   NtClose  (116, ... ) == 0x0
 00655   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000008"}, ... 116, ) }, ... 116, ) == 0x0
 00656   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00657   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00658   312   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 00659   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00660   312   NtClose  (116, ... ) == 0x0
 00661   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000009"}, ... 116, ) }, ... 116, ) == 0x0
 00662   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00663   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00664   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00665   312   NtClose  (116, ... ) == 0x0
 00666   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000010"}, ... 116, ) }, ... 116, ) == 0x0
 00667   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00668   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00669   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\00\1\0\08\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\00\1\0\08\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\00\1\0\08\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00670   312   NtClose  (116, ... ) == 0x0
 00671   312   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000011"}, ... 116, ) }, ... 116, ) == 0x0
 00672   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00673   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00674   312   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\243\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\243\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0p\0\0\0\244\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\2\0\00\1\0\08\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\245\2\0\00\1\0\08\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\246\2\0\00\1\0\08\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\246\2\0\00\1\0\08\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0p\0\0\0\247\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0`\0\0\0D\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\250\237\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\243\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\243\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\2\0\00\1\0\08\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0p\0\0\0\244\2\0\00\1\0\08\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\2\0\00\1\0\08\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\245\2\0\00\1\0\08\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\246\2\0\00\1\0\08\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\246\2\0\00\1\0\08\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0p\0\0\0\247\2\0\00\1\0\08\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0`\0\0\0D\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\250\237\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) }, 900, ) == 0x0
 00675   312   NtClose  (116, ... ) == 0x0
 00676   312   NtClose  (112, ... ) == 0x0
 00677   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 00678   312   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 112, ) == 0x0
 00679   312   NtOpenKey  (0x2000000, {24, 96, 0x40, 0, 0,  (0x2000000, {24, 96, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 116, ) }, ... 116, ) == 0x0
 00680   312   NtQueryValueKey  (116,  (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00681   312   NtNotifyChangeKey  (116, 112, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 00682   312   NtQueryValueKey  (116,  (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00683   312   NtOpenKey  (0x2000000, {24, 116, 0x40, 0, 0,  (0x2000000, {24, 116, 0x40, 0, 0, "00000004"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00684   312   NtQueryValueKey  (116,  (116, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 00685   312   NtOpenKey  (0x2000000, {24, 116, 0x40, 0, 0,  (0x2000000, {24, 116, 0x40, 0, 0, "Catalog_Entries"}, ... 120, ) }, ... 120, ) == 0x0
 00686   312   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 00687   312   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000001"}, ... 124, ) }, ... 124, ) == 0x0
 00688   312   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00689   312   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00690   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00691   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00692   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00693   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00694   312   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00695   312   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00696   312   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00697   312   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00698   312   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00699   312   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00700   312   NtClose  (124, ... ) == 0x0
 00701   312   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000002"}, ... 124, ) }, ... 124, ) == 0x0
 00702   312   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00703   312   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00704   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00705   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00706   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00707   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00708   312   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 00709   312   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00710   312   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 00711   312   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00712   312   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00713   312   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00714   312   NtClose  (124, ... ) == 0x0
 00715   312   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000003"}, ... 124, ) }, ... 124, ) == 0x0
 00716   312   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00717   312   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00718   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00719   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00720   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00721   312   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00722   312   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 00723   312   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00724   312   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 00725   312   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00726   312   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00727   312   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00728   312   NtClose  (124, ... ) == 0x0
 00729   312   NtClose  (120, ... ) == 0x0
 00730   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 00731   312   NtClose  (96, ... ) == 0x0
 00732   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00733   312   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00734   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 96, ) }, ... 96, ) == 0x0
 00735   312   NtQueryValueKey  (96,  (96, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00736   312   NtClose  (96, ... ) == 0x0
 00737   312   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 96, ) == 0x0
 00738   312   NtSetInformationProcess  (-1, PriorityClass, {process info, class 18, size 2}, 3277056, ... ) == 0x0
 00739   312   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "mtx_cv_cv_v2.0"}, 0, ... 120, ) }, 0, ... 120, ) == 0x0
 00740   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cvrss.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00741   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cvrss.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00742   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00743   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00744   312   NtClose  (124, ... ) == 0x0
 00745   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00746   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00747   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0", 72, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0", 72, ... , 72, ...
 00748   312   NtSetInformationFile  (-2147482844, -136313036, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00749   312   NtSetInformationFile  (-2147482844, -136313128, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00750   312   NtSetInformationFile  (-2147482844, -136313532, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00747   312   NtSetValueKey  ... ) == 0x0
 00751   312   NtClose  (124, ... ) == 0x0
 00752   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acrmon32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00753   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acrmon32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00754   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00755   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00756   312   NtClose  (124, ... ) == 0x0
 00757   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00758   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 84, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 84, ) }, 84, ) == 0x0
 00759   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 148, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 148, ... , 148, ...
 00760   312   NtSetInformationFile  (-2147482844, -136313424, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00759   312   NtSetValueKey  ... ) == 0x0
 00761   312   NtClose  (124, ... ) == 0x0
 00762   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00763   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00764   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00765   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00766   312   NtClose  (124, ... ) == 0x0
 00767   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00768   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 160, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 160, ) }, 160, ) == 0x0
 00769   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0", 220, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0", 220, ... , 220, ...
 00770   312   NtSetInformationFile  (-2147482844, -136313424, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00769   312   NtSetValueKey  ... ) == 0x0
 00771   312   NtClose  (124, ... ) == 0x0
 00772   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00773   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00774   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00775   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00776   312   NtClose  (124, ... ) == 0x0
 00777   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00778   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 232, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 232, ) }, 232, ) == 0x0
 00779   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 296, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 296, ... ) , 296, ... ) == 0x0
 00780   312   NtClose  (124, ... ) == 0x0
 00781   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00782   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00783   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00784   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00785   312   NtClose  (124, ... ) == 0x0
 00786   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00787   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 308, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 308, ) }, 308, ) == 0x0
 00788   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 372, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 372, ... ) , 372, ... ) == 0x0
 00789   312   NtClose  (124, ... ) == 0x0
 00790   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wcescom32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00791   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wcescom32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00792   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00793   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00794   312   NtClose  (124, ... ) == 0x0
 00795   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00796   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 384, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 384, ) }, 384, ) == 0x0
 00797   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 450, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 450, ... ) , 450, ... ) == 0x0
 00798   312   NtClose  (124, ... ) == 0x0
 00799   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Userenv.dll"}, ... 124, ) }, ... 124, ) == 0x0
 00800   312   NtMapViewOfSection  (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 00801   312   NtClose  (124, ... ) == 0x0
 00802   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 124, ) }, ... 124, ) == 0x0
 00803   312   NtQueryValueKey  (124,  (124, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00804   312   NtClose  (124, ... ) == 0x0
 00805   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 124, ) }, ... 124, ) == 0x0
 00806   312   NtQueryValueKey  (124,  (124, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00807   312   NtClose  (124, ... ) == 0x0
 00808   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 124, ) }, ... 124, ) == 0x0
 00809   312   NtQueryValueKey  (124,  (124, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 00810   312   NtClose  (124, ... ) == 0x0
 00811   312   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1240992, 0,  (0x1f0003, {24, 52, 0x80, 1240992, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 124, ) }, 0, 1, ... 124, ) == STATUS_OBJECT_NAME_EXISTS
 00812   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00813   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00814   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00815   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00816   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00817   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00818   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00819   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00820   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00821   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00822   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00823   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00824   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00825   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00826   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00827   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00828   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00829   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00830   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00831   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00832   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00833   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00834   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00835   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00836   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00837   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00838   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00839   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 128, ) == 0x0
 00840   312   NtQueryInformationToken  (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00841   312   NtClose  (128, ... ) == 0x0
 00842   312   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 128, ) }, ... 128, ) == 0x0
 00843   312   NtOpenKey  (0x20019, {24, 128, 0x40, 0, 0,  (0x20019, {24, 128, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 132, ) }, ... 132, ) == 0x0
 00844   312   NtQueryValueKey  (132,  (132, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 00845   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00846   312   NtQueryValueKey  (132,  (132, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 00847   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00848   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00849   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00850   312   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00851   312   NtClose  (132, ... ) == 0x0
 00852   312   NtClose  (128, ... ) == 0x0
 00853   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00854   312   NtQueryValueKey  (128,  (128, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00855   312   NtClose  (128, ... ) == 0x0
 00856   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00857   312   NtQueryValueKey  (128,  (128, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00858   312   NtQueryValueKey  (128,  (128, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00859   312   NtClose  (128, ... ) == 0x0
 00860   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00861   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00862   312   NtQueryValueKey  (128,  (128, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00863   312   NtClose  (128, ... ) == 0x0
 00864   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00865   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 128, ) }, ... 128, ) == 0x0
 00866   312   NtQueryValueKey  (128,  (128, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (128, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 00867   312   NtClose  (128, ... ) == 0x0
 00868   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 128, ) }, ... 128, ) == 0x0
 00869   312   NtQueryValueKey  (128,  (128, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 00870   312   NtClose  (128, ... ) == 0x0
 00871   312   NtClose  (124, ... ) == 0x0
 00872   312   NtUnmapViewOfSection  (-1, 0x75a70000, ... ) == 0x0
 00873   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Task Manager.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00874   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Task Manager.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00875   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00876   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00877   312   NtClose  (124, ... ) == 0x0
 00878   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00879   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 462, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 462, ) }, 462, ) == 0x0
 00880   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 622, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 622, ... , 622, ...
 00881   312   NtSetInformationFile  (-2147482844, -136313424, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00880   312   NtSetValueKey  ... ) == 0x0
 00882   312   NtClose  (124, ... ) == 0x0
 00883   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskman.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00884   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskman.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00885   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00886   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00887   312   NtClose  (124, ... ) == 0x0
 00888   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00889   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0z\2\0\0z\3\0\00\1\0\08\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0"}, 634, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0z\2\0\0z\3\0\00\1\0\08\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0"}, 634, ) }, 634, ) == 0x0
 00890   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 784, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 784, ... ) , 784, ... ) == 0x0
 00891   312   NtClose  (124, ... ) == 0x0
 00892   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\mmedia.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00893   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\mmedia.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00894   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00895   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00896   312   NtClose  (124, ... ) == 0x0
 00897   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00898   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\34\3\0\0\203\3\0\00\1\0\08\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0"}, 796, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\34\3\0\0\203\3\0\00\1\0\08\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0"}, 796, ) }, 796, ) == 0x0
 00899   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 944, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 944, ... , 944, ...
 00900   312   NtSetInformationFile  (-2147482844, -136313424, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00899   312   NtSetValueKey  ... ) == 0x0
 00901   312   NtClose  (124, ... ) == 0x0
 00902   312   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winamp.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00903   312   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winamp.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00904   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00905   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00906   312   NtClose  (124, ... ) == 0x0
 00907   312   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00908   312   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\274\3\0\0\215\3\0\00\1\0\08\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0"}, 956, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\274\3\0\0\215\3\0\00\1\0\08\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0"}, 956, ) }, 956, ) == 0x0
 00909   312   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 1104, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 1104, ... ) , 1104, ... ) == 0x0
 00910   312   NtClose  (124, ... ) == 0x0
 00911   312   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 124, 2, ) }, 0, 0x0, 0, ... 124, 2, ) == 0x0
 00912   312   NtDeleteValueKey  (124,  (124, "ATI", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00913   312   NtDeleteValueKey  (124,  (124, "Acrobat", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00914   312   NtDeleteValueKey  (124,  (124, "Acrobat Update", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00915   312   NtDeleteValueKey  (124,  (124, "Acrobat Read", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00916   312   NtDeleteValueKey  (124,  (124, "rasman", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00917   312   NtDeleteValueKey  (124,  (124, "ActiveSync", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00918   312   NtClose  (124, ... ) == 0x0
 00919   312   NtUserRegisterClassExWOW  (1244088, 1244164, 1244180, 1244152, 0, 386, 0, ... ) == 0x810ec0cb
 00920   312   NtUserCreateWindowEx  (-2147483648, 1244072, 1243884, "-2147483648, 0, 0, 1, 1, 0, 0, 0, 0, 1073742848, 0, ...
 00921   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1240268, ... ) }, 1240268, ... ) == 0x0
 00922   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 124, {status=0x0, info=1}, ) }, 5, 96, ... 124, {status=0x0, info=1}, ) == 0x0
 00923   312   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 124, ... 128, ) == 0x0
 00924   312   NtClose  (124, ... ) == 0x0
 00925   312   NtMapViewOfSection  (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x380000), 0x0, 204800, ) == 0x0
 00926   312   NtClose  (128, ... ) == 0x0
 00927   312   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 00928   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1240584, ... ) }, 1240584, ... ) == 0x0
 00929   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0
 00930   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 128, ... 124, ) == 0x0
 00931   312   NtQuerySection  (124, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00932   312   NtClose  (128, ... ) == 0x0
 00933   312   NtMapViewOfSection  (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 212992, ) == 0x0
 00934   312   NtClose  (124, ... ) == 0x0
 00935   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00936   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00937   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00938   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00939   312   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00940   312   NtClose  (124, ... ) == 0x0
 00941   312   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 124, ) }, ... 124, ) == 0x0
 00942   312   NtOpenKey  (0x1, {24, 124, 0x40, 0, 0,  (0x1, {24, 124, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 128, ) }, ... 128, ) == 0x0
 00943   312   NtQueryValueKey  (128,  (128, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00944   312   NtClose  (128, ... ) == 0x0
 00945   312   NtClose  (124, ... ) == 0x0
 00946   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00947   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00948   312   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00949   312   NtClose  (124, ... ) == 0x0
 00950   312   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 124, ) }, ... 124, ) == 0x0
 00951   312   NtOpenKey  (0x1, {24, 124, 0x40, 0, 0,  (0x1, {24, 124, 0x40, 0, 0, "Control Panel\Desktop"}, ... 128, ) }, ... 128, ) == 0x0
 00952   312   NtQueryValueKey  (128,  (128, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00953   312   NtClose  (128, ... ) == 0x0
 00954   312   NtClose  (124, ... ) == 0x0
 00955   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00956   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00957   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == 0x0
 00958   312   NtUserGetProcessWindowStation  (... ) == 0x24
 00959   312   NtUserGetObjectInformation  (36, 2, 0, 0, 1242380, ... ) == 0x0
 00960   312   NtUserGetObjectInformation  (36, 2, 1370248, 16, 1242380, ... ) == 0x1
 00961   312   NtUserGetGUIThreadInfo  (312, 1242336, ... ) == 0x1
 00962   312   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1242156, 64, ... 124, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1242156, 64, ... 124, 0x0, 0x0, 0x0, 64, ) == 0x0
 00963   312   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 304, 312, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 304, 312, 1511, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 304, 312, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00964   312   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 304, 312, 1512, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 304, 312, 1512, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 304, 312, 1512, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00965   312   NtUserCallNoParam  (29, ...
 00966   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239628, ... ) }, 1239628, ... ) == 0x0
 00965   312   NtUserCallNoParam  ... ) == 0x0
 00967   312   NtUserSystemParametersInfo  (41, 0, 1524225160, 0, ... ) == 0x1
 00968   312   NtGdiHfontCreate  (1241708, 356, 0, 0, 1344040, ... ) == 0xf0a040b
 00969   312   NtGdiHfontCreate  (1241708, 356, 0, 0, 1344032, ... ) == 0xe0a0402
 00970   312   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 304, 312, 1513, 0} "\0\0\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 304, 312, 1513, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 304, 312, 1513, 0} "\0\0\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00971   312   NtMapViewOfSection  (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x380000), {0, 0}, 331776, ) == 0x0
 00972   312   NtAllocateVirtualMemory  (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0
 00973   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00974   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00975   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00976   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00977   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00978   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00979   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00980   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00981   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00982   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00983   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00984   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00985   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00986   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00987   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00988   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00989   312   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00990   312   NtGdiCreatePatternBrushInternal  (59048369, 0, 0, ... ) == 0xc100418
 00991   312   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00992   312   NtUserCallNoParam  (29, ...
 00993   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239072, ... ) }, 1239072, ... ) == 0x0
 00992   312   NtUserCallNoParam  ... ) == 0x0
 00994   312   NtUserCallNoParam  (29, ...
 00995   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239068, ... ) }, 1239068, ... ) == 0x0
 00994   312   NtUserCallNoParam  ... ) == 0x0
 00996   312   NtUserMessageCall  (0x200b4, WM_NCCREATE, 0x0, 0x12f618, 0, 670, 1, ... ) == 0x1
 00997   312   NtUserMessageCall  (0x200b4, WM_NCCALCSIZE, 0x0, 0x12f64c, 0, 670, 1, ... ) == 0x0
 00998   312   NtUserSetProp  (131252, 43288, -1, ... ) == 0x1
 00999   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1240540,  (0x80100080, {24, 0, 0x40, 0, 1240540, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0
 01000   312   NtQueryInformationFile  (132, 1241476, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01001   312   NtQueryInformationFile  (132, 1241448, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01002   312   NtQueryInformationFile  (132, 1241400, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01003   312   NtAllocateVirtualMemory  (-1, 1372160, 0, 8192, 4096, 4, ... 1372160, 8192, ) == 0x0
 01004   312   NtQueryInformationFile  (132, 1371280, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01005   312   NtQueryInformationFile  (132, 1239944, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01006   312   NtQueryInformationFile  (132, 1239788, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01007   312   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1239796,  (0x40110080, {24, 0, 0x40, 0, 1239796, "\??\C:\WINDOWS\System32\qmedia.exe"}, 0x0, 32, 0, 2, 100, 0, 0, ... 136, {status=0x0, info=2}, ) }, 0x0, 32, 0, 2, 100, 0, 0, ... 136, {status=0x0, info=2}, ) == 0x0
 01008   312   NtQueryVolumeInformationFile  (136, 1239168, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01009   312   NtQueryInformationFile  (136, 1239128, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01010   312   NtQueryVolumeInformationFile  (132, 1239168, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01011   312   NtSetInformationFile  (136, 1238956, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01012   312   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 132, ... 140, ) == 0x0
 01013   312   NtMapViewOfSection  (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3e0000), {0, 0}, 49152, ) == 0x0
 01014   312   NtClose  (140, ... ) == 0x0
 01015   312   NtWriteFile  (136, 0, 0, 0,  (136, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\23\267z\336W\326\24\215W\326\24\215W\326\24\215D\336I\215U\326\24\215\324\336I\215U\326\24\215\255\365\15\215T\326\24\215W\326\25\215g\326\24\215R\332t\215\\326\24\215R\332N\215V\326\24\215RichW\326\24\215\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\204v$F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0R\0\0\0|\0\0\0\0\0\0@\24\0\0\0\20\0\0\0p\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\1\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\340q\0\0P\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0p\0\0\314\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0CODE\0\0\0\0\301\4\0\0\0\20\0\0\0\6\0\0\0\4\0\0\0\0\0\0", 48640, 0x0, 0, ... {status=0x0, info=48640}, ) , 48640, 0x0, 0, ... {status=0x0, info=48640}, ) == 0x0
 01016   312   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01017   312   NtSetInformationFile  (136, 1241400, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01018   312   NtClose  (132, ... ) == 0x0
 01019   312   NtClose  (136, ... ) == 0x0
 01020   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Userenv.dll"}, ... 136, ) }, ... 136, ) == 0x0
 01021   312   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 01022   312   NtClose  (136, ... ) == 0x0
 01023   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01024   312   NtQueryValueKey  (136,  (136, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01025   312   NtClose  (136, ... ) == 0x0
 01026   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01027   312   NtQueryValueKey  (136,  (136, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01028   312   NtClose  (136, ... ) == 0x0
 01029   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 136, ) }, ... 136, ) == 0x0
 01030   312   NtQueryValueKey  (136,  (136, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 01031   312   NtClose  (136, ... ) == 0x0
 01032   312   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1238492, 0,  (0x1f0003, {24, 52, 0x80, 1238492, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 136, ) }, 0, 1, ... 136, ) == STATUS_OBJECT_NAME_EXISTS
 01033   312   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 01034   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01035   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01036   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01037   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01038   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01039   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01040   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01041   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01042   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01043   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01044   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01045   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01046   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01047   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01048   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01049   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01050   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01051   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01052   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01053   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01054   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01055   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01056   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01057   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01058   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01059   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01060   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01061   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 132, ) == 0x0
 01062   312   NtQueryInformationToken  (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01063   312   NtClose  (132, ... ) == 0x0
 01064   312   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 132, ) }, ... 132, ) == 0x0
 01065   312   NtOpenKey  (0x20019, {24, 132, 0x40, 0, 0,  (0x20019, {24, 132, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 140, ) }, ... 140, ) == 0x0
 01066   312   NtQueryValueKey  (140,  (140, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (140, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 01067   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01068   312   NtQueryValueKey  (140,  (140, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (140, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 01069   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01070   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01071   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01072   312   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01073   312   NtClose  (140, ... ) == 0x0
 01074   312   NtClose  (132, ... ) == 0x0
 01075   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01076   312   NtQueryValueKey  (132,  (132, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01077   312   NtClose  (132, ... ) == 0x0
 01078   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01079   312   NtQueryValueKey  (132,  (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01080   312   NtQueryValueKey  (132,  (132, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01081   312   NtClose  (132, ... ) == 0x0
 01082   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01083   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01084   312   NtQueryValueKey  (132,  (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01085   312   NtClose  (132, ... ) == 0x0
 01086   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01087   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 132, ) }, ... 132, ) == 0x0
 01088   312   NtQueryValueKey  (132,  (132, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 01089   312   NtClose  (132, ... ) == 0x0
 01090   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 132, ) }, ... 132, ) == 0x0
 01091   312   NtQueryValueKey  (132,  (132, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 01092   312   NtClose  (132, ... ) == 0x0
 01093   312   NtClose  (136, ... ) == 0x0
 01094   312   NtUnmapViewOfSection  (-1, 0x75a70000, ... ) == 0x0
 01095   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239732,  (0x80100080, {24, 0, 0x40, 0, 1239732, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 136, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 136, {status=0x0, info=1}, ) == 0x0
 01096   312   NtQueryInformationFile  (136, 1240668, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01097   312   NtQueryInformationFile  (136, 1240640, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01098   312   NtQueryInformationFile  (136, 1240592, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01099   312   NtQueryInformationFile  (136, 1371584, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01100   312   NtQueryInformationFile  (136, 1239136, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01101   312   NtQueryInformationFile  (136, 1238980, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01102   312   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1238988,  (0x40110080, {24, 0, 0x40, 0, 1238988, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\icq.exe"}, 0x0, 32, 0, 2, 100, 0, 0, ... 132, {status=0x0, info=2}, ) }, 0x0, 32, 0, 2, 100, 0, 0, ... 132, {status=0x0, info=2}, ) == 0x0
 01103   312   NtQueryVolumeInformationFile  (132, 1238360, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01104   312   NtQueryInformationFile  (132, 1238320, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01105   312   NtQueryVolumeInformationFile  (136, 1238360, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01106   312   NtSetInformationFile  (132, 1238148, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01107   312   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 136, ... 140, ) == 0x0
 01108   312   NtMapViewOfSection  (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3e0000), {0, 0}, 49152, ) == 0x0
 01109   312   NtClose  (140, ... ) == 0x0
 01110   312   NtWriteFile  (132, 0, 0, 0,  (132, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\23\267z\336W\326\24\215W\326\24\215W\326\24\215D\336I\215U\326\24\215\324\336I\215U\326\24\215\255\365\15\215T\326\24\215W\326\25\215g\326\24\215R\332t\215\\326\24\215R\332N\215V\326\24\215RichW\326\24\215\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\204v$F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0R\0\0\0|\0\0\0\0\0\0@\24\0\0\0\20\0\0\0p\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\1\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\340q\0\0P\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0p\0\0\314\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0CODE\0\0\0\0\301\4\0\0\0\20\0\0\0\6\0\0\0\4\0\0\0\0\0\0", 48640, 0x0, 0, ... {status=0x0, info=48640}, ) , 48640, 0x0, 0, ... {status=0x0, info=48640}, ) == 0x0
 01111   312   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01112   312   NtSetInformationFile  (132, 1240592, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01113   312   NtClose  (136, ... ) == 0x0
 01114   312   NtClose  (132, ... ) == 0x0
 01115   312   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 132, 2, ) }, 0, 0x0, 0, ... 132, 2, ) == 0x0
 01116   312   NtSetValueKey  (132,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 0, 1,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 520, ...
 01117   312   NtSetInformationFile  (-2147482808, -136316476, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01118   312   NtSetInformationFile  (-2147482808, -136316568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01119   312   NtSetInformationFile  (-2147482808, -136316876, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01116   312   NtSetValueKey  ... ) == 0x0
 01120   312   NtClose  (132, ... ) == 0x0
 01121   312   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 132, 2, ) }, 0, 0x0, 0, ... 132, 2, ) == 0x0
 01122   312   NtSetValueKey  (132,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 0, 1,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 520, ...
 01123   312   NtSetInformationFile  (-2147482704, -136316476, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01124   312   NtSetInformationFile  (-2147482704, -136316512, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01125   312   NtSetInformationFile  (-2147482704, -136316568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01126   312   NtSetInformationFile  (-2147482704, -136316876, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01127   312   NtSetInformationFile  (-2147482704, -136316924, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01122   312   NtSetValueKey  ... ) == 0x0
 01128   312   NtClose  (132, ... ) == 0x0
 01129   312   NtUserSetTimer  (131252, 101, 2000, 0, ... ) == 0x65
 01130   312   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9437184, 1048576, ) == 0x0
 01131   312   NtAllocateVirtualMemory  (-1, 10477568, 0, 8192, 4096, 4, ... 10477568, 8192, ) == 0x0
 01132   312   NtProtectVirtualMemory  (-1, (0x9fe000), 4096, 260, ... (0x9fe000), 4096, 4, ) == 0x0
 01133   312   NtCreateThread  (0x1f03ff, 0x0, -1, 1240860, 1241576, 1, ... 132, {304, 548}, ) == 0x0
 01134   312   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=304,Tid=548,}, 0x0, ) == 0x0
 01135   312   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132}  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\00\1\0\0$\2\0\0" ... {28, 56, reply, 0, 304, 312, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\00\1\0\0$\2\0\0" )  ... {28, 56, reply, 0, 304, 312, 1515, 0}  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\00\1\0\0$\2\0\0" ... {28, 56, reply, 0, 304, 312, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\00\1\0\0$\2\0\0" )  ) == 0x0
 01136   312   NtResumeThread  (132, ... 1, ) == 0x0
 01137   548   NtTestAlert  (... ) == 0x0
 01138   548   NtContinue  (10485040, 1, ...
 01139   548   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01140   548   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 136, ) == 0x0
 01141   548   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01142   548   NtAllocateVirtualMemory  (-1, 10473472, 0, 4096, 4096, 260, ...
 00920   312   NtUserCreateWindowEx  ... ) == 0x200b4
 01143   312   NtUserGetMessage  (0, 0, 0, ...
 01142   548   NtAllocateVirtualMemory  ... 10473472, 4096, ) == 0x0
 01144   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10481004, ... ) }, 10481004, ... ) == 0x0
 01145   548   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 140, {status=0x0, info=1}, ) }, 5, 96, ... 140, {status=0x0, info=1}, ) == 0x0
 01146   548   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 140, ... 144, ) == 0x0
 01147   548   NtClose  (140, ... ) == 0x0
 01148   548   NtMapViewOfSection  (144, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa00000), 0x0, 229376, ) == 0x0
 01149   548   NtClose  (144, ... ) == 0x0
 01150   548   NtUnmapViewOfSection  (-1, 0xa00000, ... ) == 0x0
 01151   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10481320, ... ) }, 10481320, ... ) == 0x0
 01152   548   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 144, {status=0x0, info=1}, ) }, 5, 96, ... 144, {status=0x0, info=1}, ) == 0x0
 01153   548   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 144, ... 140, ) == 0x0
 01154   548   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01155   548   NtClose  (144, ... ) == 0x0
 01156   548   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 241664, ) == 0x0
 01157   548   NtClose  (140, ... ) == 0x0
 01158   548   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01159   548   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01160   548   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 140, ) == 0x0
 01161   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10480648, ... ) }, 10480648, ... ) == 0x0
 01162   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... 144, ) }, ... 144, ) == 0x0
 01163   548   NtQueryValueKey  (144,  (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) , Partial, 144, ... TitleIdx=0, Type=7, Data= (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) }, 42, ) == 0x0
 01164   548   NtQueryValueKey  (144,  (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) , Partial, 144, ... TitleIdx=0, Type=7, Data= (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) }, 42, ) == 0x0
 01165   548   NtClose  (144, ... ) == 0x0
 01166   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... 144, ) }, ... 144, ) == 0x0
 01167   548   NtQueryValueKey  (144,  (144, "Mapping", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01168   548   NtQueryValueKey  (144,  (144, "Mapping", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01169   548   NtQueryValueKey  (144,  (144, "Mapping", Partial, 152, ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) , Partial, 152, ... TitleIdx=0, Type=3, Data= (144, "Mapping", Partial, 152, ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01170   548   NtClose  (144, ... ) == 0x0
 01171   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... 144, ) }, ... 144, ) == 0x0
 01172   548   NtQueryValueKey  (144,  (144, "MinSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "MinSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01173   548   NtQueryValueKey  (144,  (144, "MaxSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "MaxSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01174   548   NtQueryValueKey  (144,  (144, "UseDelayedAcceptance", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "UseDelayedAcceptance", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01175   548   NtQueryValueKey  (144,  (144, "HelperDllName", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "HelperDllName", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01176   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 10481568, ... ) }, 10481568, ... ) == 0x0
 01177   548   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 01178   548   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 148, ... 152, ) == 0x0
 01179   548   NtClose  (148, ... ) == 0x0
 01180   548   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3e0000), 0x0, 20480, ) == 0x0
 01181   548   NtClose  (152, ... ) == 0x0
 01182   548   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01183   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 10481884, ... ) }, 10481884, ... ) == 0x0
 01184   548   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 01185   548   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 152, ... 148, ) == 0x0
 01186   548   NtQuerySection  (148, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01187   548   NtClose  (152, ... ) == 0x0
 01188   548   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 01189   548   NtClose  (148, ... ) == 0x0
 01190   548   NtClose  (144, ... ) == 0x0
 01191   548   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 10484084, 75, ... }, 0x0, 0, 3, 3, 0, 10484084, 75, ...
 01192   548   NtClose  (-2147482036, ... ) == 0x0
 01191   548   NtCreateFile  ... 144, {status=0x0, info=0}, ) == 0x0
 01193   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x1207b,  (144, 140, 0x0, 0x0, 0x1207b, "\7\0\0\0\340\0\0\0\30\361\24\0\17\346\367w", 16, 16, ... {status=0x0, info=16}, "\7\0\0\0B\0\0\0\0 \0\0H\263\14\201", ) , 16, 16, ... {status=0x0, info=16},  (144, 140, 0x0, 0x0, 0x1207b, "\7\0\0\0\340\0\0\0\30\361\24\0\17\346\367w", 16, 16, ... {status=0x0, info=16}, "\7\0\0\0B\0\0\0\0 \0\0H\263\14\201", ) , ) == 0x0
 01194   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x1207b,  (144, 140, 0x0, 0x0, 0x1207b, "\6\0\0\0B\0\0\0\0 \0\0H\263\14\201", 16, 16, ... {status=0x0, info=16}, "\6\0\0\0B\0\0\0\0 \0\0H\263\14\201", ) , 16, 16, ... {status=0x0, info=16},  (144, 140, 0x0, 0x0, 0x1207b, "\6\0\0\0B\0\0\0\0 \0\0H\263\14\201", 16, 16, ... {status=0x0, info=16}, "\6\0\0\0B\0\0\0\0 \0\0H\263\14\201", ) , ) == 0x0
 01195   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12047,  (144, 140, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\353\3\0\0\11\6\2\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\30\361\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... {status=0x0, info=0}, "", ) , 248, 16, ... {status=0x0, info=0}, "", ) == 0x0
 01196   548   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01197   548   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 01198   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01199   548   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01200   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01201   548   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01202   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == 0x0
 01203   548   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 01204   548   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 152, ) == 0x0
 01205   548   NtQuerySection  (152, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01206   548   NtClose  (148, ... ) == 0x0
 01207   548   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 151552, ) == 0x0
 01208   548   NtClose  (152, ... ) == 0x0
 01209   548   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 152, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 152, 2, ) , 0, ... 152, 2, ) == 0x0
 01210   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 148, ) }, ... 148, ) == 0x0
 01211   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   548   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DNS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01213   548   NtQueryValueKey  (148,  (148, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01214   548   NtQueryValueKey  (152,  (152, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01215   548   NtQueryValueKey  (148,  (148, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01216   548   NtQueryValueKey  (152,  (152, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01217   548   NtQueryValueKey  (148,  (148, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   548   NtQueryValueKey  (152,  (152, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01219   548   NtQueryValueKey  (148,  (148, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01220   548   NtQueryValueKey  (152,  (152, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01221   548   NtQueryValueKey  (148,  (148, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01222   548   NtQueryValueKey  (148,  (148, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01223   548   NtQueryValueKey  (148,  (148, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01224   548   NtQueryValueKey  (148,  (148, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01225   548   NtQueryValueKey  (148,  (148, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01226   548   NtQueryValueKey  (148,  (148, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01227   548   NtQueryValueKey  (148,  (148, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01228   548   NtQueryValueKey  (152,  (152, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01229   548   NtQueryValueKey  (148,  (148, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01230   548   NtQueryValueKey  (148,  (148, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01231   548   NtQueryValueKey  (152,  (152, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01232   548   NtQueryValueKey  (148,  (148, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01233   548   NtQueryValueKey  (152,  (152, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01234   548   NtQueryValueKey  (148,  (148, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01235   548   NtQueryValueKey  (152,  (152, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01236   548   NtQueryValueKey  (148,  (148, "RegistrationOverwritesInConflict", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01237   548   NtQueryValueKey  (152,  (152, "DisableReplaceAddressesInConflicts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01238   548   NtQueryValueKey  (148,  (148, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01239   548   NtQueryValueKey  (152,  (152, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01240   548   NtQueryValueKey  (148,  (148, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01241   548   NtQueryValueKey  (152,  (152, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01242   548   NtQueryValueKey  (148,  (148, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01243   548   NtQueryValueKey  (152,  (152, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01244   548   NtQueryValueKey  (148,  (148, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01245   548   NtQueryValueKey  (152,  (152, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01246   548   NtQueryValueKey  (148,  (148, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01247   548   NtQueryValueKey  (148,  (148, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01248   548   NtQueryValueKey  (148,  (148, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01249   548   NtQueryValueKey  (148,  (148, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01250   548   NtQueryValueKey  (148,  (148, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01251   548   NtQueryValueKey  (148,  (148, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01252   548   NtQueryValueKey  (148,  (148, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01253   548   NtQueryValueKey  (148,  (148, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01254   548   NtQueryValueKey  (148,  (148, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01255   548   NtQueryValueKey  (148,  (148, "UseMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01256   548   NtQueryValueKey  (148,  (148, "MulticastOnNameError", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01257   548   NtQueryValueKey  (148,  (148, "UseDotLocalDomain", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01258   548   NtQueryValueKey  (148,  (148, "ListenOnMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01259   548   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 156, ) }, ... 156, ) == 0x0
 01260   548   NtQueryValueKey  (156,  (156, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (156, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01261   548   NtClose  (156, ... ) == 0x0
 01262   548   NtClose  (152, ... ) == 0x0
 01263   548   NtClose  (148, ... ) == 0x0
 01264   548   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 148, ) }, ... 148, ) == 0x0
 01265   548   NtQueryValueKey  (148,  (148, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01266   548   NtQueryValueKey  (148,  (148, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01267   548   NtQueryValueKey  (148,  (148, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01268   548   NtClose  (148, ... ) == 0x0
 01269   548   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01270   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01271   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 148, ) }, ... 148, ) == 0x0
 01272   548   NtQueryValueKey  (148,  (148, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01273   548   NtClose  (148, ... ) == 0x0
 01274   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01275   548   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0
 01276   548   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 152, ) == 0x0
 01277   548   NtQuerySystemTime  (... {-2131528520, 29873119}, ) == 0x0
 01278   548   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 156, ) == 0x0
 01279   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01280   548   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01281   548   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01282   548   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01283   548   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 160, ) == 0x0
 01284   548   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 164, ) == 0x0
 01285   548   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01286   548   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481416, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481416, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01287   548   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850}  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 548, 1517, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 548, 1517, 0}  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 548, 1517, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" )  ) == 0x0
 01288   548   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0
 01289   548   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 0, 0, 0, 0, 0}  (172, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 304, 548, 1518, 0} "\2\213,\370\1\0,\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200Z\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 304, 548, 1518, 0}  (172, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 304, 548, 1518, 0} "\2\213,\370\1\0,\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200Z\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01290   548   NtClose  (168, ... ) == 0x0
 01291   548   NtClose  (172, ... ) == 0x0
 01292   548   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01293   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01294   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01295   548   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01296   548   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01297   548   NtClose  (172, ... ) == 0x0
 01298   548   NtClose  (168, ... ) == 0x0
 01299   548   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01300   548   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481280, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481280, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01301   548   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850}  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 548, 1521, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 548, 1521, 0}  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 548, 1521, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 01302   548   NtRequestWaitReplyPort  (172, {44, 68, new_msg, 0, 304, 548, 1518, 0}  (172, {44, 68, new_msg, 0, 304, 548, 1518, 0} "\1\213\0\0A\2\4\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 304, 548, 1522, 0} "\2\213,\370\4\0,\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\324\1\0\0\240,\11\0" )  ... {40, 64, reply, 0, 304, 548, 1522, 0}  (172, {44, 68, new_msg, 0, 304, 548, 1518, 0} "\1\213\0\0A\2\4\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 304, 548, 1522, 0} "\2\213,\370\4\0,\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\324\1\0\0\240,\11\0" )  ) == 0x0
 01303   548   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 56, 0, 1, 0, 0}  (172, {64, 88, new_msg, 56, 0, 1, 0, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {64, 88, reply, 56, 304, 548, 1523, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {64, 88, reply, 56, 304, 548, 1523, 0}  (172, {64, 88, new_msg, 56, 0, 1, 0, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {64, 88, reply, 56, 304, 548, 1523, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01304   548   NtClose  (168, ... ) == 0x0
 01305   548   NtClose  (172, ... ) == 0x0
 01306   548   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01307   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01308   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01309   548   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01310   548   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01311   548   NtClose  (172, ... ) == 0x0
 01312   548   NtClose  (168, ... ) == 0x0
 01313   548   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01314   548   NtQueryValueKey  (168,  (168, "DnsNbtLookupOrder", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01315   548   NtClose  (168, ... ) == 0x0
 01316   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01317   548   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 168, {status=0x0, info=1}, ) }, 5, 96, ... 168, {status=0x0, info=1}, ) == 0x0
 01318   548   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 168, ... 172, ) == 0x0
 01319   548   NtClose  (168, ... ) == 0x0
 01320   548   NtMapViewOfSection  (172, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3e0000), 0x0, 16384, ) == 0x0
 01321   548   NtClose  (172, ... ) == 0x0
 01322   548   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01323   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 10481140, ... ) }, 10481140, ... ) == 0x0
 01324   548   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01325   548   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 168, ) == 0x0
 01326   548   NtQuerySection  (168, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01327   548   NtClose  (172, ... ) == 0x0
 01328   548   NtMapViewOfSection  (168, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fb0000), 0x0, 28672, ) == 0x0
 01329   548   NtClose  (168, ... ) == 0x0
 01330   548   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 168, ) }, ... 168, ) == 0x0
 01331   548   NtMapViewOfSection  (168, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0
 01332   548   NtClose  (168, ... ) == 0x0
 01333   548   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01334   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 172, ) }, ... 172, ) == 0x0
 01335   548   NtQueryValueKey  (172,  (172, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01336   548   NtClose  (172, ... ) == 0x0
 01337   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01338   548   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01339   548   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4063232, 65536, ) == 0x0
 01340   548   NtAllocateVirtualMemory  (-1, 4063232, 0, 4096, 4096, 4, ... 4063232, 4096, ) == 0x0
 01341   548   NtAllocateVirtualMemory  (-1, 4067328, 0, 8192, 4096, 4, ... 4067328, 8192, ) == 0x0
 01342   548   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01343   548   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481112, 112, ... 176, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481112, 112, ... 176, 0x0, 0x0, 0x0, 112, ) == 0x0
 01344   548   NtRequestWaitReplyPort  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850}  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850} "\0\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 548, 1526, 0} "\7\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 548, 1526, 0}  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850} "\0\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 548, 1526, 0} "\7\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" )  ) == 0x0
 01345   548   NtRequestWaitReplyPort  (176, {64, 88, new_msg, 0, 304, 548, 1522, 0}  (176, {64, 88, new_msg, 0, 304, 548, 1522, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 304, 548, 1527, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 304, 548, 1527, 0}  (176, {64, 88, new_msg, 0, 304, 548, 1522, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 304, 548, 1527, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01346   548   NtClose  (172, ... ) == 0x0
 01347   548   NtClose  (176, ... ) == 0x0
 01348   548   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) , 0, ... 176, 2, ) == 0x0
 01349   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01350   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01351   548   NtQueryValueKey  (176,  (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01352   548   NtQueryValueKey  (176,  (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01353   548   NtClose  (176, ... ) == 0x0
 01354   548   NtClose  (172, ... ) == 0x0
 01355   548   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01356   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 176, ) }, ... 176, ) == 0x0
 01357   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01358   548   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01359   548   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01360   548   NtClose  (172, ... ) == 0x0
 01361   548   NtClose  (176, ... ) == 0x0
 01362   548   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 01363   548   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0
 01364   548   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 176, ) == 0x0
 01365   548   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10480912, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10480912, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01366   548   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850}  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850} "\0\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 548, 1530, 0} "\7\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 548, 1530, 0}  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850} "\0\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 548, 1530, 0} "\7\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 01367   548   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 0, 304, 548, 1527, 0}  (172, {64, 88, new_msg, 0, 304, 548, 1527, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 304, 548, 1531, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 304, 548, 1531, 0}  (172, {64, 88, new_msg, 0, 304, 548, 1527, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 304, 548, 1531, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01368   548   NtClose  (176, ... ) == 0x0
 01369   548   NtClose  (172, ... ) == 0x0
 01370   548   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01371   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 176, ) }, ... 176, ) == 0x0
 01372   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01373   548   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01374   548   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01375   548   NtClose  (172, ... ) == 0x0
 01376   548   NtClose  (176, ... ) == 0x0
 01377   548   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) , 0, ... 176, 2, ) == 0x0
 01378   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01379   548   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01380   548   NtQueryValueKey  (176,  (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01381   548   NtQueryValueKey  (176,  (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01382   548   NtClose  (176, ... ) == 0x0
 01383   548   NtClose  (172, ... ) == 0x0
 01384   548   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01385   548   NtQueryValueKey  (172,  (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01386   548   NtQueryValueKey  (172,  (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01387   548   NtQueryValueKey  (172,  (172, "AutodialDLL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01388   548   NtClose  (172, ... ) == 0x0
 01389   548   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rasadhlp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01390   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01391   548   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01392   548   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == 0x0
 01393   548   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasadhlp.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01394   548   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 176, ) == 0x0
 01395   548   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01396   548   NtClose  (172, ... ) == 0x0
 01397   548   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fc0000), 0x0, 20480, ) == 0x0
 01398   548   NtClose  (176, ... ) == 0x0
 01399   548   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 176, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 176, {status=0x0, info=0}, ) == 0x0
 01400   548   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01401   548   NtDeviceIoControlFile  (176, 172, 0x0, 0x0, 0xf14014,  (176, 172, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\20\0\0\0\0\360\375\177h\2\374v\1\0\0\0\340\361\237\0D\365\237\0D\365\237\0\2$\370w\310j\367w\377\377\377\377\364j\365w$P\374w`i\365w\0\0\0\0\10\0\25\300\0\0\0\0\10\6\24\0@.$\0\254\36$\0\210/$\0\0\320\375\177\24\232\347wS\16\26\0\200\17\25\0\216\17\25\0T\16\25\0x/$\0\30\0\26\2\20\363\237\0\20\363\237\0r\0a\0s\0a\0d\0h\0l\0p\0.\0d\0l\0l\0\0\0\0\0T\16\25\0\377\377\0\0\1\0\0\0\370\24\25\0\240\31\25\0 \0\0\0\0\0\0\0\210\1\24\0\230\31\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245qH\16\25\04\16\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\260\31\1\1\0\0\24\0\340\362\237\0\300\367\237\0\334\377\237\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\260\31\25\0\210\350\24\0@\203\24\0X\203\24\0\200\17\25\0\216\17\25\0T\16\25\0\377\377\0\0\0\0\0\0T\16\25\0\7\0\0\0\200\17\25\0\20\364\237\0\177;\245q\0\0\0\0\0\0\0\0\200\17\25\0\0\0\0\0T\16\25\0\377\377\0\0\1\0\0\0\230\1\24\0\350\24\25\0\20\0\0\0\0\0\0\0\230\1\24\0\340\24\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245qH\16\25\04\16\25\0\4\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\247\1\1\0\0\24\0\250\363\237\0\210\370\237\0\334\377\237\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\247\24\0\210\350\24\0@\203\24\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) , 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01402   548   NtClose  (172, ... ) == 0x0
 01403   548   NtClose  (176, ... ) == 0x0
 01404   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12003,  (144, 140, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0,\354\300\250|\201\0\0\0\0\0\0\0\0", 26, 26, ... {status=0x0, info=176}, "\1\0\0\0\1\0\0\0\16\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0", ) , 26, 26, ... {status=0x0, info=176},  (144, 140, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0,\354\300\250|\201\0\0\0\0\0\0\0\0", 26, 26, ... {status=0x0, info=176}, "\1\0\0\0\1\0\0\0\16\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01405   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12037,  (144, 140, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , 4, 8, ... {status=0x0, info=8},  (144, 140, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01406   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12047,  (144, 140, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\353\3\0\0\11\6\2\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\0\0\0\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... {status=0x0, info=0}, 0x0, ) , 248, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01407   548   NtDeviceIoControlFile  (176, 0, 0x0, 0x0, 0x120028,  (176, 0, 0x0, 0x0, 0x120028, "\1\4\0\0\0\0\0\0\0\2\0\0\0\2\0\0\15\0\0\0\4\0\0\0\1\0\0\00}\0\0", 32, 0, ... {status=0x0, info=0}, 0x0, ) , 32, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01408   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=0}, 0x0, ) , 16, 0, ... {status=0x103, info=0}, 0x0, ) == 0x103
 01409   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01410   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=40}, 0x0, ) , 16, 0, ... {status=0x103, info=40}, 0x0, ) == 0x103
 01411   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01412   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=78}, 0x0, ) , 16, 0, ... {status=0x103, info=78}, 0x0, ) == 0x103
 01413   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01414   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=81}, 0x0, ) , 16, 0, ... {status=0x0, info=81}, 0x0, ) == 0x0
 01415   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01416   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01417   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01418   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=128}, 0x0, ) , 16, 0, ... {status=0x0, info=128}, 0x0, ) == 0x0
 01419   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01420   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01421   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01422   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01423   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01424   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01425   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01426   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01427   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01428   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01429   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01430   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01431   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01432   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01433   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01434   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01435   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01436   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01437   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01438   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01439   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01440   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01441   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01442   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01443   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01444   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01445   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01446   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01447   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01448   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01449   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01450   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01451   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01452   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01453   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01454   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01455   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01456   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01457   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01458   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01459   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01460   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01461   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01462   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01463   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01464   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01465   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01466   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01467   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01468   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01469   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01470   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01471   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01472   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01473   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01474   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01475   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01476   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01477   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01478   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01479   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01480   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01481   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01482   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01483   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01484   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01485   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01486   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01487   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01488   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01489   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01490   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01491   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01492   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01493   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01494   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01495   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01496   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01497   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01498   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01499   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01500   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01501   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01502   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01503   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01504   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01505   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01506   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01507   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01508   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01509   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01510   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01511   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01512   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01513   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01514   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01515   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01516   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01517   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01518   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01519   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01520   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01521   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01522   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01523   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01524   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01525   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01526   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01527   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01528   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01529   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01530   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01531   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01532   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01533   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01534   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01535   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01536   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01537   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01538   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01539   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01540   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01541   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01542   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01543   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01544   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01545   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01546   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01547   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01548   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01549   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01550   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01551   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01552   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01553   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01554   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01555   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01556   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01557   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01558   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01559   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01560   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01561   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01562   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01563   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01564   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01565   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01566   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01567   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01568   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01569   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01570   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01571   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01572   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01573   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01574   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01575   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01576   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01577   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01578   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01579   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01580   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01581   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01582   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01583   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01584   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01585   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01586   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01587   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01588   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01589   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01590   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01591   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01592   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01593   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01594   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01595   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01596   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01597   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01598   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01599   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01600   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01601   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01602   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01603   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01604   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01605   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01606   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01607   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01608   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01609   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01610   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01611   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01612   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01613   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01614   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01615   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01616   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01617   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01618   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01619   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01620   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01621   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01622   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01623   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01624   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01625   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01626   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01627   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01628   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01629   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01630   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01631   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01632   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01633   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01634   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01635   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01636   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01637   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01638   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01639   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01640   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01641   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01642   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01643   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01644   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01645   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01646   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01647   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01648   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01649   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01650   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01651   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01652   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01653   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01654   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01655   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01656   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01657   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01658   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01659   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01660   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01661   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01662   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01663   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01664   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01665   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01666   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01667   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01668   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01669   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01670   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01671   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01672   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01673   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01674   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01675   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01676   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01677   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01678   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01679   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01680   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01681   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01682   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01683   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01684   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01685   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01686   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01687   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01688   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01689   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01690   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01691   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01692   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01693   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01694   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01695   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01696   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01697   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01698   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01699   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01700   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01701   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01702   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01703   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01704   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01705   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01706   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01707   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01708   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01709   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01710   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01711   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01712   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01713   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01714   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01715   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01716   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01717   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01718   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01719   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01720   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01721   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01722   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01723   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01724   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01725   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01726   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01727   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01728   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01729   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01730   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01731   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01732   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01733   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01734   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01735   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01736   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01737   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01738   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01739   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01740   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01741   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01742   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01743   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01744   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01745   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01746   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01747   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01748   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01749   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01750   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01751   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01752   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01753   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01754   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01755   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01756   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01757   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01758   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01759   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01760   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01761   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01762   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01763   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01764   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01765   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01766   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01767   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01768   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01769   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01770   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01771   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01772   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01773   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01774   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01775   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01776   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01777   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01778   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01779   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01780   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01781   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01782   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01783   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01784   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01785   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01786   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01787   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01788   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01789   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01790   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01791   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01792   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01793   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01794   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01795   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01796   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01797   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01798   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01799   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01800   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01801   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01802   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01803   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01804   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01805   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01806   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01807   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01808   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01809   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01810   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01811   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01812   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01813   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01814   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01815   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01816   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01817   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01818   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01819   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01820   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01821   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01822   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01823   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01824   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01825   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01826   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01827   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01828   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01829   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01830   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01831   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01832   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01833   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01834   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01835   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01836   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01837   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01838   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01839   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01840   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01841   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01842   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01843   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01844   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01845   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01846   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01847   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01848   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01849   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01850   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01851   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01852   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01853   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01854   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01855   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01856   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01857   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01858   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01859   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01860   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01861   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01862   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01863   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01864   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01865   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01866   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01867   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01868   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01869   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01870   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01871   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01872   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01873   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01874   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01875   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01876   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01877   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01878   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01879   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01880   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01881   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x102
 01882   548   NtQuerySystemTime  (... {-2118247270, 29873119}, ) == 0x0
 01883   548   NtWaitForSingleObject  (140, 1, {-1, 2147483647}, ... ) == 0x0
 01884   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01885   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01886   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01143   312   NtUserGetMessage  ... {0x200b4, WM_TIMER, 0x65, 0x0, 0x6f63, {512, 384}}, ) == 0x1
 01887   312   NtQueryValueKey  (76,  (76, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01888   312   NtQueryValueKey  (76,  (76, "SecureProtocols", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01889   312   NtQueryValueKey  (76,  (76, "CertificateRevocation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01890   312   NtQueryValueKey  (76,  (76, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01891   312   NtQueryValueKey  (76,  (76, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01892   312   NtQueryValueKey  (76,  (76, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01893   312   NtQueryValueKey  (76,  (76, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01894   312   NtQueryValueKey  (76,  (76, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01895   312   NtQueryValueKey  (76,  (76, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01896   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01897   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1239992, ... }, 1239992, ...
 01886   548   NtWaitForSingleObject  ... ) == 0x0
 01898   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 01899   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01897   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01900   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "Secur32.dll"}, 1239992, ... }, 1239992, ...
 01899   548   NtWaitForSingleObject  ... ) == 0x0
 01901   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 01902   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01900   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01903   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 1239992, ... ) }, 1239992, ... ) == 0x0
 01904   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01905   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 180, ) == 0x0
 01906   312   NtQuerySection  (180, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01907   312   NtClose  (172, ... ) == 0x0
 01908   312   NtMapViewOfSection  (180, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f90000), 0x0, 65536, ) == 0x0
 01909   312   NtClose  (180, ... ) == 0x0
 01910   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 180, ) == 0x0
 01911   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 172, ) == 0x0
 01912   312   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 184, ) }, ... 184, ) == 0x0
 01913   312   NtQueryEvent  (184, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 01914   312   NtClose  (184, ... ) == 0x0
 01915   312   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1241476, 140, ... 184, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241476, 140, ... 184, 0x0, 0x0, 256, 140, ) == 0x0
 01916   312   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 304, 312, 1541, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 304, 312, 1541, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 304, 312, 1541, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 01917   312   NtQueryValueKey  (76,  (76, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01918   312   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01919   312   NtQueryValueKey  (188,  (188, "FixupKey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01920   312   NtClose  (188, ... ) == 0x0
 01921   312   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01922   312   NtQueryValueKey  (188,  (188, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01923   312   NtClose  (188, ... ) == 0x0
 01924   312   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01925   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 192, ) }, ... 192, ) == 0x0
 01926   312   NtQueryValueKey  (192,  (192, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (192, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01927   312   NtClose  (192, ... ) == 0x0
 01928   312   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 192, ) }, ... 192, ) == 0x0
 01929   312   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 196, ) }, ... 196, ) == 0x0
 01930   312   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 200, ) }, ... 200, ) == 0x0
 01931   312   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 204, ) }, ... 204, ) == 0x0
 01932   312   NtQueryValueKey  (204,  (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01933   312   NtQueryValueKey  (204,  (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01934   312   NtClose  (204, ... ) == 0x0
 01935   312   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 204, ) }, ... 204, ) == 0x0
 01936   312   NtQueryValueKey  (204,  (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01937   312   NtQueryValueKey  (204,  (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01938   312   NtQueryValueKey  (204,  (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01939   312   NtQueryValueKey  (204,  (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01940   312   NtQueryValueKey  (204,  (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01941   312   NtQueryValueKey  (204,  (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01942   312   NtClose  (204, ... ) == 0x0
 01943   312   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Content"}, ... 204, ) }, ... 204, ) == 0x0
 01944   312   NtQueryValueKey  (204,  (204, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01945   312   NtClose  (204, ... ) == 0x0
 01946   312   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Content"}, ... 204, ) }, ... 204, ) == 0x0
 01947   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01948   312   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1374360, 0,  (0x1f0003, {24, 52, 0x80, 1374360, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 208, ) }, 0, 2147483647, ... 208, ) == STATUS_OBJECT_NAME_EXISTS
 01949   312   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 01950   312   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 01951   312   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01952   312   NtQueryValueKey  (212,  (212, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01953   312   NtClose  (212, ... ) == 0x0
 01954   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 01955   312   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01956   312   NtSetValueKey  (212,  (212, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 0, 1,  (212, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 150, ... ) == 0x0
 01957   312   NtClose  (212, ... ) == 0x0
 01958   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 01959   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 01960   312   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 01961   312   NtSetInformationFile  (212, 1239744, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01962   312   NtClose  (212, ... ) == 0x0
 01963   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\desktop.ini"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 01964   312   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01965   312   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01966   312   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) }, 16, ) == 0x0
 01967   312   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 212, ) }, ... 212, ) == 0x0
 01968   312   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "Paths"}, ... 216, ) }, ... 216, ) == 0x0
 01969   312   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path1"}, ... 220, ) }, ... 220, ) == 0x0
 01970   312   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path2"}, ... 224, ) }, ... 224, ) == 0x0
 01971   312   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path3"}, ... 228, ) }, ... 228, ) == 0x0
 01972   312   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path4"}, ... 232, ) }, ... 232, ) == 0x0
 01973   312   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "Special Paths"}, ... 236, ) }, ... 236, ) == 0x0
 01974   312   NtSetValueKey  (216,  (216, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 0, 1,  (216, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 174, ... ) == 0x0
 01975   312   NtSetValueKey  (216,  (216, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 0, 4,  (216, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 4, ... ) == 0x0
 01976   312   NtSetValueKey  (220,  (220, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 0, 1,  (220, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01977   312   NtSetValueKey  (224,  (224, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 0, 1,  (224, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01978   312   NtSetValueKey  (228,  (228, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 0, 1,  (228, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01979   312   NtSetValueKey  (232,  (232, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 0, 1,  (232, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01980   312   NtSetValueKey  (220,  (220, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (220, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01981   312   NtSetValueKey  (224,  (224, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (224, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01982   312   NtSetValueKey  (228,  (228, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (228, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01983   312   NtSetValueKey  (232,  (232, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (232, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01984   312   NtClose  (232, ... ) == 0x0
 01985   312   NtClose  (228, ... ) == 0x0
 01986   312   NtClose  (224, ... ) == 0x0
 01987   312   NtClose  (220, ... ) == 0x0
 01988   312   NtClose  (216, ... ) == 0x0
 01989   312   NtClose  (236, ... ) == 0x0
 01990   312   NtClose  (212, ... ) == 0x0
 01991   312   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Cookies"}, ... 212, ) }, ... 212, ) == 0x0
 01992   312   NtQueryValueKey  (212,  (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01993   312   NtClose  (212, ... ) == 0x0
 01994   312   NtClose  (204, ... ) == 0x0
 01995   312   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Cookies"}, ... 204, ) }, ... 204, ) == 0x0
 01996   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01997   312   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 01998   312   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 01999   312   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02000   312   NtQueryValueKey  (212,  (212, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 02001   312   NtClose  (212, ... ) == 0x0
 02002   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 02003   312   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02004   312   NtSetValueKey  (212,  (212, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 0, 1,  (212, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 86, ... ) == 0x0
 02005   312   NtClose  (212, ... ) == 0x0
 02006   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 02007   312   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 02008   312   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 02009   312   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02010   312   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "History"}, ... 212, ) }, ... 212, ) == 0x0
 02011   312   NtQueryValueKey  (212,  (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02012   312   NtClose  (212, ... ) == 0x0
 02013   312   NtClose  (204, ... ) == 0x0
 02014   312   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "History"}, ... 204, ) }, ... 204, ) == 0x0
 02015   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02016   312   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 02017   312   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 02018   312   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02019   312   NtQueryValueKey  (212,  (212, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 02020   312   NtClose  (212, ... ) == 0x0
 02021   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 02022   312   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02023   312   NtSetValueKey  (212,  (212, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 0, 1,  (212, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 116, ... ) == 0x0
 02024   312   NtClose  (212, ... ) == 0x0
 02025   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 02026   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 02027   312   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 02028   312   NtSetInformationFile  (212, 1239744, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02029   312   NtClose  (212, ... ) == 0x0
 02030   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\desktop.ini"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 02031   312   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 02032   312   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 02033   312   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02034   312   NtClose  (204, ... ) == 0x0
 02035   312   NtClose  (200, ... ) == 0x0
 02036   312   NtClose  (192, ... ) == 0x0
 02037   312   NtClose  (196, ... ) == 0x0
 02038   312   NtClose  (188, ... ) == 0x0
 02039   312   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "_!MSFTHISTORY!_"}, ... 188, ) }, ... 188, ) == 0x0
 02040   312   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!temporary internet files!content.ie5!"}, ... 196, ) }, ... 196, ) == 0x0
 02041   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02042   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 3, 8388641, ... 192, {status=0x0, info=1}, ) }, 3, 8388641, ... 192, {status=0x0, info=1}, ) == 0x0
 02043   312   NtQueryVolumeInformationFile  (192, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02044   312   NtClose  (192, ... ) == 0x0
 02045   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 192, {status=0x0, info=1}, ) }, 3, 8388641, ... 192, {status=0x0, info=1}, ) == 0x0
 02046   312   NtQueryVolumeInformationFile  (192, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02047   312   NtClose  (192, ... ) == 0x0
 02048   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02049   312   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 192, {status=0x0, info=1}, ) }, 7, 2113568, ... 192, {status=0x0, info=1}, ) == 0x0
 02050   312   NtSetInformationFile  (192, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02051   312   NtClose  (192, ... ) == 0x0
 02052   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) == 0x0
 02053   312   NtSetInformationFile  (192, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02054   312   NtQueryInformationFile  (192, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02055   312   NtClose  (192, ... ) == 0x0
 02056   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) == 0x0
 02057   312   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768"}, ... 200, ) }, ... 200, ) == 0x0
 02058   312   NtMapViewOfSection  (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3f0000), {0, 0}, 32768, ) == 0x0
 02059   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02060   312   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!cookies!"}, ... 204, ) }, ... 204, ) == 0x0
 02061   312   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 02062   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 3, 8388641, ... 212, {status=0x0, info=1}, ) }, 3, 8388641, ... 212, {status=0x0, info=1}, ) == 0x0
 02063   312   NtQueryVolumeInformationFile  (212, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02064   312   NtClose  (212, ... ) == 0x0
 02065   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 212, {status=0x0, info=1}, ) }, 3, 8388641, ... 212, {status=0x0, info=1}, ) == 0x0
 02066   312   NtQueryVolumeInformationFile  (212, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02067   312   NtClose  (212, ... ) == 0x0
 02068   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02069   312   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 02070   312   NtSetInformationFile  (212, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02071   312   NtClose  (212, ... ) == 0x0
 02072   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0
 02073   312   NtSetInformationFile  (212, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02074   312   NtQueryInformationFile  (212, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02075   312   NtClose  (212, ... ) == 0x0
 02076   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0
 02077   312   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Cookies_index.dat_16384"}, ... 236, ) }, ... 236, ) == 0x0
 02078   312   NtMapViewOfSection  (236, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa00000), {0, 0}, 16384, ) == 0x0
 02079   312   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 02080   312   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!history!history.ie5!"}, ... 216, ) }, ... 216, ) == 0x0
 02081   312   NtWaitForSingleObject  (216, 0, 0x0, ... ) == 0x0
 02082   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 3, 8388641, ... 220, {status=0x0, info=1}, ) }, 3, 8388641, ... 220, {status=0x0, info=1}, ) == 0x0
 02083   312   NtQueryVolumeInformationFile  (220, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02084   312   NtClose  (220, ... ) == 0x0
 02085   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 220, {status=0x0, info=1}, ) }, 3, 8388641, ... 220, {status=0x0, info=1}, ) == 0x0
 02086   312   NtQueryVolumeInformationFile  (220, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02087   312   NtClose  (220, ... ) == 0x0
 02088   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02089   312   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 220, {status=0x0, info=1}, ) }, 7, 2113568, ... 220, {status=0x0, info=1}, ) == 0x0
 02090   312   NtSetInformationFile  (220, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02091   312   NtClose  (220, ... ) == 0x0
 02092   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) == 0x0
 02093   312   NtSetInformationFile  (220, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02094   312   NtQueryInformationFile  (220, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02095   312   NtClose  (220, ... ) == 0x0
 02096   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) == 0x0
 02097   312   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_History_History.IE5_index.dat_32768"}, ... 224, ) }, ... 224, ) == 0x0
 02098   312   NtMapViewOfSection  (224, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa10000), {0, 0}, 32768, ) == 0x0
 02099   312   NtReleaseMutant  (216, ... 0x0, ) == 0x0
 02100   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02101   312   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 228, {status=0x0, info=1}, ) }, 7, 2113568, ... 228, {status=0x0, info=1}, ) == 0x0
 02102   312   NtSetInformationFile  (228, 1241672, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02103   312   NtClose  (228, ... ) == 0x0
 02104   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02105   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02106   312   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 228, {status=0x0, info=1}, ) }, 7, 2113568, ... 228, {status=0x0, info=1}, ) == 0x0
 02107   312   NtSetInformationFile  (228, 1241672, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02108   312   NtClose  (228, ... ) == 0x0
 02109   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\desktop.ini"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02110   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02111   312   NtQueryInformationFile  (192, 1240080, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02112   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02113   312   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 228, ) }, ... 228, ) == 0x0
 02114   312   NtOpenKey  (0xf, {24, 228, 0x40, 0, 0,  (0xf, {24, 228, 0x40, 0, 0, "Extensible Cache"}, ... 232, ) }, ... 232, ) == 0x0
 02115   312   NtClose  (228, ... ) == 0x0
 02116   312   NtWaitForSingleObject  (188, 0, {-600000000, -1}, ... ) == 0x0
 02117   312   NtEnumerateKey  (232, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name= (232, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name="MSHist012007051420070521"}, 64, ) }, 64, ) == 0x0
 02118   312   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007051420070521"}, ... 228, ) }, ... 228, ) == 0x0
 02119   312   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02120   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02121   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02122   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02123   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02124   312   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02125   312   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02126   312   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02127   312   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02128   312   NtClose  (228, ... ) == 0x0
 02129   312   NtEnumerateKey  (232, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name= (232, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007052120070528"}, 64, ) }, 64, ) == 0x0
 02130   312   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007052120070528"}, ... 228, ) }, ... 228, ) == 0x0
 02131   312   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02132   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02133   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02134   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02135   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02136   312   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02137   312   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02138   312   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02139   312   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02140   312   NtClose  (228, ... ) == 0x0
 02141   312   NtEnumerateKey  (232, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name= (232, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007053120070601"}, 64, ) }, 64, ) == 0x0
 02142   312   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007053120070601"}, ... 228, ) }, ... 228, ) == 0x0
 02143   312   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02144   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02145   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02146   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02147   312   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02148   312   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02149   312   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02150   312   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02151   312   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02152   312   NtClose  (228, ... ) == 0x0
 02153   312   NtEnumerateKey  (232, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02154   312   NtReleaseMutant  (188, ... 0x0, ) == 0x0
 02155   312   NtClose  (232, ... ) == 0x0
 02156   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02157   312   NtQueryInformationFile  (192, 1242008, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02158   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02159   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02160   312   NtQueryInformationFile  (192, 1242080, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02161   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02162   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02163   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02164   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02165   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02166   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02167   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 232, ) }, ... 232, ) == 0x0
 02168   312   NtQueryValueKey  (232,  (232, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02169   312   NtClose  (232, ... ) == 0x0
 02170   312   NtQueryValueKey  (76,  (76, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02171   312   NtQueryValueKey  (76,  (76, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02172   312   NtQueryValueKey  (76,  (76, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02173   312   NtQueryValueKey  (76,  (76, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02174   312   NtQueryValueKey  (76,  (76, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02175   312   NtQueryValueKey  (76,  (76, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02176   312   NtQueryValueKey  (76,  (76, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02177   312   NtQueryValueKey  (76,  (76, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02178   312   NtQueryValueKey  (76,  (76, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02179   312   NtQueryValueKey  (76,  (76, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02180   312   NtQueryValueKey  (76,  (76, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02181   312   NtQueryValueKey  (76,  (76, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02182   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 232, ) }, ... 232, ) == 0x0
 02183   312   NtQueryValueKey  (232,  (232, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02184   312   NtClose  (232, ... ) == 0x0
 02185   312   NtQueryValueKey  (76,  (76, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02186   312   NtQueryValueKey  (76,  (76, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02187   312   NtQueryValueKey  (76,  (76, "GopherDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02188   312   NtQueryValueKey  (76,  (76, "DisableCachingOfSSLPages", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02189   312   NtQueryValueKey  (76,  (76, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02190   312   NtQueryValueKey  (76,  (76, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02191   312   NtQueryValueKey  (76,  (76, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02192   312   NtQueryValueKey  (76,  (76, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02193   312   NtQueryValueKey  (76,  (76, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02194   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 232, ) }, ... 232, ) == 0x0
 02195   312   NtQueryValueKey  (232,  (232, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02196   312   NtClose  (232, ... ) == 0x0
 02197   312   NtQueryValueKey  (76,  (76, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02198   312   NtQueryValueKey  (76,  (76, "NonBlockingClient32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02199   312   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02200   312   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02201   312   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02202   312   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02203   312   NtQueryValueKey  (76,  (76, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02204   312   NtQueryValueKey  (76,  (76, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02205   312   NtQueryValueKey  (76,  (76, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02206   312   NtQueryValueKey  (76,  (76, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02207   312   NtQueryValueKey  (76,  (76, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02208   312   NtQueryValueKey  (76,  (76, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02209   312   NtQueryValueKey  (76,  (76, "WarnOnZoneCrossing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02210   312   NtQueryValueKey  (76,  (76, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02211   312   NtQueryValueKey  (76,  (76, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02212   312   NtQueryValueKey  (76,  (76, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02213   312   NtQueryValueKey  (76,  (76, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02214   312   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetStartupMutex"}, ... 232, ) }, ... 232, ) == 0x0
 02215   312   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 228, ) == 0x0
 02216   312   NtQueryValueKey  (76,  (76, "GlobalUserOffline", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02217   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02218   312   NtQueryInformationFile  (192, 1242056, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02219   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02220   312   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetConnectionMutex"}, ... 240, ) }, ... 240, ) == 0x0
 02221   312   NtCreateMutant  (0x1f0001, 0x0, 0, ... 244, ) == 0x0
 02222   312   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetProxyRegistryMutex"}, ... 248, ) }, ... 248, ) == 0x0
 02223   312   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02224   312   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02225   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 252, ) }, ... 252, ) == 0x0
 02226   312   NtQueryValueKey  (252,  (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02227   312   NtQueryValueKey  (252,  (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02228   312   NtClose  (252, ... ) == 0x0
 02229   312   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 02230   312   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 02231   312   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 02232   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RASAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02233   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\RASAPI32.DLL"}, 1240444, ... }, 1240444, ...
 01902   548   NtWaitForSingleObject  ... ) == 0x0
 02234   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02235   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02233   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02236   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "RASAPI32.DLL"}, 1240444, ... }, 1240444, ...
 02235   548   NtWaitForSingleObject  ... ) == 0x0
 02237   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02238   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02236   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02239   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.DLL"}, 1240444, ... ) }, 1240444, ... ) == 0x0
 02240   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.DLL"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02241   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02242   312   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02243   312   NtClose  (252, ... ) == 0x0
 02244   312   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76ee0000), 0x0, 225280, ) == 0x0
 02245   312   NtClose  (256, ... ) == 0x0
 02246   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rasman.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02247   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rasman.dll"}, 1239640, ... }, 1239640, ...
 02238   548   NtWaitForSingleObject  ... ) == 0x0
 02248   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02249   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02247   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02250   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rasman.dll"}, 1239640, ... }, 1239640, ...
 02249   548   NtWaitForSingleObject  ... ) == 0x0
 02251   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02252   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02250   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02253   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 1239640, ... ) }, 1239640, ... ) == 0x0
 02254   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02255   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02256   312   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02257   312   NtClose  (256, ... ) == 0x0
 02258   312   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e90000), 0x0, 69632, ) == 0x0
 02259   312   NtClose  (252, ... ) == 0x0
 02260   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02261   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\NETAPI32.dll"}, 1238836, ... }, 1238836, ...
 02252   548   NtWaitForSingleObject  ... ) == 0x0
 02262   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02263   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02261   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02264   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "NETAPI32.dll"}, 1238836, ... }, 1238836, ...
 02263   548   NtWaitForSingleObject  ... ) == 0x0
 02265   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02266   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02264   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02267   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02268   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02269   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02270   312   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02271   312   NtClose  (252, ... ) == 0x0
 02272   312   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71c20000), 0x0, 323584, ) == 0x0
 02273   312   NtClose  (256, ... ) == 0x0
 02274   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "TAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02275   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\TAPI32.dll"}, 1239640, ... }, 1239640, ...
 02266   548   NtWaitForSingleObject  ... ) == 0x0
 02276   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02277   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02275   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02278   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "TAPI32.dll"}, 1239640, ... }, 1239640, ...
 02277   548   NtWaitForSingleObject  ... ) == 0x0
 02279   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02280   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02278   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02281   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1239640, ... ) }, 1239640, ... ) == 0x0
 02282   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02283   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02284   312   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02285   312   NtClose  (256, ... ) == 0x0
 02286   312   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76eb0000), 0x0, 172032, ) == 0x0
 02287   312   NtClose  (252, ... ) == 0x0
 02288   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rtutils.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02289   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rtutils.dll"}, 1238836, ... }, 1238836, ...
 02280   548   NtWaitForSingleObject  ... ) == 0x0
 02290   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02291   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02289   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02292   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rtutils.dll"}, 1238836, ... }, 1238836, ...
 02291   548   NtWaitForSingleObject  ... ) == 0x0
 02293   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02294   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02292   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02295   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02296   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02297   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02298   312   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02299   312   NtClose  (252, ... ) == 0x0
 02300   312   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e80000), 0x0, 53248, ) == 0x0
 02301   312   NtClose  (256, ... ) == 0x0
 02302   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINMM.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02303   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINMM.dll"}, 1238836, ... }, 1238836, ...
 02294   548   NtWaitForSingleObject  ... ) == 0x0
 02304   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02305   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02303   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02306   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WINMM.dll"}, 1238836, ... }, 1238836, ...
 02305   548   NtWaitForSingleObject  ... ) == 0x0
 02307   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02308   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02306   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02309   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINMM.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02310   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINMM.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02311   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02312   312   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02313   312   NtClose  (256, ... ) == 0x0
 02314   312   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b40000), 0x0, 180224, ) == 0x0
 02315   312   NtClose  (252, ... ) == 0x0
 02316   312   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 252, ) == 0x0
 02317   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 256, ) == 0x0
 02318   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 260, ) == 0x0
 02319   312   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32"}, ... 264, ) }, ... 264, ) == 0x0
 02320   312   NtQueryValueKey  (264,  (264, "wave", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02321   312   NtQueryValueKey  (264,  (264, "wave1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02322   312   NtQueryValueKey  (264,  (264, "wave2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02323   312   NtQueryValueKey  (264,  (264, "wave3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02324   312   NtQueryValueKey  (264,  (264, "wave4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02325   312   NtQueryValueKey  (264,  (264, "wave5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02326   312   NtQueryValueKey  (264,  (264, "wave6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02327   312   NtQueryValueKey  (264,  (264, "wave7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02328   312   NtQueryValueKey  (264,  (264, "wave8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02329   312   NtQueryValueKey  (264,  (264, "wave9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02330   312   NtQueryValueKey  (264,  (264, "midi", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02331   312   NtQueryValueKey  (264,  (264, "midi1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02332   312   NtQueryValueKey  (264,  (264, "midi2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02333   312   NtQueryValueKey  (264,  (264, "midi3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02334   312   NtQueryValueKey  (264,  (264, "midi4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02335   312   NtQueryValueKey  (264,  (264, "midi5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02336   312   NtQueryValueKey  (264,  (264, "midi6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02337   312   NtQueryValueKey  (264,  (264, "midi7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02338   312   NtQueryValueKey  (264,  (264, "midi8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02339   312   NtQueryValueKey  (264,  (264, "midi9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02340   312   NtQueryTimerResolution  (... 156250, 10000, 156250, ) == 0x0
 02341   312   NtQueryValueKey  (264,  (264, "aux", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02342   312   NtQueryValueKey  (264,  (264, "aux1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02343   312   NtQueryValueKey  (264,  (264, "aux2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02344   312   NtQueryValueKey  (264,  (264, "aux3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02345   312   NtQueryValueKey  (264,  (264, "aux4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02346   312   NtQueryValueKey  (264,  (264, "aux5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02347   312   NtQueryValueKey  (264,  (264, "aux6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02348   312   NtQueryValueKey  (264,  (264, "aux7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02349   312   NtQueryValueKey  (264,  (264, "aux8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02350   312   NtQueryValueKey  (264,  (264, "aux9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02351   312   NtUserRegisterWindowMessage  ( ("MSJSTICK_VJOYD_MSGSTR", ... ) , ... ) == 0xc07c
 02352   312   NtOpenKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm"}, ... 268, ) }, ... 268, ) == 0x0
 02353   312   NtQueryValueKey  (268,  (268, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (268, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02354   312   NtClose  (268, ... ) == 0x0
 02355   312   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 0, 0,  (0x1f0003, {24, 52, 0x80, 0, 0, "DINPUTWINMM"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 02356   312   NtQueryValueKey  (264,  (264, "mixer", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02357   312   NtQueryValueKey  (264,  (264, "mixer1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02358   312   NtQueryValueKey  (264,  (264, "mixer2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02359   312   NtQueryValueKey  (264,  (264, "mixer3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02360   312   NtQueryValueKey  (264,  (264, "mixer4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02361   312   NtQueryValueKey  (264,  (264, "mixer5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02362   312   NtQueryValueKey  (264,  (264, "mixer6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02363   312   NtQueryValueKey  (264,  (264, "mixer7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02364   312   NtQueryValueKey  (264,  (264, "mixer8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02365   312   NtQueryValueKey  (264,  (264, "mixer9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02366   312   NtQueryDefaultUILanguage  (1238836, ...
 02367   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02368   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482032, ) == 0x0
 02369   312   NtQueryInformationToken  (-2147482032, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02370   312   NtClose  (-2147482032, ... ) == 0x0
 02371   312   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 02372   312   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02373   312   NtOpenKey  (0x80000000, {24, -2147482032, 0x640, 0, 0,  (0x80000000, {24, -2147482032, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482028, ) }, ... -2147482028, ) == 0x0
 02374   312   NtQueryValueKey  (-2147482028,  (-2147482028, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02375   312   NtClose  (-2147482028, ... ) == 0x0
 02376   312   NtClose  (-2147482032, ... ) == 0x0
 02366   312   NtQueryDefaultUILanguage  ... ) == 0x0
 02377   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02378   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1, 96, ... 268, {status=0x0, info=1}, ) }, 1, 96, ... 268, {status=0x0, info=1}, ) == 0x0
 02379   312   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 268, ... 272, ) == 0x0
 02380   312   NtMapViewOfSection  (272, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa20000), 0x0, 163840, ) == 0x0
 02381   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02382   312   NtQueryDefaultLocale  (1, 1236872, ... ) == 0x0
 02383   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02384   312   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1542, 0} " S\26\0\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 304, 312, 1542, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1542, 0} " S\26\0\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ) == 0x0
 02385   312   NtClose  (268, ... ) == 0x0
 02386   312   NtClose  (272, ... ) == 0x0
 02387   312   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 02388   312   NtUnmapViewOfSection  (-1, 0x12e9e0, ... ) == STATUS_NOT_MAPPED_VIEW
 02389   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02390   312   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02391   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02392   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02393   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1235956, ... }, 1235956, ...
 02308   548   NtWaitForSingleObject  ... ) == 0x0
 02394   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02395   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02393   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02396   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02397   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02398   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02399   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 02400   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 272, {status=0x0, info=1}, ) }, 3, 33, ... 272, {status=0x0, info=1}, ) == 0x0
 02401   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02402   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Telephony"}, ... 268, ) }, ... 268, ) == 0x0
 02403   312   NtQueryValueKey  (268,  (268, "Tapi32MaxNumRequestRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02404   312   NtQueryValueKey  (268,  (268, "Tapi32RequestRetryTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02405   312   NtClose  (268, ... ) == 0x0
 02406   312   NtCreateMutant  (0x1f0001, 0x0, 0, ... 268, ) == 0x0
 02407   312   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 1392200, 0,  (0x1f0001, {24, 52, 0x80, 1392200, 0, "RasPbFile"}, 0, ... ) }, 0, ... ) == STATUS_ACCESS_DENIED
 02408   312   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "RasPbFile"}, ... 276, ) }, ... 276, ) == 0x0
 02409   312   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 280, ) == 0x0
 02410   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 284, ) == 0x0
 02411   312   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 288, ) == 0x0
 02412   312   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 02413   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 292, ) == 0x0
 02414   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 296, ) == 0x0
 02415   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 300, ) == 0x0
 02416   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 304, ) == 0x0
 02417   312   NtCreateKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "Software\Microsoft\Tracing"}, 0, 0x0, 0, ... 308, 2, ) }, 0, 0x0, 0, ... 308, 2, ) == 0x0
 02418   312   NtQueryValueKey  (308,  (308, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (308, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02419   312   NtClose  (308, ... ) == 0x0
 02420   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 308, ) == 0x0
 02421   312   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 312, ) == 0x0
 02422   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Tracing\RASAPI32"}, ... 316, ) }, ... 316, ) == 0x0
 02423   312   NtQueryValueKey  (316,  (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02424   312   NtQueryValueKey  (316,  (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02425   312   NtQueryValueKey  (316,  (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02426   312   NtQueryValueKey  (316,  (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02427   312   NtQueryValueKey  (316,  (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 02428   312   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02429   312   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02430   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 320, ) == 0x0
 02431   312   NtNotifyChangeKey  (316, 320, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 02432   312   NtQueryValueKey  (316,  (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02433   312   NtQueryValueKey  (316,  (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02434   312   NtQueryValueKey  (316,  (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02435   312   NtQueryValueKey  (316,  (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02436   312   NtQueryValueKey  (316,  (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 02437   312   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02438   312   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02439   312   NtNotifyChangeKey  (316, 320, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 02440   312   NtSetEvent  (304, ... 0x0, ) == 0x0
 02441   312   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 324, ) }, ... 324, ) == 0x0
 02442   312   NtWaitForSingleObject  (324, 0, {-1800000000, -1}, ... ) == 0x0
 02443   312   NtClose  (324, ... ) == 0x0
 02444   312   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 324, ) == 0x0
 02445   312   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 328, ) == 0x0
 02446   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 332, ) }, ... 332, ) == 0x0
 02447   312   NtOpenKey  (0x20019, {24, 332, 0x40, 0, 0,  (0x20019, {24, 332, 0x40, 0, 0, "ActiveComputerName"}, ... 336, ) }, ... 336, ) == 0x0
 02448   312   NtQueryValueKey  (336,  (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02449   312   NtClose  (336, ... ) == 0x0
 02450   312   NtClose  (332, ... ) == 0x0
 02451   312   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 332, ) == 0x0
 02452   312   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 336, ) == 0x0
 02453   312   NtDuplicateObject  (-1, 332, -1, 0x0, 0, 2, ... 340, ) == 0x0
 02454   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02455   312   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 02456   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 344, ) == 0x0
 02457   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02458   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02459   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240604,  (0xc0100080, {24, 0, 0x40, 0, 1240604, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 348, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 348, {status=0x0, info=1}, ) == 0x0
 02460   312   NtSetInformationFile  (348, 1240660, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02461   312   NtSetInformationFile  (348, 1240652, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02462   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02463   312   NtWriteFile  (348, 325, 0, 0,  (348, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02464   312   NtReadFile  (348, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (348, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\344!\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02465   312   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\344!\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\344!\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02466   312   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\206\375\221\273\322?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\206\375\221\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\206\375\221\273\322?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\206\375\221\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02467   312   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\207\375\221\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\207\375\221\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\207\375\221\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\207\375\221\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02468   312   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\207\375\221\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\207\375\221\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 02469   312   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\206\375\221\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\206\375\221\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 02470   312   NtClose  (344, ... ) == 0x0
 02471   312   NtClose  (348, ... ) == 0x0
 02472   312   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 02473   312   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02474   312   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02475   312   NtOpenEvent  (0x100000, {24, 0, 0x0, 0, 0,  (0x100000, {24, 0, 0x0, 0, 0, "\INSTALLATION_SECURITY_HOLD"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02476   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02477   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 348, ) == 0x0
 02478   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02479   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02480   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238108,  (0xc0100080, {24, 0, 0x40, 0, 1238108, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 344, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 344, {status=0x0, info=1}, ) == 0x0
 02481   312   NtSetInformationFile  (344, 1238164, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02482   312   NtSetInformationFile  (344, 1238156, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02483   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02484   312   NtWriteFile  (344, 325, 0, 0,  (344, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0j(\319\14\261\320\21\233\250\0\300O\331.\365\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02485   312   NtReadFile  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20A \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02486   312   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20A \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 26, 1024, ... {status=0x103, info=68},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20A \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02487   312   NtClose  (348, ... ) == 0x0
 02488   312   NtClose  (344, ... ) == 0x0
 02489   312   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 344, 2, ) }, 0, 0x0, 0, ... 344, 2, ) == 0x0
 02490   312   NtCreateKey  (0x20019, {24, 344, 0x40, 0, 0,  (0x20019, {24, 344, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 348, 2, ) }, 0, 0x0, 0, ... 348, 2, ) == 0x0
 02491   312   NtClose  (344, ... ) == 0x0
 02492   312   NtQueryValueKey  (348,  (348, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02493   312   NtClose  (348, ... ) == 0x0
 02494   312   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 348, ) }, ... 348, ) == 0x0
 02495   312   NtWaitForSingleObject  (348, 0, {-1800000000, -1}, ... ) == 0x0
 02496   312   NtClose  (348, ... ) == 0x0
 02497   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02498   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 348, ) == 0x0
 02499   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02500   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02501   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240192,  (0xc0100080, {24, 0, 0x40, 0, 1240192, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 344, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 344, {status=0x0, info=1}, ) == 0x0
 02502   312   NtSetInformationFile  (344, 1240248, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02503   312   NtSetInformationFile  (344, 1240240, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02504   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02505   312   NtWriteFile  (344, 325, 0, 0,  (344, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02506   312   NtReadFile  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\345!\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02507   312   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\345!\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\345!\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02508   312   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\2\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\0\0\0\0", 64, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 64, 1024, ... {status=0x103, info=48},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\2\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\0\0\0\0", 64, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02509   312   NtWaitForSingleObject  (325, 0, 0x0, ... ) == 0x0
 02510   312   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\3\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\02\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\2\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\2\0\0\340\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\1\0\0~\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\1\0\0B\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\1\0\0\32\1\0\0 \0\0\0\4\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\16\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0E\0R\0S\0v\0c\0\0\0DNS Client\0\0i\0e\0n\0t\0\0\0Dnscache\0\0c\0h\0e\0\0\0Logical Disk Manager\0\0k\0 \0M\0a\0n\0a\0g\0e\0r\0\0\0dmserver\0\0v\0e\0r\0\0\0DHCP Client\0l\0i\0e\0n\0t\0\0\0Dhcp\0\0p\0\0\0Cryptographic Services\0\0c\0 \0S\0e\0r\0v\0i\0c\0e\0s\0\0\0CryptSvc\0\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\3\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\02\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\2\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\2\0\0\340\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\1\0\0~\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\1\0\0B\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\1\0\0\32\1\0\0 \0\0\0\4\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\16\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0E\0R\0S\0v\0c\0\0\0DNS Client\0\0i\0e\0n\0t\0\0\0Dnscache\0\0c\0h\0e\0\0\0Logical Disk Manager\0\0k\0 \0M\0a\0n\0a\0g\0e\0r\0\0\0dmserver\0\0v\0e\0r\0\0\0DHCP Client\0l\0i\0e\0n\0t\0\0\0Dhcp\0\0p\0\0\0Cryptographic Services\0\0c\0 \0S\0e\0r\0v\0i\0c\0e\0s\0\0\0CryptSvc\0\0", ) , ) == 0x103
 02511   312   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\4\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0>\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\3\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\4\2\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\362\1\0\0\336\1\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\306\1\0\0\242\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\1\0\0 \1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\1\0\0\356\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Help and Support\0\0S\0u\0p\0p\0o\0r\0t\0\0\0helpsvc\0s\0v\0c\0\0\0Fast User Switching Compatibility\0n\0g\0 \0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0FastUserSwitchingCompatibility\0\0g\0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0COM+ Event System\0t\0 \0S\0y\0s\0t\0e\0m\0\0\0EventSystem\0y\0s\0t\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\4\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0>\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\3\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\4\2\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\362\1\0\0\336\1\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\306\1\0\0\242\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\1\0\0 \1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\1\0\0\356\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Help and Support\0\0S\0u\0p\0p\0o\0r\0t\0\0\0helpsvc\0s\0v\0c\0\0\0Fast User Switching Compatibility\0n\0g\0 \0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0FastUserSwitchingCompatibility\0\0g\0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0COM+ Event System\0t\0 \0S\0y\0s\0t\0e\0m\0\0\0EventSystem\0y\0s\0t\0", ) , ) == 0x103
 02512   312   NtWaitForSingleObject  (325, 0, 0x0, ... ) == 0x0
 02513   312   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\5\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0p\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\4\0\0\0X\2\0\0\0\0\0\0@\2\0\0&\2\0\0\30\2\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\1\0\0x\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\1\0\0B\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\1\0\0\370\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Network Location Awareness (NLA)\0\0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0\0\0Nla\0a\0\0\0Network Connections\0n\0n\0e\0c\0t\0i\0o\0n\0s\0\0\0Netman\0\0a\0n\0\0\0Messenger\0n\0g\0e\0r\0\0\0Messenger\0n\0g\0e\0r\0\0\0TCP/IP NetBIOS Helper\0I\0O\0S\0 \0H\0e\0l\0p\0e\0r\0\0\0LmHosts\0s\0t\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\5\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0p\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\4\0\0\0X\2\0\0\0\0\0\0@\2\0\0&\2\0\0\30\2\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\1\0\0x\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\1\0\0B\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\1\0\0\370\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Network Location Awareness (NLA)\0\0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0\0\0Nla\0a\0\0\0Network Connections\0n\0n\0e\0c\0t\0i\0o\0n\0s\0\0\0Netman\0\0a\0n\0\0\0Messenger\0n\0g\0e\0r\0\0\0Messenger\0n\0g\0e\0r\0\0\0TCP/IP NetBIOS Helper\0I\0O\0S\0 \0H\0e\0l\0p\0e\0r\0\0\0LmHosts\0s\0t\0", ) , ) == 0x103
 02514   312   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\6\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\242\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\5\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\372\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\272\1\0\0\226\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0X\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\1\0\0\24\1\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0a\0m\0S\0s\0\0\0Remote Procedure Call (RPC)\0r\0e\0 \0C\0a\0l\0l\0 \0(\0R\0P\0C\0)\0\0\0RpcSs\0S\0s\0\0\0Remote Registry\0e\0g\0i\0s\0t\0r\0y\0\0\0RemoteRegistry\0\0g\0i\0s\0t\0r\0y\0\0\0Protected Storage\0 \0S\0t\0o\0r\0a\0g\0e\0\0\0ProtectedStorage\0\0S\0t\0o\0r\0a\0g\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\6\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\242\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\5\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\372\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\272\1\0\0\226\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0X\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\1\0\0\24\1\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0a\0m\0S\0s\0\0\0Remote Procedure Call (RPC)\0r\0e\0 \0C\0a\0l\0l\0 \0(\0R\0P\0C\0)\0\0\0RpcSs\0S\0s\0\0\0Remote Registry\0e\0g\0i\0s\0t\0r\0y\0\0\0RemoteRegistry\0\0g\0i\0s\0t\0r\0y\0\0\0Protected Storage\0 \0S\0t\0o\0r\0a\0g\0e\0\0\0ProtectedStorage\0\0S\0t\0o\0r\0a\0g\0", ) , ) == 0x103
 02515   312   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\7\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\6\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\0\2\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\356\1\0\0\320\1\0\0 \1\0\0\4\0\0\0G\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\276\1\0\0\236\1\0\0 \1\0\0\4\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\1\0\0`\1\0\0 \0\0\0\4\0\0\0A\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\1\0\0\14\1\0\0 \0\0\0\4\0\0\0\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\0\0\0\340\0\0\0\20\1\0\0\4\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Print Spooler\0p\0o\0o\0l\0e\0r\0\0\0Spooler\0l\0e\0r\0\0\0Shell Hardware Detection\0\0e\0 \0D\0e\0t\0e\0c\0t\0i\0o\0n\0\0\0ShellHWDetection\0\0t\0e\0c\0t\0i\0o\0n\0\0\0System Event Notification\0N\0o\0t\0i\0f\0i\0c\0a\0t\0i\0o\0n\0\0\0SENS\0\0S\0\0\0Secondary Logon\0y\0 \0L\0o\0g\0o\0n\0\0\0seclogon\0\0g\0o\0n\0\0\0Task Sch", ) , 44, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\7\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\210\375\221\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\6\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\0\2\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\356\1\0\0\320\1\0\0 \1\0\0\4\0\0\0G\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\276\1\0\0\236\1\0\0 \1\0\0\4\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\1\0\0`\1\0\0 \0\0\0\4\0\0\0A\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\1\0\0\14\1\0\0 \0\0\0\4\0\0\0\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\0\0\0\340\0\0\0\20\1\0\0\4\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Print Spooler\0p\0o\0o\0l\0e\0r\0\0\0Spooler\0l\0e\0r\0\0\0Shell Hardware Detection\0\0e\0 \0D\0e\0t\0e\0c\0t\0i\0o\0n\0\0\0ShellHWDetection\0\0t\0e\0c\0t\0i\0o\0n\0\0\0System Event Notification\0N\0o\0t\0i\0f\0i\0c\0a\0t\0i\0o\0n\0\0\0SENS\0\0S\0\0\0Secondary Logon\0y\0 \0L\0o\0g\0o\0n\0\0\0seclogon\0\0g\0o\0n\0\0\0Task Sch", ) , ) == 0x103
 02516   312   NtClose  (348, ... ) == 0x0
 02517   312   NtClose  (344, ... ) == 0x0
 02518   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "sensapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02519   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\sensapi.dll"}, 1240452, ... }, 1240452, ...
 02395   548   NtWaitForSingleObject  ... ) == 0x0
 02520   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02521   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02519   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02522   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "sensapi.dll"}, 1240452, ... }, 1240452, ...
 02521   548   NtWaitForSingleObject  ... ) == 0x0
 02523   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02524   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02522   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02525   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\sensapi.dll"}, 1240452, ... ) }, 1240452, ... ) == 0x0
 02526   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\sensapi.dll"}, 5, 96, ... 344, {status=0x0, info=1}, ) }, 5, 96, ... 344, {status=0x0, info=1}, ) == 0x0
 02527   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 344, ... 348, ) == 0x0
 02528   312   NtQuerySection  (348, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02529   312   NtClose  (344, ... ) == 0x0
 02530   312   NtMapViewOfSection  (348, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x722b0000), 0x0, 20480, ) == 0x0
 02531   312   NtClose  (348, ... ) == 0x0
 02532   312   NtOpenSection  (0x4, {24, 52, 0x0, 0, 0,  (0x4, {24, 52, 0x0, 0, 0, "SENS Information Cache"}, ... 348, ) }, ... 348, ) == 0x0
 02533   312   NtMapViewOfSection  (348, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa20000), {0, 0}, 4096, ) == 0x0
 02534   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 344, ) == 0x0
 02535   312   NtConnectPort  ( ("\RPC Control\senssvc", {12, 2, 1, 1}, 0x0, 0x0, 1240916, 112, ... 352, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1240916, 112, ... 352, 0x0, 0x0, 0x0, 112, ) == 0x0
 02536   312   NtRequestWaitReplyPort  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680}  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680} "\0$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0 H\25\0\4\0\0\0 H\25\0\20\344\314w H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1544, 0} "\7$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0 H\25\0\377\377\377\377 H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1544, 0}  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680} "\0$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0 H\25\0\4\0\0\0 H\25\0\20\344\314w H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1544, 0} "\7$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0 H\25\0\377\377\377\377 H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" )  ) == 0x0
 02537   312   NtRequestWaitReplyPort  (352, {32, 56, new_msg, 0, 44, 7, 20, 0}  (352, {32, 56, new_msg, 0, 44, 7, 20, 0} "\1\0\0\0A\2\0\0\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\377\377\377\377@\2\0\0" ... {124, 148, reply, 0, 304, 312, 1545, 0} "\2\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {124, 148, reply, 0, 304, 312, 1545, 0}  (352, {32, 56, new_msg, 0, 44, 7, 20, 0} "\1\0\0\0A\2\0\0\322?\334\21\261\310\0\14)\371\246\3050\0\0\0\377\377\377\377@\2\0\0" ... {124, 148, reply, 0, 304, 312, 1545, 0} "\2\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02538   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02539   312   NtQueryInformationFile  (192, 1242024, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02540   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02541   312   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\0\20Z\25\0" ... {176, 200, reply, 0, 304, 312, 1546, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\0\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 304, 312, 1546, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\0\20Z\25\0" ... {176, 200, reply, 0, 304, 312, 1546, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\0\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 02542   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02543   312   NtOpenThreadToken  (-2, 0x20008, 1, ... ) == STATUS_NO_TOKEN
 02544   312   NtOpenProcessToken  (-1, 0x20008, ... 356, ) == 0x0
 02545   312   NtQueryInformationToken  (356, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02546   312   NtClose  (356, ... ) == 0x0
 02547   312   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER"}, ... 356, ) }, ... 356, ) == 0x0
 02548   312   NtSetInformationObject  (356, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 02549   312   NtOpenKey  (0x3, {24, 356, 0x40, 0, 0,  (0x3, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 360, ) }, ... 360, ) == 0x0
 02550   312   NtOpenKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, ... 364, ) }, ... 364, ) == 0x0
 02551   312   NtQueryValueKey  (364,  (364, "MigrateProxy", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "MigrateProxy", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02552   312   NtClose  (364, ... ) == 0x0
 02553   312   NtAllocateVirtualMemory  (-1, 1400832, 0, 20480, 4096, 4, ... 1400832, 20480, ) == 0x0
 02554   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02555   312   NtOpenProcessToken  (-1, 0xc, ... 364, ) == 0x0
 02556   312   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 02557   312   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 02558   312   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 02559   312   NtQueryValueKey  (368,  (368, "Common AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 82, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "Common AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 82, ) }, 82, ) == 0x0
 02560   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 372, ) }, ... 372, ) == 0x0
 02561   312   NtMapViewOfSection  (372, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 02562   312   NtClose  (372, ... ) == 0x0
 02563   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 372, ) }, ... 372, ) == 0x0
 02564   312   NtQueryValueKey  (372,  (372, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02565   312   NtClose  (372, ... ) == 0x0
 02566   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 372, ) }, ... 372, ) == 0x0
 02567   312   NtQueryValueKey  (372,  (372, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02568   312   NtClose  (372, ... ) == 0x0
 02569   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 372, ) }, ... 372, ) == 0x0
 02570   312   NtQueryValueKey  (372,  (372, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (372, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 02571   312   NtClose  (372, ... ) == 0x0
 02572   312   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1237236, 0,  (0x1f0003, {24, 52, 0x80, 1237236, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 372, ) }, 0, 1, ... 372, ) == STATUS_OBJECT_NAME_EXISTS
 02573   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02574   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02575   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02576   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02577   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02578   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02579   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02580   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02581   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02582   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02583   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02584   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02585   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02586   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02587   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02588   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02589   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02590   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02591   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02592   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02593   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02594   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02595   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02596   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02597   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02598   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02599   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02600   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 376, ) == 0x0
 02601   312   NtQueryInformationToken  (376, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02602   312   NtClose  (376, ... ) == 0x0
 02603   312   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 02604   312   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 380, ) }, ... 380, ) == 0x0
 02605   312   NtQueryValueKey  (380,  (380, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (380, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 02606   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02607   312   NtQueryValueKey  (380,  (380, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (380, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 02608   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02609   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02610   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02611   312   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02612   312   NtClose  (380, ... ) == 0x0
 02613   312   NtClose  (376, ... ) == 0x0
 02614   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02615   312   NtQueryValueKey  (376,  (376, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02616   312   NtClose  (376, ... ) == 0x0
 02617   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02618   312   NtQueryValueKey  (376,  (376, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02619   312   NtQueryValueKey  (376,  (376, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02620   312   NtClose  (376, ... ) == 0x0
 02621   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02622   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02623   312   NtQueryValueKey  (376,  (376, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02624   312   NtClose  (376, ... ) == 0x0
 02625   312   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02626   312   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10682368, 4096, ) == 0x0
 02627   312   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ... 1421312, 4096, ) == 0x0
 02628   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02629   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02630   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02631   312   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02632   312   NtClose  (376, ... ) == 0x0
 02633   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02634   312   NtQueryValueKey  (376,  (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02635   312   NtClose  (376, ... ) == 0x0
 02636   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02637   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 376, ) }, ... 376, ) == 0x0
 02638   312   NtQueryKey  (376, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02639   312   NtQuerySecurityObject  (376, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02640   312   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02641   312   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02642   312   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02643   312   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02644   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02645   312   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02646   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02647   312   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02648   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02649   312   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02650   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02651   312   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02652   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02653   312   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02654   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02655   312   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02656   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02657   312   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02658   312   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02659   312   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02660   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02661   312   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02662   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02663   312   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02664   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02665   312   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02666   312   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02667   312   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02668   312   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02669   312   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02670   312   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02671   312   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02672   312   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02673   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02674   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02675   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02676   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02677   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02678   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02679   312   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02680   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02681   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02682   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02683   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02684   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02685   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02686   312   NtClose  (376, ... ) == 0x0
 02687   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 376, ) }, ... 376, ) == 0x0
 02688   312   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "ActiveComputerName"}, ... 380, ) }, ... 380, ) == 0x0
 02689   312   NtQueryValueKey  (380,  (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02690   312   NtClose  (380, ... ) == 0x0
 02691   312   NtClose  (376, ... ) == 0x0
 02692   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02693   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02694   312   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02695   312   NtClose  (376, ... ) == 0x0
 02696   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02697   312   NtQueryValueKey  (376,  (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 02698   312   NtClose  (376, ... ) == 0x0
 02699   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02700   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 376, ) }, ... 376, ) == 0x0
 02701   312   NtQueryValueKey  (376,  (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 02702   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02703   312   NtQueryValueKey  (376,  (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 02704   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02705   312   NtClose  (376, ... ) == 0x0
 02706   312   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02707   312   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 02708   312   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02709   312   NtQueryInformationToken  (364, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 02710   312   NtDuplicateToken  (364, 0xc, {24, 0, 0x0, 0, 1239544, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 02711   312   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02712   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02713   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02714   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02715   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02716   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237748,  (0xc0100080, {24, 0, 0x40, 0, 1237748, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02717   312   NtSetInformationFile  (384, 1237804, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02718   312   NtSetInformationFile  (384, 1237796, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02719   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02720   312   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02721   312   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20B \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02722   312   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20B \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20B \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02723   312   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\376\25)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\376\25)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\376\25)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\376\25)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02724   312   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\376\25)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\376\25)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02725   312   NtClose  (380, ... ) == 0x0
 02726   312   NtClose  (384, ... ) == 0x0
 02727   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02728   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 384, ) == 0x0
 02729   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02730   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02731   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237744,  (0xc0100080, {24, 0, 0x40, 0, 1237744, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) == 0x0
 02732   312   NtSetInformationFile  (380, 1237800, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02733   312   NtSetInformationFile  (380, 1237792, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02734   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02735   312   NtWriteFile  (380, 325, 0, 0,  (380, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02736   312   NtReadFile  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20C \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02737   312   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20C \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20C \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02738   312   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\377\25)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\377\25)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\377\25)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\377\25)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02739   312   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\377\25)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\377\25)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02740   312   NtClose  (384, ... ) == 0x0
 02741   312   NtClose  (380, ... ) == 0x0
 02742   312   NtOpenEvent  (0x100000, {24, 0, 0x0, 0, 0,  (0x100000, {24, 0, 0x0, 0, 0, "\INSTALLATION_SECURITY_HOLD"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02743   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02744   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02745   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02746   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02747   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237376,  (0xc0100080, {24, 0, 0x40, 0, 1237376, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02748   312   NtSetInformationFile  (384, 1237432, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02749   312   NtSetInformationFile  (384, 1237424, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02750   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02751   312   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0j(\319\14\261\320\21\233\250\0\300O\331.\365\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02752   312   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20D \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02753   312   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20D \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 26, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20D \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02754   312   NtClose  (380, ... ) == 0x0
 02755   312   NtClose  (384, ... ) == 0x0
 02756   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02757   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02758   312   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02759   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 02760   312   NtQueryValueKey  (384,  (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 02761   312   NtClose  (384, ... ) == 0x0
 02762   312   NtCreateKey  (0x2001f, {24, 376, 0x40, 0, 0,  (0x2001f, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 02763   312   NtQueryValueKey  (384,  (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02764   312   NtClose  (384, ... ) == 0x0
 02765   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02766   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02767   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1239448, ... ) }, 1239448, ... ) == 0x0
 02768   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239456,  (0x80100080, {24, 0, 0x40, 0, 1239456, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02769   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02770   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02771   312   NtQueryInformationFile  (384, 1239472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02772   312   NtReadFile  (384, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 02773   312   NtClose  (384, ... ) == 0x0
 02774   312   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02775   312   NtAllocateVirtualMemory  (-1, 1425408, 0, 12288, 4096, 4, ... 1425408, 12288, ) == 0x0
 02776   312   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02777   312   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02778   312   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02779   312   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02780   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02781   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02782   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02783   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02784   312   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02785   312   NtClose  (380, ... ) == 0x0
 02786   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02787   312   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02788   312   NtClose  (380, ... ) == 0x0
 02789   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02790   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02791   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02792   312   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02793   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02794   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02795   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02796   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02797   312   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02798   312   NtClose  (380, ... ) == 0x0
 02799   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02800   312   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02801   312   NtClose  (380, ... ) == 0x0
 02802   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02803   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02804   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02805   312   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02806   312   NtClose  (384, ... ) == 0x0
 02807   312   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Volatile Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02808   312   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02809   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02810   312   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02811   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02812   312   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02813   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02814   312   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02815   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02816   312   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02817   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02818   312   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02819   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02820   312   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02821   312   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02822   312   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02823   312   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02824   312   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02825   312   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02826   312   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02827   312   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02828   312   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02829   312   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02830   312   NtClose  (384, ... ) == 0x0
 02831   312   NtClose  (376, ... ) == 0x0
 02832   312   NtFreeVirtualMemory  (-1, (0xa30000), 0, 32768, ... (0xa30000), 4096, ) == 0x0
 02833   312   NtClose  (368, ... ) == 0x0
 02834   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data"}, 1240112, ... ) }, 1240112, ... ) == 0x0
 02835   312   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 02836   312   NtSetValueKey  (368,  (368, "Common AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 106, ... ) , 0, 1,  (368, "Common AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 106, ... ) , 106, ... ) == 0x0
 02837   312   NtClose  (368, ... ) == 0x0
 02838   312   NtClose  (364, ... ) == 0x0
 02839   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02840   312   NtQueryDirectoryFile  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1,  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02841   312   NtClose  (364, ... ) == 0x0
 02842   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02843   312   NtQueryDirectoryFile  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1,  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02844   312   NtClose  (364, ... ) == 0x0
 02845   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02846   312   NtOpenProcessToken  (-1, 0xc, ... 364, ) == 0x0
 02847   312   NtQueryInformationToken  (364, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 02848   312   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 368, ) }, ... 368, ) == 0x0
 02849   312   NtCreateKey  (0x2000000, {24, 368, 0x40, 0, 0,  (0x2000000, {24, 368, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 02850   312   NtClose  (368, ... ) == 0x0
 02851   312   NtQueryValueKey  (376,  (376, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 02852   312   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10682368, 4096, ) == 0x0
 02853   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02854   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02855   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02856   312   NtQueryValueKey  (368,  (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02857   312   NtClose  (368, ... ) == 0x0
 02858   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02859   312   NtQueryValueKey  (368,  (368, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02860   312   NtClose  (368, ... ) == 0x0
 02861   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02862   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 368, ) }, ... 368, ) == 0x0
 02863   312   NtQueryKey  (368, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02864   312   NtQuerySecurityObject  (368, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02865   312   NtEnumerateValueKey  (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02866   312   NtEnumerateValueKey  (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02867   312   NtEnumerateValueKey  (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02868   312   NtEnumerateValueKey  (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02869   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02870   312   NtEnumerateValueKey  (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02871   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02872   312   NtEnumerateValueKey  (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02873   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02874   312   NtEnumerateValueKey  (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02875   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02876   312   NtEnumerateValueKey  (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02877   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02878   312   NtEnumerateValueKey  (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02879   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02880   312   NtEnumerateValueKey  (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02881   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02882   312   NtEnumerateValueKey  (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02883   312   NtEnumerateValueKey  (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02884   312   NtEnumerateValueKey  (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02885   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02886   312   NtEnumerateValueKey  (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02887   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02888   312   NtEnumerateValueKey  (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02889   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02890   312   NtEnumerateValueKey  (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02891   312   NtEnumerateValueKey  (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02892   312   NtEnumerateValueKey  (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02893   312   NtEnumerateValueKey  (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02894   312   NtEnumerateValueKey  (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02895   312   NtEnumerateValueKey  (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02896   312   NtEnumerateValueKey  (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02897   312   NtEnumerateValueKey  (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02898   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02899   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02900   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02901   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02902   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02903   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02904   312   NtEnumerateValueKey  (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02905   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02906   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02907   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02908   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02909   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02910   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02911   312   NtClose  (368, ... ) == 0x0
 02912   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 368, ) }, ... 368, ) == 0x0
 02913   312   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "ActiveComputerName"}, ... 384, ) }, ... 384, ) == 0x0
 02914   312   NtQueryValueKey  (384,  (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02915   312   NtClose  (384, ... ) == 0x0
 02916   312   NtClose  (368, ... ) == 0x0
 02917   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02918   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02919   312   NtQueryValueKey  (368,  (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02920   312   NtClose  (368, ... ) == 0x0
 02921   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02922   312   NtQueryValueKey  (368,  (368, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 02923   312   NtClose  (368, ... ) == 0x0
 02924   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02925   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 368, ) }, ... 368, ) == 0x0
 02926   312   NtQueryValueKey  (368,  (368, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 02927   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02928   312   NtQueryValueKey  (368,  (368, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 02929   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02930   312   NtClose  (368, ... ) == 0x0
 02931   312   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02932   312   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 368, ) }, ... 368, ) == 0x0
 02933   312   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02934   312   NtQueryInformationToken  (364, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 02935   312   NtDuplicateToken  (364, 0xc, {24, 0, 0x0, 0, 1239544, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 02936   312   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02937   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02938   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 384, ) == 0x0
 02939   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02940   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02941   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237748,  (0xc0100080, {24, 0, 0x40, 0, 1237748, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) == 0x0
 02942   312   NtSetInformationFile  (380, 1237804, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02943   312   NtSetInformationFile  (380, 1237796, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02944   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02945   312   NtWriteFile  (380, 325, 0, 0,  (380, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02946   312   NtReadFile  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20E \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02947   312   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20E \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20E \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02948   312   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\0\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\0\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02949   312   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\0\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\0\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02950   312   NtClose  (384, ... ) == 0x0
 02951   312   NtClose  (380, ... ) == 0x0
 02952   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02953   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02954   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02955   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02956   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237744,  (0xc0100080, {24, 0, 0x40, 0, 1237744, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02957   312   NtSetInformationFile  (384, 1237800, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02958   312   NtSetInformationFile  (384, 1237792, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02959   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02960   312   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02961   312   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20F \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02962   312   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20F \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20F \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02963   312   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\1\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\1\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\1\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\1\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02964   312   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\1\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\1\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02965   312   NtClose  (380, ... ) == 0x0
 02966   312   NtClose  (384, ... ) == 0x0
 02967   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02968   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02969   312   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02970   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 02971   312   NtQueryValueKey  (384,  (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 02972   312   NtClose  (384, ... ) == 0x0
 02973   312   NtCreateKey  (0x2001f, {24, 368, 0x40, 0, 0,  (0x2001f, {24, 368, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 02974   312   NtQueryValueKey  (384,  (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02975   312   NtClose  (384, ... ) == 0x0
 02976   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02977   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02978   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1239448, ... ) }, 1239448, ... ) == 0x0
 02979   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239456,  (0x80100080, {24, 0, 0x40, 0, 1239456, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02980   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02981   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02982   312   NtQueryInformationFile  (384, 1239472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02983   312   NtReadFile  (384, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 02984   312   NtClose  (384, ... ) == 0x0
 02985   312   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02986   312   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02987   312   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02988   312   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02989   312   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02990   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02991   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02992   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02993   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02994   312   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02995   312   NtClose  (380, ... ) == 0x0
 02996   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02997   312   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02998   312   NtClose  (380, ... ) == 0x0
 02999   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03000   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03001   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03002   312   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03003   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03004   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03005   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 03006   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 03007   312   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03008   312   NtClose  (380, ... ) == 0x0
 03009   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 03010   312   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03011   312   NtClose  (380, ... ) == 0x0
 03012   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03013   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03014   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03015   312   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03016   312   NtClose  (384, ... ) == 0x0
 03017   312   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "Volatile Environment"}, ... 384, ) }, ... 384, ) == 0x0
 03018   312   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03019   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03020   312   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03021   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03022   312   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03023   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03024   312   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03025   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03026   312   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03027   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03028   312   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03029   312   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03030   312   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03031   312   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03032   312   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03033   312   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03034   312   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03035   312   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03036   312   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03037   312   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03038   312   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03039   312   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03040   312   NtClose  (384, ... ) == 0x0
 03041   312   NtClose  (368, ... ) == 0x0
 03042   312   NtFreeVirtualMemory  (-1, (0xa30000), 0, 32768, ... (0xa30000), 4096, ) == 0x0
 03043   312   NtClose  (376, ... ) == 0x0
 03044   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1240112, ... ) }, 1240112, ... ) == 0x0
 03045   312   NtQueryInformationToken  (364, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03046   312   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 03047   312   NtCreateKey  (0x2000000, {24, 376, 0x40, 0, 0,  (0x2000000, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 03048   312   NtClose  (376, ... ) == 0x0
 03049   312   NtSetValueKey  (368,  (368, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (368, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03050   312   NtClose  (368, ... ) == 0x0
 03051   312   NtClose  (364, ... ) == 0x0
 03052   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03053   312   NtCreateKey  (0x2, {24, 360, 0x40, 0, 0,  (0x2, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03054   312   NtSetValueKey  (364,  (364, "MigrateProxy", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (364, "MigrateProxy", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03055   312   NtClose  (364, ... ) == 0x0
 03056   312   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, ... 364, ) }, ... 364, ) == 0x0
 03057   312   NtQueryValueKey  (364,  (364, "ProxyEnable", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "ProxyEnable", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03058   312   NtQueryValueKey  (364,  (364, "ProxyServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03059   312   NtQueryValueKey  (364,  (364, "ProxyOverride", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03060   312   NtQueryValueKey  (364,  (364, "AutoConfigURL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03061   312   NtClose  (364, ... ) == 0x0
 03062   312   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03063   312   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03064   312   NtQueryValueKey  (364,  (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03065   312   NtQueryValueKey  (364,  (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03066   312   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03067   312   NtClose  (364, ... ) == 0x0
 03068   312   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03069   312   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03070   312   NtQueryValueKey  (364,  (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03071   312   NtQueryValueKey  (364,  (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03072   312   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03073   312   NtClose  (364, ... ) == 0x0
 03074   312   NtWaitForSingleObject  (228, 0, 0x0, ... ) == 0x0
 03075   312   NtClearEvent  (228, ... ) == 0x0
 03076   312   NtSetEvent  (228, ... 0x0, ) == 0x0
 03077   312   NtCreateKey  (0x20006, {24, 360, 0x40, 0, 0,  (0x20006, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03078   312   NtSetValueKey  (364,  (364, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 0, 4,  (364, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03079   312   NtDeleteValueKey  (364,  (364, "ProxyServer", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03080   312   NtDeleteValueKey  (364,  (364, "ProxyOverride", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03081   312   NtDeleteValueKey  (364,  (364, "AutoConfigURL", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03082   312   NtClose  (364, ... ) == 0x0
 03083   312   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT"}, ... 364, ) }, ... 364, ) == 0x0
 03084   312   NtCreateKey  (0x2, {24, 364, 0x40, 0, 0,  (0x2, {24, 364, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 368, 2, ) }, 0, "", 0, ... 368, 2, ) == 0x0
 03085   312   NtSetValueKey  (368,  (368, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 0, 4,  (368, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03086   312   NtClose  (368, ... ) == 0x0
 03087   312   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03088   312   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 368, 2, ) }, 0, "", 0, ... 368, 2, ) == 0x0
 03089   312   NtQueryValueKey  (368,  (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03090   312   NtQueryValueKey  (368,  (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03091   312   NtCreateKey  (0x2, {24, 360, 0x40, 0, 0,  (0x2, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 376, 2, ) }, 0, "", 0, ... 376, 2, ) == 0x0
 03092   312   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03093   312   NtClose  (368, ... ) == 0x0
 03094   312   NtSetValueKey  (376,  (376, "SavedLegacySettings", 0, 3, "<\0\0\0\27\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0", 56, ... , 0, 3,  (376, "SavedLegacySettings", 0, 3, "<\0\0\0\27\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0", 56, ... , 56, ...
 03095   312   NtSetInformationFile  (-2147482704, -136313036, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 03096   312   NtSetInformationFile  (-2147482704, -136313136, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 03094   312   NtSetValueKey  ... ) == 0x0
 03097   312   NtClose  (376, ... ) == 0x0
 03098   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03099   312   NtQueryInformationFile  (192, 1242180, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03100   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03101   312   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03102   312   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03103   312   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03104   312   NtClearEvent  (376, ... ) == 0x0
 03105   312   NtSetEvent  (376, ... 0x0, ) == 0x0
 03106   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03107   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1239760, ... }, 1239760, ...
 02524   548   NtWaitForSingleObject  ... ) == 0x0
 03108   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03109   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03107   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03110   312   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "wsock32.dll"}, 1239760, ... }, 1239760, ...
 03109   548   NtWaitForSingleObject  ... ) == 0x0
 03111   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03112   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03110   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03113   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 1239760, ... ) }, 1239760, ... ) == 0x0
 03114   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 5, 96, ... 368, {status=0x0, info=1}, ) }, 5, 96, ... 368, {status=0x0, info=1}, ) == 0x0
 03115   312   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 368, ... 384, ) == 0x0
 03116   312   NtQuerySection  (384, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03117   312   NtClose  (368, ... ) == 0x0
 03118   312   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0
 03119   312   NtClose  (384, ... ) == 0x0
 03120   312   NtClearEvent  (228, ... ) == 0x0
 03121   312   NtSetEvent  (228, ... 0x0, ) == 0x0
 03122   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03123   312   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03124   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03125   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03126   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03127   312   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03128   312   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03129   312   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03130   312   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03131   312   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03132   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03133   312   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03134   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03135   312   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03136   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "urlmon.dll"}, ... 384, ) }, ... 384, ) == 0x0
 03137   312   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x760f0000), 0x0, 491520, ) == 0x0
 03138   312   NtClose  (384, ... ) == 0x0
 03139   312   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "VERSION.dll"}, ... 384, ) }, ... 384, ) == 0x0
 03140   312   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 28672, ) == 0x0
 03141   312   NtClose  (384, ... ) == 0x0
 03142   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 03143   312   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 10682368, 65536, ) == 0x0
 03144   312   NtAllocateVirtualMemory  (-1, 10682368, 0, 4096, 4096, 4, ... 10682368, 4096, ) == 0x0
 03145   312   NtAllocateVirtualMemory  (-1, 10686464, 0, 8192, 4096, 4, ... 10686464, 8192, ) == 0x0
 03146   312   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCounterMutex"}, 0, ... 384, ) }, 0, ... 384, ) == 0x0
 03147   312   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCacheCounterMutex"}, 0, ... 368, ) }, 0, ... 368, ) == 0x0
 03148   312   NtQueryDefaultUILanguage  (1237672, ...
 03149   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03150   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482032, ) == 0x0
 03151   312   NtQueryInformationToken  (-2147482032, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03152   312   NtClose  (-2147482032, ... ) == 0x0
 03153   312   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 03154   312   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03155   312   NtOpenKey  (0x80000000, {24, -2147482032, 0x640, 0, 0,  (0x80000000, {24, -2147482032, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482028, ) }, ... -2147482028, ) == 0x0
 03156   312   NtQueryValueKey  (-2147482028,  (-2147482028, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03157   312   NtClose  (-2147482028, ... ) == 0x0
 03158   312   NtClose  (-2147482032, ... ) == 0x0
 03148   312   NtQueryDefaultUILanguage  ... ) == 0x0
 03159   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03160   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 1, 96, ... 380, {status=0x0, info=1}, ) }, 1, 96, ... 380, {status=0x0, info=1}, ) == 0x0
 03161   312   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 380, ... 388, ) == 0x0
 03162   312   NtMapViewOfSection  (388, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa60000), 0x0, 454656, ) == 0x0
 03163   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03164   312   NtQueryDefaultLocale  (1, 1235708, ... ) == 0x0
 03165   312   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03166   312   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1547, 0} " S\26\0\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 304, 312, 1547, 0}  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" ... {128, 156, reply, 0, 304, 312, 1547, 0} " S\26\0\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" )  ) == 0x0
 03167   312   NtClose  (380, ... ) == 0x0
 03168   312   NtClose  (388, ... ) == 0x0
 03169   312   NtUnmapViewOfSection  (-1, 0xa60000, ... ) == 0x0
 03170   312   NtUnmapViewOfSection  (-1, 0x12e554, ... ) == STATUS_NOT_MAPPED_VIEW
 03171   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03172   312   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03173   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03174   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03175   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1234248, ... }, 1234248, ...
 03112   548   NtWaitForSingleObject  ... ) == 0x0
 03176   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03177   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03175   312   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03178   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03179   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03180   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03181   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1234840, ... ) }, 1234840, ... ) == 0x0
 03182   312   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 388, {status=0x0, info=1}, ) }, 3, 33, ... 388, {status=0x0, info=1}, ) == 0x0
 03183   312   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03184   312   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 03185   312   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 03186   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03187   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03188   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 03189   312   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03190   312   NtClose  (380, ... ) == 0x0
 03191   312   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes"}, ... 380, ) }, ... 380, ) == 0x0
 03192   312   NtSetInformationObject  (382, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 03193   312   NtQueryKey  (382, Name, 384, ... {Name= (382, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 03194   312   NtOpenKey  (0x2000000, {24, 382, 0x40, 0, 0,  (0x2000000, {24, 382, 0x40, 0, 0, "PROTOCOLS\Name-Space Handler\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03195   312   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\PROTOCOLS\Name-Space Handler"}, ... 392, ) }, ... 392, ) == 0x0
 03196   312   NtQueryKey  (394, Name, 392, ... {Name= (394, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space HandlerS"}, 130, ) }, 130, ) == 0x0
 03197   312   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03198   312   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03199   312   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03200   312   NtClose  (396, ... ) == 0x0
 03201   312   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\PROTOCOLS\Name-Space Handler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03202   312   NtEnumerateKey  (394, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name= (394, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name="mk", Class=""}, 28, ) , Class=""}, 28, ) == 0x0
 03203   312   NtEnumerateKey  (394, 1, Node, 288, ... ) == STATUS_NO_MORE_ENTRIES
 03204   312   NtClose  (394, ... ) == 0x0
 03205   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03206   312   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03207   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 392, ) }, ... 392, ) == 0x0
 03208   312   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Ranges\"}, ... 396, ) }, ... 396, ) == 0x0
 03209   312   NtQueryKey  (396, 4, 176, ... {key info, class 4, size 40}, 40, ) == 0x0
 03210   312   NtClose  (396, ... ) == 0x0
 03211   312   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 304, 312, 1548, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 304, 312, 1548, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 304, 312, 1548, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 03212   312   NtCreateSection  (0xf0007, {24, 52, 0x80, 0, 0,  (0xf0007, {24, 52, 0x80, 0, 0, "UrlZonesSM_SRI-user"}, {8, 0}, 4, 134217728, 0, ... 396, ) }, {8, 0}, 4, 134217728, 0, ... 396, ) == 0x0
 03213   312   NtMapViewOfSection  (396, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa60000), {0, 0}, 4096, ) == 0x0
 03214   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 400, ) }, ... 400, ) == 0x0
 03215   312   NtQueryValueKey  (400,  (400, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03216   312   NtClose  (400, ... ) == 0x0
 03217   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 400, ) }, ... 400, ) == 0x0
 03218   312   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "0"}, ... 404, ) }, ... 404, ) == 0x0
 03219   312   NtClose  (404, ... ) == 0x0
 03220   312   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "1"}, ... 404, ) }, ... 404, ) == 0x0
 03221   312   NtClose  (404, ... ) == 0x0
 03222   312   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "2"}, ... 404, ) }, ... 404, ) == 0x0
 03223   312   NtClose  (404, ... ) == 0x0
 03224   312   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "3"}, ... 404, ) }, ... 404, ) == 0x0
 03225   312   NtClose  (404, ... ) == 0x0
 03226   312   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "4"}, ... 404, ) }, ... 404, ) == 0x0
 03227   312   NtClose  (404, ... ) == 0x0
 03228   312   NtClose  (400, ... ) == 0x0
 03229   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 400, ) }, ... 400, ) == 0x0
 03230   312   NtEnumerateKey  (400, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name= (400, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name="0"}, 18, ) }, 18, ) == 0x0
 03231   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"}, ... 404, ) }, ... 404, ) == 0x0
 03232   312   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) }, 16, ) == 0x0
 03233   312   NtClose  (404, ... ) == 0x0
 03234   312   NtEnumerateKey  (400, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="1"}, 18, ) }, 18, ) == 0x0
 03235   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1"}, ... 404, ) }, ... 404, ) == 0x0
 03236   312   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) }, 16, ) == 0x0
 03237   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03238   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03239   312   NtOpenKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 408, ) }, ... 408, ) == 0x0
 03240   312   NtSetValueKey  (408,  (408, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03241   312   NtSetValueKey  (408,  (408, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03242   312   NtSetValueKey  (408,  (408, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03243   312   NtClose  (408, ... ) == 0x0
 03244   312   NtClose  (404, ... ) == 0x0
 03245   312   NtEnumerateKey  (400, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="2I"}, 18, ) }, 18, ) == 0x0
 03246   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2"}, ... 404, ) }, ... 404, ) == 0x0
 03247   312   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) }, 16, ) == 0x0
 03248   312   NtClose  (404, ... ) == 0x0
 03249   312   NtEnumerateKey  (400, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="3"}, 18, ) }, 18, ) == 0x0
 03250   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 404, ) }, ... 404, ) == 0x0
 03251   312   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03252   312   NtClose  (404, ... ) == 0x0
 03253   312   NtEnumerateKey  (400, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="4"}, 18, ) }, 18, ) == 0x0
 03254   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"}, ... 404, ) }, ... 404, ) == 0x0
 03255   312   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03256   312   NtClose  (404, ... ) == 0x0
 03257   312   NtEnumerateKey  (400, 5, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 03258   312   NtClose  (400, ... ) == 0x0
 03259   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03260   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03261   312   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03262   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03263   312   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03264   312   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03265   312   NtClearEvent  (228, ... ) == 0x0
 03266   312   NtSetEvent  (228, ... 0x0, ) == 0x0
 03267   312   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 400, ) }, ... 400, ) == 0x0
 03268   312   NtQueryValueKey  (400,  (400, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03269   312   NtClose  (400, ... ) == 0x0
 03270   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03271   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03272   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03273   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03274   312   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03275   312   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03276   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 400, ) }, ... 400, ) == 0x0
 03277   312   NtQueryValueKey  (400,  (400, "1A10", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "1A10", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03278   312   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03279   312   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03280   312   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03281   312   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03282   312   NtClose  (400, ... ) == 0x0
 03283   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03284   312   NtQueryInformationFile  (192, 1241900, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03285   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03286   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03287   312   NtQueryInformationFile  (192, 1239516, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03288   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03289   312   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03290   312   NtQueryInformationFile  (212, 1241480, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03291   312   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03292   312   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03293   312   NtQueryInformationFile  (212, 1241440, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03294   312   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03295   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03296   312   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 400, ) == 0x0
 03297   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03298   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03299   312   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {128, 152, reply, 0, 304, 312, 1550, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1550, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {128, 152, reply, 0, 304, 312, 1550, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03300   312   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 44, 3, 20, 0}  (408, {64, 88, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\10\0\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 304, 312, 1551, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 304, 312, 1551, 0}  (408, {64, 88, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\10\0\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 304, 312, 1551, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03301   312   NtClose  (404, ... ) == 0x0
 03302   312   NtClose  (408, ... ) == 0x0
 03303   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03304   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03305   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03306   312   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03307   312   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03308   312   NtClose  (408, ... ) == 0x0
 03309   312   NtClose  (404, ... ) == 0x0
 03310   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03311   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03312   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03313   312   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03314   312   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03315   312   NtClose  (404, ... ) == 0x0
 03316   312   NtClose  (408, ... ) == 0x0
 03317   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03318   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03319   312   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03320   312   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03321   312   NtClose  (408, ... ) == 0x0
 03322   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03323   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03324   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03325   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03326   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03327   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03328   312   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1554, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1554, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1554, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" )  ) == 0x0
 03329   312   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 304, 312, 1551, 0}  (404, {112, 136, new_msg, 0, 304, 312, 1551, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03177   548   NtWaitForSingleObject  ... ) == 0x0
 03330   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03331   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03329   312   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 304, 312, 1555, 0}  ... {44, 68, reply, 0, 304, 312, 1555, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03332   312   NtClose  (408, ... ) == 0x0
 03333   312   NtClose  (404, ... ) == 0x0
 03334   312   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03335   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03336   312   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03337   312   NtClose  (408, ... ) == 0x0
 03338   312   NtClose  (404, ... ) == 0x0
 03339   312   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03340   312   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03341   312   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03342   312   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03343   312   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03344   312   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03345   312   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 03346   312   NtClose  (404, ... ) == 0x0
 03347   312   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03348   312   NtClose  (408, ... ) == 0x0
 03349   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03350   312   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03351   312   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 03352   312   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 03353   312   NtClose  (408, ... ) == 0x0
 03354   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03355   312   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03356   312   NtClose  (408, ... ) == 0x0
 03357   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03358   312   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03359   312   NtClose  (408, ... ) == 0x0
 03360   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03361   312   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03362   312   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03363   312   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03364   312   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 03365   312   NtClose  (404, ... ) == 0x0
 03366   312   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 03367   312   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 03368   312   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ... 1437696, 4096, ) == 0x0
 03369   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03370   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03371   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03372   312   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03373   312   NtClose  (404, ... ) == 0x0
 03374   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03375   312   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 03376   312   NtClose  (404, ... ) == 0x0
 03377   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03378   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 03379   312   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 03380   312   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 03381   312   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03382   312   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03383   312   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03384   312   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03385   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03386   312   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03387   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03388   312   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03389   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03390   312   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03391   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03392   312   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03393   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03394   312   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03395   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03396   312   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03397   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03398   312   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03399   312   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03400   312   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03401   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03402   312   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03403   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03404   312   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03405   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03406   312   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03407   312   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03408   312   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03409   312   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03410   312   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03411   312   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03412   312   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03413   312   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03414   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03415   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03416   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03417   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03418   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03419   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03420   312   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03421   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03422   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03423   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03424   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03425   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03426   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03427   312   NtClose  (404, ... ) == 0x0
 03428   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 03429   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 03430   312   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03431   312   NtClose  (416, ... ) == 0x0
 03432   312   NtClose  (404, ... ) == 0x0
 03433   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03434   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03435   312   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03436   312   NtClose  (404, ... ) == 0x0
 03437   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03438   312   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03439   312   NtClose  (404, ... ) == 0x0
 03440   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03441   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 03442   312   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03443   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03444   312   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03445   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03446   312   NtClose  (404, ... ) == 0x0
 03447   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03448   312   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03449   312   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03450   312   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03451   312   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03452   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03453   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03454   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 03455   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03456   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03457   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 03458   312   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03459   312   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03460   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03461   312   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03462   312   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20G \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03463   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20G \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20G \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03464   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\2\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\2\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03465   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03466   312   NtClose  (416, ... ) == 0x0
 03467   312   NtClose  (420, ... ) == 0x0
 03468   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03469   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 03470   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03471   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03472   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03473   312   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03474   312   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03475   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03476   312   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03477   312   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20H \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03478   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20H \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20H \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03479   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\3\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\3\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\3\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\3\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03480   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\3\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\3\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03481   312   NtClose  (420, ... ) == 0x0
 03482   312   NtClose  (416, ... ) == 0x0
 03483   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03484   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03485   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03486   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 03487   312   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03488   312   NtClose  (416, ... ) == 0x0
 03489   312   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 03490   312   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03491   312   NtClose  (416, ... ) == 0x0
 03492   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03493   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03494   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 03495   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03496   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03497   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03498   312   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03499   312   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03500   312   NtClose  (416, ... ) == 0x0
 03501   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03502   312   NtAllocateVirtualMemory  (-1, 1441792, 0, 12288, 4096, 4, ... 1441792, 12288, ) == 0x0
 03503   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03504   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03505   312   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03506   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03507   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03508   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03509   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03510   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03511   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03512   312   NtClose  (420, ... ) == 0x0
 03513   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03514   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03515   312   NtClose  (420, ... ) == 0x0
 03516   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03517   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03518   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03519   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03520   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03521   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03522   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03523   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03524   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03525   312   NtClose  (420, ... ) == 0x0
 03526   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03527   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03528   312   NtClose  (420, ... ) == 0x0
 03529   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03530   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03531   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03532   312   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03533   312   NtClose  (416, ... ) == 0x0
 03534   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03535   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03536   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03537   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03538   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03539   312   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03540   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03541   312   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03542   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03543   312   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03544   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03545   312   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03546   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03547   312   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03548   312   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03549   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03550   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03551   312   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03552   312   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03553   312   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03554   312   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03555   312   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03556   312   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03557   312   NtClose  (416, ... ) == 0x0
 03558   312   NtClose  (404, ... ) == 0x0
 03559   312   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 03560   312   NtClose  (412, ... ) == 0x0
 03561   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 03562   312   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03563   312   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 03564   312   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03565   312   NtClose  (412, ... ) == 0x0
 03566   312   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03567   312   NtClose  (404, ... ) == 0x0
 03568   312   NtClose  (408, ... ) == 0x0
 03569   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03570   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03571   312   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03572   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03573   312   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03574   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03575   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03576   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03577   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03578   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03579   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03580   312   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1558, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1558, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1558, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03581   312   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03331   548   NtWaitForSingleObject  ... ) == 0x0
 03582   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03583   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03581   312   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 304, 312, 1559, 0}  ... {44, 68, reply, 0, 304, 312, 1559, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03584   312   NtClose  (408, ... ) == 0x0
 03585   312   NtClose  (404, ... ) == 0x0
 03586   312   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03587   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03588   312   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03589   312   NtClose  (408, ... ) == 0x0
 03590   312   NtClose  (404, ... ) == 0x0
 03591   312   NtClearEvent  (376, ... ) == 0x0
 03592   312   NtSetEvent  (376, ... 0x0, ) == 0x0
 03593   312   NtClose  (376, ... ) == 0x0
 03594   312   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03595   312   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03596   312   NtClearEvent  (376, ... ) == 0x0
 03597   312   NtSetEvent  (376, ... 0x0, ) == 0x0
 03598   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03599   312   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03600   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03601   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03602   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03603   312   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03604   312   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03605   312   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03606   312   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03607   312   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03608   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03609   312   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03610   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03611   312   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03612   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03613   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03614   312   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03615   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03616   312   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03617   312   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03618   312   NtClearEvent  (228, ... ) == 0x0
 03619   312   NtSetEvent  (228, ... 0x0, ) == 0x0
 03620   312   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 404, ) }, ... 404, ) == 0x0
 03621   312   NtQueryValueKey  (404,  (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03622   312   NtClose  (404, ... ) == 0x0
 03623   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03624   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03625   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03626   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03627   312   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03628   312   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03629   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03630   312   NtQueryInformationFile  (192, 1241896, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03631   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03632   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03633   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03634   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03635   312   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1562, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1562, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1562, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 03636   312   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 304, 312, 1559, 0}  (408, {64, 88, new_msg, 0, 304, 312, 1559, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 304, 312, 1563, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 304, 312, 1563, 0}  (408, {64, 88, new_msg, 0, 304, 312, 1559, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 304, 312, 1563, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03637   312   NtClose  (404, ... ) == 0x0
 03638   312   NtClose  (408, ... ) == 0x0
 03639   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03640   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03641   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03642   312   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03643   312   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03644   312   NtClose  (408, ... ) == 0x0
 03645   312   NtClose  (404, ... ) == 0x0
 03646   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03647   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03648   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03649   312   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03650   312   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03651   312   NtClose  (404, ... ) == 0x0
 03652   312   NtClose  (408, ... ) == 0x0
 03653   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03654   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03655   312   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03656   312   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03657   312   NtClose  (408, ... ) == 0x0
 03658   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03659   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03660   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03661   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03662   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03663   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03664   312   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1566, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1566, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1566, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 03665   312   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 304, 312, 1563, 0}  (404, {112, 136, new_msg, 0, 304, 312, 1563, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03583   548   NtWaitForSingleObject  ... ) == 0x0
 03666   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03667   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03665   312   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 304, 312, 1567, 0}  ... {44, 68, reply, 0, 304, 312, 1567, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03668   312   NtClose  (408, ... ) == 0x0
 03669   312   NtClose  (404, ... ) == 0x0
 03670   312   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03671   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03672   312   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv02.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03673   312   NtClose  (408, ... ) == 0x0
 03674   312   NtClose  (404, ... ) == 0x0
 03675   312   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03676   312   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03677   312   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03678   312   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03679   312   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03680   312   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03681   312   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 03682   312   NtClose  (404, ... ) == 0x0
 03683   312   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03684   312   NtClose  (408, ... ) == 0x0
 03685   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03686   312   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03687   312   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 03688   312   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 03689   312   NtClose  (408, ... ) == 0x0
 03690   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03691   312   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03692   312   NtClose  (408, ... ) == 0x0
 03693   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03694   312   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03695   312   NtClose  (408, ... ) == 0x0
 03696   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03697   312   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03698   312   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03699   312   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03700   312   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 03701   312   NtClose  (404, ... ) == 0x0
 03702   312   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 03703   312   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 03704   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03705   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03706   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03707   312   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03708   312   NtClose  (404, ... ) == 0x0
 03709   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03710   312   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 03711   312   NtClose  (404, ... ) == 0x0
 03712   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03713   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 03714   312   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 03715   312   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 03716   312   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03717   312   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03718   312   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03719   312   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03720   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03721   312   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03722   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03723   312   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03724   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03725   312   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03726   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03727   312   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03728   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03729   312   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03730   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03731   312   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03732   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03733   312   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03734   312   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03735   312   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03736   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03737   312   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03738   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03739   312   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03740   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03741   312   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03742   312   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03743   312   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03744   312   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03745   312   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03746   312   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03747   312   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03748   312   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03749   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03750   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03751   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03752   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03753   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03754   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03755   312   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03756   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03757   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03758   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03759   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03760   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03761   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03762   312   NtClose  (404, ... ) == 0x0
 03763   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 03764   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 03765   312   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03766   312   NtClose  (416, ... ) == 0x0
 03767   312   NtClose  (404, ... ) == 0x0
 03768   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03769   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03770   312   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03771   312   NtClose  (404, ... ) == 0x0
 03772   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03773   312   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03774   312   NtClose  (404, ... ) == 0x0
 03775   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03776   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 03777   312   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03778   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03779   312   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03780   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03781   312   NtClose  (404, ... ) == 0x0
 03782   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03783   312   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03784   312   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03785   312   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03786   312   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03787   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03788   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03789   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 03790   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03791   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03792   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 03793   312   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03794   312   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03795   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03796   312   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03797   312   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20I \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03798   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20I \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20I \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03799   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\4\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\4\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\4\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\4\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03800   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\4\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\4\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03801   312   NtClose  (416, ... ) == 0x0
 03802   312   NtClose  (420, ... ) == 0x0
 03803   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03804   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 03805   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03806   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03807   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03808   312   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03809   312   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03810   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03811   312   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03812   312   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20J \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03813   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20J \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20J \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03814   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\5\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\5\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\5\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\5\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03815   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\5\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\5\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03816   312   NtClose  (420, ... ) == 0x0
 03817   312   NtClose  (416, ... ) == 0x0
 03818   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03819   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03820   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03821   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 03822   312   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03823   312   NtClose  (416, ... ) == 0x0
 03824   312   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 03825   312   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03826   312   NtClose  (416, ... ) == 0x0
 03827   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03828   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03829   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 03830   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03831   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03832   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03833   312   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03834   312   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03835   312   NtClose  (416, ... ) == 0x0
 03836   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03837   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03838   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03839   312   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03840   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03841   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03842   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03843   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03844   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03845   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03846   312   NtClose  (420, ... ) == 0x0
 03847   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03848   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03849   312   NtClose  (420, ... ) == 0x0
 03850   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03851   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03852   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03853   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03854   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03855   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03856   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03857   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03858   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03859   312   NtClose  (420, ... ) == 0x0
 03860   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03861   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03862   312   NtClose  (420, ... ) == 0x0
 03863   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03864   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03865   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03866   312   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03867   312   NtClose  (416, ... ) == 0x0
 03868   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03869   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03870   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03871   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03872   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03873   312   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03874   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03875   312   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03876   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03877   312   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03878   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03879   312   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03880   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03881   312   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03882   312   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03883   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03884   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03885   312   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03886   312   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03887   312   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03888   312   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03889   312   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03890   312   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03891   312   NtClose  (416, ... ) == 0x0
 03892   312   NtClose  (404, ... ) == 0x0
 03893   312   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 03894   312   NtClose  (412, ... ) == 0x0
 03895   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 03896   312   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03897   312   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 03898   312   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03899   312   NtClose  (412, ... ) == 0x0
 03900   312   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03901   312   NtClose  (404, ... ) == 0x0
 03902   312   NtClose  (408, ... ) == 0x0
 03903   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03904   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03905   312   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03906   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03907   312   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03908   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03909   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03910   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03911   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03912   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03913   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03914   312   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1570, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1570, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1570, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03915   312   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03667   548   NtWaitForSingleObject  ... ) == 0x0
 03916   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03917   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03915   312   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 304, 312, 1571, 0}  ... {44, 68, reply, 0, 304, 312, 1571, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03918   312   NtClose  (408, ... ) == 0x0
 03919   312   NtClose  (404, ... ) == 0x0
 03920   312   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03921   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03922   312   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv02.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03923   312   NtClose  (408, ... ) == 0x0
 03924   312   NtClose  (404, ... ) == 0x0
 03925   312   NtClearEvent  (376, ... ) == 0x0
 03926   312   NtSetEvent  (376, ... 0x0, ) == 0x0
 03927   312   NtClose  (376, ... ) == 0x0
 03928   312   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03929   312   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03930   312   NtClearEvent  (376, ... ) == 0x0
 03931   312   NtSetEvent  (376, ... 0x0, ) == 0x0
 03932   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03933   312   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03934   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03935   312   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03936   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03937   312   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03938   312   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03939   312   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03940   312   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03941   312   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03942   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03943   312   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03944   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03945   312   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03946   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03947   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03948   312   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\debelizombi.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03949   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\debelizombi.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03950   312   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03951   312   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03952   312   NtClearEvent  (228, ... ) == 0x0
 03953   312   NtSetEvent  (228, ... 0x0, ) == 0x0
 03954   312   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 404, ) }, ... 404, ) == 0x0
 03955   312   NtQueryValueKey  (404,  (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03956   312   NtClose  (404, ... ) == 0x0
 03957   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03958   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03959   312   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03960   312   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03961   312   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03962   312   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03963   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03964   312   NtQueryInformationFile  (192, 1241896, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03965   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03966   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03967   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03968   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03969   312   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1574, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1574, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1574, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 03970   312   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 304, 312, 1571, 0}  (408, {64, 88, new_msg, 0, 304, 312, 1571, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 304, 312, 1575, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 304, 312, 1575, 0}  (408, {64, 88, new_msg, 0, 304, 312, 1571, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 304, 312, 1575, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03971   312   NtClose  (404, ... ) == 0x0
 03972   312   NtClose  (408, ... ) == 0x0
 03973   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03974   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03975   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03976   312   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03977   312   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03978   312   NtClose  (408, ... ) == 0x0
 03979   312   NtClose  (404, ... ) == 0x0
 03980   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03981   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03982   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03983   312   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03984   312   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03985   312   NtClose  (404, ... ) == 0x0
 03986   312   NtClose  (408, ... ) == 0x0
 03987   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03988   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03989   312   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03990   312   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03991   312   NtClose  (408, ... ) == 0x0
 03992   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03993   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03994   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03995   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03996   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03997   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03998   312   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1578, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1578, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1578, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 03999   312   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 304, 312, 1575, 0}  (404, {112, 136, new_msg, 0, 304, 312, 1575, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03917   548   NtWaitForSingleObject  ... ) == 0x0
 04000   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=95}, 0x0, ) , 16, 0, ... {status=0x103, info=95}, 0x0, ) == 0x103
 04001   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03999   312   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 304, 312, 1579, 0}  ... {44, 68, reply, 0, 304, 312, 1579, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 04002   312   NtClose  (408, ... ) == 0x0
 04003   312   NtClose  (404, ... ) == 0x0
 04004   312   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 04005   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 04006   312   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.debelizombi.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 04007   312   NtClose  (408, ... ) == 0x0
 04008   312   NtClose  (404, ... ) == 0x0
 04009   312   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 04010   312   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 04011   312   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 04012   312   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04013   312   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04014   312   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 04015   312   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 04016   312   NtClose  (404, ... ) == 0x0
 04017   312   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04018   312   NtClose  (408, ... ) == 0x0
 04019   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04020   312   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 04021   312   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 04022   312   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 04023   312   NtClose  (408, ... ) == 0x0
 04024   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 04025   312   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 04026   312   NtClose  (408, ... ) == 0x0
 04027   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 04028   312   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 04029   312   NtClose  (408, ... ) == 0x0
 04030   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04031   312   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 04032   312   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 04033   312   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 04034   312   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 04035   312   NtClose  (404, ... ) == 0x0
 04036   312   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 04037   312   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 04038   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04039   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04040   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04041   312   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 04042   312   NtClose  (404, ... ) == 0x0
 04043   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04044   312   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 04045   312   NtClose  (404, ... ) == 0x0
 04046   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04047   312   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 04048   312   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 04049   312   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 04050   312   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 04051   312   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 04052   312   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 04053   312   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 04054   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04055   312   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 04056   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04057   312   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 04058   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04059   312   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 04060   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04061   312   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 04062   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04063   312   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 04064   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04065   312   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 04066   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04067   312   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04068   312   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04069   312   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 04070   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04071   312   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 04072   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04073   312   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 04074   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04075   312   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 04076   312   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 04077   312   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 04078   312   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 04079   312   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 04080   312   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 04081   312   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 04082   312   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04083   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04084   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04085   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 04086   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04087   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04088   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04089   312   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04090   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04091   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04092   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 04093   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04094   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04095   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04096   312   NtClose  (404, ... ) == 0x0
 04097   312   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 04098   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 04099   312   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 04100   312   NtClose  (416, ... ) == 0x0
 04101   312   NtClose  (404, ... ) == 0x0
 04102   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04103   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04104   312   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 04105   312   NtClose  (404, ... ) == 0x0
 04106   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04107   312   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 04108   312   NtClose  (404, ... ) == 0x0
 04109   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04110   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 04111   312   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 04112   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04113   312   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 04114   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04115   312   NtClose  (404, ... ) == 0x0
 04116   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04117   312   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 04118   312   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 04119   312   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 04120   312   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 04121   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04122   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04123   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 04124   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04125   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04126   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 04127   312   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04128   312   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04129   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04130   312   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04131   312   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20K \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04132   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20K \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20K \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04133   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\6\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\6\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\6\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\6\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04134   312   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\6\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\6\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 04135   312   NtClose  (416, ... ) == 0x0
 04136   312   NtClose  (420, ... ) == 0x0
 04137   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04138   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 04139   312   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04140   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04141   312   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 04142   312   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04143   312   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04144   312   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04145   312   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04146   312   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20L \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04147   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20L \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20L \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04148   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\7\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\7\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\7\26)\273\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\7\26)\273\322?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04149   312   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\7\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\7\26)\273\322?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 04150   312   NtClose  (420, ... ) == 0x0
 04151   312   NtClose  (416, ... ) == 0x0
 04152   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04153   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04154   312   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04155   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 04156   312   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 04157   312   NtClose  (416, ... ) == 0x0
 04158   312   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 04159   312   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04160   312   NtClose  (416, ... ) == 0x0
 04161   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04162   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04163   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 04164   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 04165   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04166   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04167   312   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04168   312   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 04169   312   NtClose  (416, ... ) == 0x0
 04170   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 04171   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04172   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04173   312   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04174   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04175   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04176   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04177   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 04178   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04179   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 04180   312   NtClose  (420, ... ) == 0x0
 04181   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04182   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 04183   312   NtClose  (420, ... ) == 0x0
 04184   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04185   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04186   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04187   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04188   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04189   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04190   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 04191   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04192   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 04193   312   NtClose  (420, ... ) == 0x0
 04194   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04195   312   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 04196   312   NtClose  (420, ... ) == 0x0
 04197   312   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04198   312   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04199   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04200   312   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04201   312   NtClose  (416, ... ) == 0x0
 04202   312   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 04203   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 04204   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04205   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 04206   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04207   312   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 04208   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04209   312   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 04210   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04211   312   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 04212   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04213   312   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 04214   312   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04215   312   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 04216   312   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04217   312   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 04218   312   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 04219   312   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 04220   312   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 04221   312   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 04222   312   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 04223   312   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 04224   312   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04225   312   NtClose  (416, ... ) == 0x0
 04226   312   NtClose  (404, ... ) == 0x0
 04227   312   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 04228   312   NtClose  (412, ... ) == 0x0
 04229   312   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 04230   312   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 04231   312   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 04232   312   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 04233   312   NtClose  (412, ... ) == 0x0
 04234   312   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 04235   312   NtClose  (404, ... ) == 0x0
 04236   312   NtClose  (408, ... ) == 0x0
 04237   312   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 04238   312   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 04239   312   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04240   312   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 04241   312   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 04242   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04243   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04244   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04245   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04246   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 04247   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 04248   312   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1582, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1582, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1582, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 04249   312   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\322?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 04001   548   NtWaitForSingleObject  ... ) == 0x0
 04250   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=95}, 0x0, ) , 16, 0, ... {status=0x103, info=95}, 0x0, ) == 0x103
 04251   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 04249   312   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 304, 312, 1583, 0}  ... {44, 68, reply, 0, 304, 312, 1583, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 04252   312   NtClose  (408, ... ) == 0x0
 04253   312   NtClose  (404, ... ) == 0x0
 04254   312   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 04255   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 04256   312   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.debelizombi.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 04257   312   NtClose  (408, ... ) == 0x0
 04258   312   NtClose  (404, ... ) == 0x0
 04259   312   NtClearEvent  (376, ... ) == 0x0
 04260   312   NtSetEvent  (376, ... 0x0, ) == 0x0
 04261   312   NtClose  (376, ... ) == 0x0
 04262   312   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1242800,  (0x80100080, {24, 0, 0x40, 0, 1242800, "\??\C:\WINDOWS\imon.cfg"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04263   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04264   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04265   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1239612, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1239612, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 04266   312   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376}  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376} "\0$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1586, 0} "\7$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1586, 0}  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376} "\0$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1586, 0} "\7$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 04267   312   NtRequestWaitReplyPort  (404, {64, 88, new_msg, 0, 304, 312, 1583, 0}  (404, {64, 88, new_msg, 0, 304, 312, 1583, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 304, 312, 1587, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 304, 312, 1587, 0}  (404, {64, 88, new_msg, 0, 304, 312, 1583, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 304, 312, 1587, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 04268   312   NtClose  (376, ... ) == 0x0
 04269   312   NtClose  (404, ... ) == 0x0
 04270   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 04271   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 04272   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04273   312   NtQueryValueKey  (404,  (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04274   312   NtQueryValueKey  (404,  (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04275   312   NtClose  (404, ... ) == 0x0
 04276   312   NtClose  (376, ... ) == 0x0
 04277   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 04278   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 04279   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04280   312   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04281   312   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04282   312   NtClose  (376, ... ) == 0x0
 04283   312   NtClose  (404, ... ) == 0x0
 04284   312   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04285   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 04286   312   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1239412, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1239412, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 04287   312   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176}  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176} "\0$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1590, 0} "\7$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" )  ... {128, 152, reply, 0, 304, 312, 1590, 0}  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176} "\0$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" ... {128, 152, reply, 0, 304, 312, 1590, 0} "\7$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" )  ) == 0x0
 04288   312   NtRequestWaitReplyPort  (376, {64, 88, new_msg, 0, 304, 312, 1587, 0}  (376, {64, 88, new_msg, 0, 304, 312, 1587, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 304, 312, 1591, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 304, 312, 1591, 0}  (376, {64, 88, new_msg, 0, 304, 312, 1587, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 304, 312, 1591, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 04289   312   NtClose  (404, ... ) == 0x0
 04290   312   NtClose  (376, ... ) == 0x0
 04291   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 04292   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 04293   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04294   312   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04295   312   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04296   312   NtClose  (376, ... ) == 0x0
 04297   312   NtClose  (404, ... ) == 0x0
 04298   312   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 04299   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 04300   312   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04301   312   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04302   312   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04303   312   NtClose  (404, ... ) == 0x0
 04304   312   NtClose  (376, ... ) == 0x0
 04305   312   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 04306   312   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 04307   312   NtDeviceIoControlFile  (376, 404, 0x0, 0x0, 0xf14014,  (376, 404, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\231%\362v\2\0\0\200\330\304\362v\0\0\0\0\360\356\22\0O\345\367w{\30\335w\0\0\0\0\300.\24\0\0\0\24\0\200\23\25\0\0\0\0\0\0\360\22\0\277\37\365w\0\0\24\0\203 \365w\10\6\24\0\215\26\365w\0\0\0\0\260\27\25\0\260\31\25\0\24\232\347w\23\30\26\0\250\336\25\0\266\336\25\0\24\30\25\0\377\377\0\0\0\0\0\0\24\30\25\0\7\0\0\0\250\336\25\0\254\357\22\0\177;\245q\0\0\0\0\0\0\0\0\250\336\25\0\0\0\0\0\24\30\25\0\377\377\0\0\1\0\0\0\210\1\24\0\210\23\25\0\4\0\0\0\0\0\0\0\210\1\24\0\200\23\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q\10\30\25\0\364\27\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\260\31\1\1\0\0\24\0D\357\22\0$\364\22\0\274\373\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\260\31\25\0\240\305\25\0\310\266\25\0\340\266\25\0\250\336\25\0\266\336\25\0\24\30\25\0\377\377\0\0\0\0\0\0\24\30\25\0\7\0\0\0\250\336\25\0t\360\22\0\177;\245q\0\0\0\0\0\0\0\0\250\336\25\0\0\0\0\0\24\30\25\0\377\377\0\0\1\0\0\0\210\1\24\0x\23\25\0\4\0\0\0\0\0\0\0\210\1\24\0p\23\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q\10\30\25\0\364\27\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\30*\1\1\0\0\24\0\14\360\22\0\354\364\22\0\274\373\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\30*\25\0\340\260\25\0\310\266\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) , 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 04308   312   NtClose  (404, ... ) == 0x0
 04309   312   NtClose  (376, ... ) == 0x0
 04310   312   NtUserGetMessage  (0, 0, 0, ...
 04251   548   NtWaitForSingleObject  ... ) == 0x102
 04311   548   NtQuerySystemTime  (... {-2096841020, 29873119}, ) == 0x0
 04312   548   NtWaitForSingleObject  (140, 1, {-1, 2147483647}, ... ) == 0x0
 04313   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04314   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04315   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04316   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04317   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04318   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04319   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04320   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04321   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04322   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04323   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04324   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04325   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04326   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04327   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04328   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04329   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04330   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04331   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04332   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04333   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04334   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04335   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04336   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04337   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04338   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04339   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04340   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04341   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04342   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04343   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04344   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04345   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04346   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04347   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04348   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04349   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=161}, 0x0, ) , 16, 0, ... {status=0x0, info=161}, 0x0, ) == 0x0
 04350   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04351   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04352   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04353   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04354   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04355   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04356   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04357   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04358   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04359   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04360   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04361   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04362   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04363   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04364   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04365   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04366   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04367   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04368   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04369   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04370   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04371   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04372   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04373   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04374   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04375   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04376   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04377   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04378   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04379   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04380   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04381   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04382   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04383   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04384   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04385   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04386   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04387   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04388   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04389   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04390   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04391   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04392   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04393   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04394   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04395   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04396   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04397   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04398   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04399   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04400   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04401   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04402   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04403   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04404   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04405   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04406   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04407   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04408   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04409   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04410   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04411   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04412   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04413   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04414   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04415   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04416   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04417   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04418   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04419   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04420   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04421   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04422   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04423   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04424   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04425   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04426   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04427   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04428   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04429   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04430   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04431   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04432   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04433   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04434   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04435   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04436   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04437   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04438   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04439   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04440   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04441   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04442   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04443   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04444   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04445   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04446   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04447   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04448   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04449   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04450   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04451   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04452   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04453   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04454   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04455   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04456   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04457   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04458   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04459   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04460   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04461   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04462   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04463   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04464   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04465   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04466   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04467   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04468   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04469   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04470   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04471   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04472   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04473   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04474   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04475   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04476   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04477   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04478   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04479   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04480   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04481   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04482   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04483   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04484   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04485   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04486   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04487   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04488   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04489   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04490   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04491   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04492   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04493   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04494   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04495   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04496   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04497   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04498   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04499   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04500   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04501   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04502   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04503   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04504   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04505   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04506   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04507   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04508   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04509   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04510   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04511   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04512   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04513   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04514   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04515   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04516   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04517   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04518   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04519   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04520   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04521   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04522   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04523   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04524   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04525   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04526   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04527   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04528   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04529   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04530   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04531   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04532   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04533   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04534   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04535   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04536   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04537   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04538   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04539   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04540   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04541   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04542   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04543   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04544   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04545   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04546   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04547   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04548   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04549   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04550   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04551   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04552   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04553   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04554   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04555   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04556   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04557   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04558   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04559   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04560   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04561   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04562   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04563   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04564   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04565   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04566   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04567   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04568   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04569   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04570   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04571   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04572   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04573   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04574   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04575   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04576   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04577   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04578   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04579   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04580   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04581   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04582   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04583   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04584   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04585   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04586   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04587   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04588   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04589   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04590   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04591   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04592   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04593   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04594   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04595   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04596   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04597   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04598   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04599   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04600   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04601   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04602   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04603   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04604   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04605   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04606   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04607   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04608   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04609   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04610   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04611   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04612   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04613   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04614   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04615   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04616   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04617   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04618   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04619   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04620   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04621   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04622   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04623   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04624   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04625   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04626   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04627   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04628   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04629   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04630   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04631   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04632   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04633   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04634   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04635   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04636   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04637   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04638   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04639   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04640   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04641   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04642   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04643   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04644   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04645   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04646   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04647   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04648   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04649   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04650   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04651   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04652   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04653   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04654   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04655   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04656   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04657   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04658   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04659   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04660   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04661   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04662   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04663   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04664   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04665   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04666   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04667   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04668   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04669   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04670   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04671   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04672   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04673   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04674   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04675   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04676   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04677   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04678   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04679   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04680   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04681   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04682   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04683   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04684   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04685   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04686   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04687   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04688   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04689   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04690   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04691   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04692   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04693   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04694   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04695   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04696   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04697   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04698   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04699   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04700   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04701   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04702   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04703   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04704   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04705   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04706   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04707   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04708   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04709   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04710   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04711   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04712   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04713   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04714   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04715   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04716   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04717   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04718   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04719   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04720   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04721   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04722   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04723   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04724   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04725   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04726   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04727   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04728   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04729   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04730   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04731   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04732   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04733   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04734   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04735   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04736   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04737   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04738   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04739   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04740   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04741   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04742   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04743   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04744   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04745   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04746   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04747   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04748   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04749   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04750   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04751   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04752   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04753   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04754   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04755   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04756   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04757   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04758   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x103
 04759   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04760   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04761   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04762   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04763   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04764   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04765   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04766   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04767   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04768   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04769   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04770   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04771   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04772   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04773   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04774   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04775   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04776   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04777   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04778   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04779   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04780   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04781   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04782   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04783   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04784   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04785   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04786   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04787   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04788   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04789   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04790   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04791   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04792   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04793   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04794   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04795   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04796   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04797   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04798   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04799   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04800   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04801   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04802   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04803   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04804   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04805   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04806   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04807   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04808   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04809   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04810   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04811   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04812   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04813   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04814   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04815   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04816   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04817   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04818   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04819   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04820   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04821   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04822   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04823   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04824   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04825   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04826   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04827   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04828   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04829   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04830   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04831   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04832   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04833   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04834   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04835   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04836   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04837   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04838   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04839   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04840   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04841   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04842   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04843   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04844   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04845   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04846   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04847   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04848   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04849   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04850   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04851   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04852   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04853   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04854   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04855   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04856   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04857   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04858   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04859   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04860   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04861   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04862   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04863   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04864   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04865   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04866   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04867   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04868   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04869   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04870   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04871   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04872   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04873   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04874   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04875   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04876   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04877   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04878   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04879   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04880   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04881   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04882   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04883   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04884   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04885   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04886   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04887   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04888   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04889   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04890   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04891   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04892   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04893   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04894   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04895   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04896   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04897   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04898   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04899   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04900   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04901   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04902   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04903   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04904   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04905   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04906   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04907   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04908   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04909   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04910   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04911   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04912   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04913   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04914   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04915   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04916   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04917   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04918   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04919   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04920   548   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04921   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04922   548   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103